public BlockTxNode ReadNode()
{
var blockIndexColumn = new Int32ColumnValue {
Columnid = cursor.blockIndexColumnId
};
var txIndexColumn = new Int32ColumnValue {
Columnid = cursor.txIndexColumnId
};
var depthColumn = new Int32ColumnValue {
Columnid = cursor.blockDepthColumnId
};
var txHashColumn = new BytesColumnValue {
Columnid = cursor.blockTxHashColumnId
};
Api.RetrieveColumns(cursor.jetSession, cursor.blocksTableId, blockIndexColumn, txIndexColumn, depthColumn, txHashColumn);
if (this.blockIndex != blockIndexColumn.Value.Value)
{
throw new InvalidOperationException();
}
var txIndex = txIndexColumn.Value.Value;
var depth = depthColumn.Value.Value;
var txHash = DbEncoder.DecodeUInt256(txHashColumn.Value);
var pruned = depth >= 0;
depth = Math.Max(0, depth);
return(new BlockTxNode(txIndex, depth, txHash, pruned, encodedTx: null));
}
public void TestBytesColumnValueToString()
{
var instance = new BytesColumnValue {
Value = BitConverter.GetBytes(0x1122334455667788UL)
};
Assert.AreEqual("88-77-66-55-44-33-22-11", instance.ToString());
}
public void TestNullBytesColumnValueToString()
{
var instance = new BytesColumnValue {
Value = null
};
Assert.AreEqual(string.Empty, instance.ToString());
}
public void TestBytesValueAsObject()
{
byte[] data = Any.Bytes;
var instance = new BytesColumnValue {
Value = data
};
Assert.AreEqual(data, instance.ValueAsObject);
}
public MediaDataView(MediaFilesTable table)
{
_table = table;
_c = new ColumnValue[1];
_c[0] = new BytesColumnValue()
{
Columnid = _table.ColumnDictionary[MediaFilesTable.Column.MediaData],
RetrieveGrbit = RetrieveColumnGrbit.None
};
}
public void TestBytesLength()
{
byte[] data = Any.Bytes;
var instance = new BytesColumnValue {
Value = data
};
Assert.AreEqual(data.Length, instance.Length);
instance = new BytesColumnValue {
Value = null
};
Assert.AreEqual(0, instance.Length);
}
public bool TryGetTransaction(UInt256 blockHash, int txIndex, out BlockTx transaction)
{
using (var handle = this.cursorCache.TakeItem())
{
var cursor = handle.Item;
using (var jetTx = cursor.jetSession.BeginTransaction())
{
int blockIndex;
if (!TryGetBlockIndex(cursor, blockHash, out blockIndex))
{
transaction = null;
return(false);
}
Api.JetSetCurrentIndex(cursor.jetSession, cursor.blocksTableId, "IX_BlockIndexTxIndex");
Api.MakeKey(cursor.jetSession, cursor.blocksTableId, blockIndex, MakeKeyGrbit.NewKey);
Api.MakeKey(cursor.jetSession, cursor.blocksTableId, txIndex, MakeKeyGrbit.None);
if (Api.TrySeek(cursor.jetSession, cursor.blocksTableId, SeekGrbit.SeekEQ))
{
var blockTxHashColumn = new BytesColumnValue {
Columnid = cursor.blockTxHashColumnId
};
var blockTxBytesColumn = new BytesColumnValue {
Columnid = cursor.blockTxBytesColumnId
};
Api.RetrieveColumns(cursor.jetSession, cursor.blocksTableId, blockTxHashColumn, blockTxBytesColumn);
if (blockTxBytesColumn.Value != null)
{
var txHash = DbEncoder.DecodeUInt256(blockTxHashColumn.Value);
transaction = new BlockTx(txIndex, txHash, blockTxBytesColumn.Value.ToImmutableArray());
return(true);
}
else
{
transaction = null;
return(false);
}
}
else
{
transaction = null;
return(false);
}
}
}
}
public InsertView(MediaFilesTable table)
{
_table = table;
_c = new ColumnValue[2];
_c[0] = new Int64ColumnValue()
{
Columnid = _table.ColumnDictionary[MediaFilesTable.Column.SequenceNumber],
SetGrbit = SetColumnGrbit.None
};
_c[1] = new BytesColumnValue()
{
Columnid = _table.ColumnDictionary[MediaFilesTable.Column.MediaData],
SetGrbit = SetColumnGrbit.None
};
}
private IEnumerable <UnspentTx> ReadUnspentTransactionsInner()
{
using (SetSessionContext())
{
Api.JetSetCurrentIndex(this.jetSession, this.unspentTxTableId, "IX_TxHash");
if (Api.TryMoveFirst(this.jetSession, this.unspentTxTableId))
{
do
{
var txHashColumn = new BytesColumnValue {
Columnid = this.txHashColumnId
};
var blockIndexColumn = new Int32ColumnValue {
Columnid = this.blockIndexColumnId
};
var txIndexColumn = new Int32ColumnValue {
Columnid = this.txIndexColumnId
};
var txVersionColumn = new UInt32ColumnValue {
Columnid = this.txVersionColumnId
};
var isCoinbaseColumn = new BoolColumnValue {
Columnid = this.isCoinbaseColumnId
};
var outputStatesColumn = new BytesColumnValue {
Columnid = this.outputStatesColumnId
};
var txOutputBytesColumn = new BytesColumnValue {
Columnid = this.txOutputBytesColumnId
};
Api.RetrieveColumns(this.jetSession, this.unspentTxTableId, txHashColumn, blockIndexColumn, txIndexColumn, txVersionColumn, isCoinbaseColumn, outputStatesColumn, txOutputBytesColumn);
var txHash = DbEncoder.DecodeUInt256(txHashColumn.Value);
var blockIndex = blockIndexColumn.Value.Value;
var txIndex = txIndexColumn.Value.Value;
var txVersion = txVersionColumn.Value.Value;
var isCoinbase = isCoinbaseColumn.Value.Value;
var outputStates = DataDecoder.DecodeOutputStates(outputStatesColumn.Value);
yield return(new UnspentTx(txHash, blockIndex, txIndex, txVersion, isCoinbase, outputStates));
}while (Api.TryMoveNext(this.jetSession, this.unspentTxTableId));
}
}
}
public bool TryGetUnspentTx(UInt256 txHash, out UnspentTx unspentTx)
{
CheckTransaction();
using (SetSessionContext())
{
Api.JetSetCurrentIndex(this.jetSession, this.unspentTxTableId, "IX_TxHash");
Api.MakeKey(this.jetSession, this.unspentTxTableId, DbEncoder.EncodeUInt256(txHash), MakeKeyGrbit.NewKey);
if (Api.TrySeek(this.jetSession, this.unspentTxTableId, SeekGrbit.SeekEQ))
{
var blockIndexColumn = new Int32ColumnValue {
Columnid = this.blockIndexColumnId
};
var txIndexColumn = new Int32ColumnValue {
Columnid = this.txIndexColumnId
};
var txVersionColumn = new UInt32ColumnValue {
Columnid = this.txVersionColumnId
};
var isCoinbaseColumn = new BoolColumnValue {
Columnid = this.isCoinbaseColumnId
};
var outputStatesColumn = new BytesColumnValue {
Columnid = this.outputStatesColumnId
};
var txOutputBytesColumn = new BytesColumnValue {
Columnid = this.txOutputBytesColumnId
};
Api.RetrieveColumns(this.jetSession, this.unspentTxTableId, blockIndexColumn, txIndexColumn, txVersionColumn, isCoinbaseColumn, outputStatesColumn, txOutputBytesColumn);
var blockIndex = blockIndexColumn.Value.Value;
var txIndex = txIndexColumn.Value.Value;
var txVersion = txVersionColumn.Value.Value;
var isCoinbase = isCoinbaseColumn.Value.Value;
var outputStates = DataDecoder.DecodeOutputStates(outputStatesColumn.Value);
unspentTx = new UnspentTx(txHash, blockIndex, txIndex, txVersion, isCoinbase, outputStates);
return(true);
}
unspentTx = default(UnspentTx);
return(false);
}
}
private void InitColumns()
{
_colIdInstanceLabel = Api.GetTableColumnid(Sesid, Table, colNameInstanceLabel);
_colIdIfcTypeId = Api.GetTableColumnid(Sesid, Table, colNameIfcTypeId);
_colIdIfcProductLabel = Api.GetTableColumnid(Sesid, Table, colNameIfcProductLabel);
_colIdStyleLabel = Api.GetTableColumnid(Sesid, Table, colNameStyleLabel);
_colIdShapeLabel = Api.GetTableColumnid(Sesid, Table, colNameShapeLabel);
_colIdRepresentationContext = Api.GetTableColumnid(Sesid, Table, colNameRepresentationContext);
_colIdRepType = Api.GetTableColumnid(Sesid, Table, colNameRepType);
_colIdTransformation = Api.GetTableColumnid(Sesid, Table, colNameTransformation);
_colIdBoundingBox = Api.GetTableColumnid(Sesid, Table, colNameBoundingBox);
_colValInstanceLabel = new Int32ColumnValue {
Columnid = _colIdInstanceLabel
};
_colValIfcTypeId = new Int16ColumnValue {
Columnid = _colIdIfcTypeId
};
_colValIfcProductLabel = new Int32ColumnValue {
Columnid = _colIdIfcProductLabel
};
_colValStyleLabel = new Int32ColumnValue {
Columnid = _colIdStyleLabel
};
_colValShapeLabel = new Int32ColumnValue {
Columnid = _colIdShapeLabel
};
_colValRepresentationContext = new Int32ColumnValue {
Columnid = _colIdRepresentationContext
};
_colValRepType = new ByteColumnValue {
Columnid = _colIdRepType
};
_colValTransformation = new BytesColumnValue {
Columnid = _colIdTransformation
};
_colValBoundingBox = new BytesColumnValue {
Columnid = _colIdBoundingBox
};
_colValues = new ColumnValue[] { _colValIfcTypeId, _colValIfcProductLabel, _colValStyleLabel, _colValShapeLabel, _colValRepresentationContext, _colValRepType, _colValTransformation, _colValBoundingBox, };
}
private void InitColumns()
{
_colIdShapeLabel = Api.GetTableColumnid(Sesid, Table, colNameShapeLabel);
_colIdIfcShapeLabel = Api.GetTableColumnid(Sesid, Table, colNameIfcShapeLabel);
_colIdGeometryHash = Api.GetTableColumnid(Sesid, Table, colNameGeometryHash);
_colIdCost = Api.GetTableColumnid(Sesid, Table, colNameCost);
_colIdReferenceCount = Api.GetTableColumnid(Sesid, Table, colNameReferenceCount);
_colIdLOD = Api.GetTableColumnid(Sesid, Table, colNameLOD);
_colIdFormat = Api.GetTableColumnid(Sesid, Table, colNameFormat);
_colIdBoundingBox = Api.GetTableColumnid(Sesid, Table, colNameBoundingBox);
_colIdShapeData = Api.GetTableColumnid(Sesid, Table, colNameShapeData);
_colValShapeLabel = new Int32ColumnValue {
Columnid = _colIdShapeLabel
};
_colValIfcShapeLabel = new Int32ColumnValue {
Columnid = _colIdIfcShapeLabel
};
_colValGeometryHash = new Int32ColumnValue {
Columnid = _colIdGeometryHash
};
_colValCost = new Int32ColumnValue {
Columnid = _colIdCost
};
_colValReferenceCount = new Int32ColumnValue {
Columnid = _colIdReferenceCount
};
_colValLOD = new ByteColumnValue {
Columnid = _colIdLOD
};
_colValFormat = new ByteColumnValue {
Columnid = _colIdFormat
};
_colValBoundingBox = new BytesColumnValue {
Columnid = _colIdBoundingBox
};
_colValShapeData = new BytesColumnValue {
Columnid = _colIdShapeData
};
_colValues = new ColumnValue[] { _colValIfcShapeLabel, _colValGeometryHash, _colValCost, _colValReferenceCount, _colValLOD, _colValFormat, _colValBoundingBox, _colValShapeData };
}
private void InitColumns()
{
_colIdGeometryLabel = Api.GetTableColumnid(Sesid, Table, ColNameGeometryLabel);
_colIdGeomType = Api.GetTableColumnid(Sesid, Table, ColNameGeomType);
_colIdProductIfcTypeId = Api.GetTableColumnid(Sesid, Table, ColNameProductIfcTypeId);
_colIdProductLabel = Api.GetTableColumnid(Sesid, Table, ColNameProductLabel);
_colIdSubPart = Api.GetTableColumnid(Sesid, Table, ColNameSubPart);
_colIdTransformMatrix = Api.GetTableColumnid(Sesid, Table, ColNameTransformMatrix);
_colIdShapeData = Api.GetTableColumnid(Sesid, Table, ColNameShapeData);
_colIdGeometryHash = Api.GetTableColumnid(Sesid, Table, ColNameGeometryHash);
_colIdStyleLabel = Api.GetTableColumnid(Sesid, Table, ColNameStyleLabel);
_colValGeometryLabel = new Int32ColumnValue {
Columnid = _colIdGeometryLabel
};
_colValGeomType = new ByteColumnValue {
Columnid = _colIdGeomType
};
_colValProductIfcTypeId = new Int16ColumnValue {
Columnid = _colIdProductIfcTypeId
};
_colValProductLabel = new Int32ColumnValue {
Columnid = _colIdProductLabel
};
_colValSubPart = new Int16ColumnValue {
Columnid = _colIdSubPart
};
_colValTransformMatrix = new BytesColumnValue {
Columnid = _colIdTransformMatrix
};
_colValShapeData = new BytesColumnValue {
Columnid = _colIdShapeData
};
_colValGeometryHash = new Int32ColumnValue {
Columnid = _colIdGeometryHash
};
_colValStyleLabel = new Int32ColumnValue {
Columnid = _colIdStyleLabel
};
_colValues = new ColumnValue[] { _colValGeomType, _colValProductLabel, _colValProductIfcTypeId, _colValSubPart, _colValTransformMatrix, _colValShapeData, _colValGeometryHash, _colValStyleLabel };
}
/// <summary>
/// Insert multiple records with the <see cref="Api.SetColumns"/> API.
/// </summary>
/// <param name="numRecords">The number of records to insert.</param>
public void InsertRecordsWithSetColumns(int numRecords)
{
var keyColumn = new Int64ColumnValue {
Columnid = this.columnidKey
};
var dataColumn = new BytesColumnValue {
Columnid = this.columnidData, Value = this.data
};
var columns = new ColumnValue[] { keyColumn, dataColumn };
for (int i = 0; i < numRecords; ++i)
{
Api.JetBeginTransaction(this.session);
Api.JetPrepareUpdate(this.session, this.table, JET_prep.Insert);
keyColumn.Value = this.GetNextKey();
Api.SetColumns(this.session, this.table, columns);
Api.JetUpdate(this.session, this.table);
Api.JetCommitTransaction(this.session, CommitTransactionGrbit.LazyFlush);
}
}
private void InitColumns()
{
// IDictionary<string, JET_COLUMNID> columnids = Api.GetColumnDictionary(_jetSession, _jetCursor);
_colIdHeaderId = Api.GetTableColumnid(_jetSession, _jetCursor, _colNameHeaderId);
_colIdEntityCount = Api.GetTableColumnid(_jetSession, _jetCursor, _colNameEntityCount);
_colIdFileVersion = Api.GetTableColumnid(_jetSession, _jetCursor, _colNameFileVersion);
_colIdHeaderData = Api.GetTableColumnid(_jetSession, _jetCursor, _colNameHeaderData);
_colValHeaderId = new Int32ColumnValue {
Columnid = _colIdHeaderId
};
_colValEntityCount = new Int64ColumnValue {
Columnid = _colIdEntityCount
};
_colValFileVersion = new StringColumnValue {
Columnid = _colIdFileVersion
};
_colValHeaderData = new BytesColumnValue {
Columnid = _colIdHeaderData
};
}
private void InitColumns()
{
// The main entity Table
_colIdEntityLabel = Api.GetTableColumnid(Sesid, Table, colNameEntityLabel);
_colIdIfcType = Api.GetTableColumnid(Sesid, Table, colNameIfcType);
_colIdEntityData = Api.GetTableColumnid(Sesid, Table, colNameEntityData);
_colIdIsIndexedClass = Api.GetTableColumnid(Sesid, Table, colNameIsIndexedClass);
_colValEntityLabel = new Int32ColumnValue {
Columnid = _colIdEntityLabel
};
_colValTypeId = new Int16ColumnValue {
Columnid = _colIdIfcType
};
_colValData = new BytesColumnValue {
Columnid = _colIdEntityData
};
_colValIsIndexedClass = new BoolColumnValue {
Columnid = _colIdIsIndexedClass
};
_colValues = new ColumnValue[] { _colValEntityLabel, _colValTypeId, _colValData, _colValIsIndexedClass };
//The index table
_colIdIdxIfcType = Api.GetTableColumnid(Sesid, _indexTable, colNameIfcType);
_colValIdxIfcType = new Int16ColumnValue {
Columnid = _colIdIdxIfcType
};
_colIdIdxKey = Api.GetTableColumnid(Sesid, _indexTable, colNameSecondaryKey);
_colValIdxKey = new Int32ColumnValue {
Columnid = _colIdIdxKey
};
_colIdIdxEntityLabel = Api.GetTableColumnid(Sesid, _indexTable, colNameEntityLabel);
_colValIdxEntityLabel = new Int32ColumnValue {
Columnid = _colIdIdxEntityLabel
};
_colIdxValues = new ColumnValue[] { _colValIdxIfcType, _colValIdxKey, _colValIdxEntityLabel };
}
public bool TryGetUnspentTxOutput(TxOutputKey txOutputKey, out TxOutput txOutput)
{
CheckTransaction();
using (SetSessionContext())
{
Api.JetSetCurrentIndex(this.jetSession, this.unspentTxOutputTableId, "IX_TxOutputKey");
Api.MakeKey(this.jetSession, this.unspentTxOutputTableId, DbEncoder.EncodeTxOutputKey(txOutputKey), MakeKeyGrbit.NewKey);
if (Api.TrySeek(this.jetSession, this.unspentTxOutputTableId, SeekGrbit.SeekEQ))
{
var txOutputBytesColumn = new BytesColumnValue {
Columnid = this.txOutputBytesColumnId
};
Api.RetrieveColumns(this.jetSession, this.unspentTxOutputTableId, txOutputBytesColumn);
txOutput = DataDecoder.DecodeTxOutput(txOutputBytesColumn.Value);
return(true);
}
txOutput = default(TxOutput);
return(false);
}
}
private static DatatableRow[] EnumerateDatatableTable(JetDb db, IReadOnlyDictionary <string, string> ldapDisplayNameToDatatableColumnNameDictionary, bool dumpHashes, bool includeHistoryHashes)
{
Stopwatch stopwatch = null;
if (ShowDebugOutput)
{
ConsoleEx.WriteDebug($"Called: {nameof(NtdsAudit)}::{nameof(EnumerateDatatableTable)}");
stopwatch = new Stopwatch();
stopwatch.Start();
}
var datatable = new List <DatatableRow>();
var deletedCount = 0;
using (var table = db.OpenJetDbTable(DATATABLE))
{
// Get a dictionary mapping column names to column ids
var columnDictionary = table.GetColumnDictionary();
// Loop over the table
table.MoveBeforeFirst();
while (table.TryMoveNext())
{
var accountExpiresColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["accountExpires"]]
};
var displayNameColumn = new StringColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["displayName"]]
};
var distinguishedNameTagColumn = new Int32ColumnValue {
Columnid = columnDictionary["DNT_col"]
};
var groupTypeColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["groupType"]]
};
var isDeletedColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["isDeleted"]]
};
var lastLogonColumn = new LdapDateTimeColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["lastLogonTimestamp"]]
};
var lmColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["dBCSPwd"]]
};
var lmHistoryColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["lmPwdHistory"]]
};
var nameColumn = new StringColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["name"]]
};
var ntColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["unicodePwd"]]
};
var ntHistoryColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["ntPwdHistory"]]
};
var objColumn = new BoolColumnValue {
Columnid = columnDictionary["OBJ_col"]
};
var objectCategoryColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["objectCategory"]]
};
var objectSidColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["objectSid"]]
};
var parentDistinguishedNameTagColumn = new Int32ColumnValue {
Columnid = columnDictionary["PDNT_col"]
};
var passwordLastSetColumn = new LdapDateTimeColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["pwdLastSet"]]
};
var pekListColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["pekList"]]
};
var primaryGroupIdColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["primaryGroupID"]]
};
var rdnTypeColumn = new Int32ColumnValue {
Columnid = columnDictionary["RDNtyp_col"]
}; // The RDNTyp_col holds the Attribute-ID for the attribute being used as the RDN, such as CN, OU, DC
var samAccountNameColumn = new StringColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["sAMAccountName"]]
};
var timeColumn = new LdapDateTimeColumnValue {
Columnid = columnDictionary["time_col"]
};
var userAccountControlColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["userAccountControl"]]
};
var supplementalCredentialsColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["supplementalCredentials"]]
};
var columns = new List <ColumnValue>
{
accountExpiresColumn,
displayNameColumn,
distinguishedNameTagColumn,
groupTypeColumn,
isDeletedColumn,
lastLogonColumn,
nameColumn,
objColumn,
objectCategoryColumn,
objectSidColumn,
parentDistinguishedNameTagColumn,
passwordLastSetColumn,
primaryGroupIdColumn,
rdnTypeColumn,
samAccountNameColumn,
timeColumn,
userAccountControlColumn,
};
if (dumpHashes)
{
columns.Add(pekListColumn);
columns.Add(lmColumn);
columns.Add(ntColumn);
columns.Add(supplementalCredentialsColumn);
if (includeHistoryHashes)
{
columns.Add(lmHistoryColumn);
columns.Add(ntHistoryColumn);
}
}
table.RetrieveColumns(columns.ToArray());
// Skip deleted objects
if (isDeletedColumn.Value.HasValue && isDeletedColumn.Value != 0)
{
deletedCount++;
continue;
}
// Some deleted objects do not have the isDeleted flag but do have a string appended to the DN (https://support.microsoft.com/en-us/help/248047/phantoms--tombstones-and-the-infrastructure-master)
if (nameColumn.Value?.Contains("\nDEL:") ?? false)
{
deletedCount++;
continue;
}
SecurityIdentifier sid = null;
uint rid = 0;
if (objectSidColumn.Error == JET_wrn.Success)
{
var sidBytes = objectSidColumn.Value;
var ridBytes = sidBytes.Skip(sidBytes.Length - sizeof(int)).Take(sizeof(int)).Reverse().ToArray();
sidBytes = sidBytes.Take(sidBytes.Length - sizeof(int)).Concat(ridBytes).ToArray();
rid = BitConverter.ToUInt32(ridBytes, 0);
sid = new SecurityIdentifier(sidBytes, 0);
}
var row = new DatatableRow
{
AccountExpires = accountExpiresColumn.Value,
DisplayName = displayNameColumn.Value,
Dnt = distinguishedNameTagColumn.Value,
GroupType = groupTypeColumn.Value,
LastLogon = lastLogonColumn.Value,
Name = nameColumn.Value,
ObjectCategoryDnt = objectCategoryColumn.Value,
Rid = rid,
Sid = sid,
ParentDnt = parentDistinguishedNameTagColumn.Value,
Phantom = objColumn.Value == false,
LastPasswordChange = passwordLastSetColumn.Value,
PrimaryGroupDnt = primaryGroupIdColumn.Value,
RdnType = rdnTypeColumn.Value,
SamAccountName = samAccountNameColumn.Value,
UserAccountControlValue = userAccountControlColumn.Value,
};
if (dumpHashes)
{
if (pekListColumn.Value != null)
{
row.PekList = pekListColumn.Value;
}
if (lmColumn.Value != null)
{
row.EncryptedLmHash = lmColumn.Value;
}
if (ntColumn.Value != null)
{
row.EncryptedNtHash = ntColumn.Value;
}
if (includeHistoryHashes)
{
if (lmHistoryColumn.Value != null)
{
row.EncryptedLmHistory = lmHistoryColumn.Value;
}
if (ntHistoryColumn.Value != null)
{
row.EncryptedNtHistory = ntHistoryColumn.Value;
}
}
if (supplementalCredentialsColumn.Value != null)
{
row.SupplementalCredentialsBlob = supplementalCredentialsColumn.Value;
}
}
datatable.Add(row);
}
}
if (ShowDebugOutput)
{
ConsoleEx.WriteDebug($" Skipped {deletedCount} deleted objects");
ConsoleEx.WriteDebug($" Enumerated {datatable.Count} objects");
stopwatch.Stop();
ConsoleEx.WriteDebug($" Completed in {stopwatch.Elapsed}");
}
return(datatable.ToArray());
}
private DatatableRow[] EnumerateDatatableTable(Dictionary <string, string> ldapDisplayNameToDatatableColumnNameDictionary)
{
var datatable = new List <DatatableRow>();
var deletedCount = 0;
wrn = Api.JetOpenTable(sesId, dbId, DATATABLE, null, 0, OpenTableGrbit.ReadOnly | OpenTableGrbit.Sequential, out _tableid);
if (wrn == JET_wrn.Success)
{
// 获取将列名称映射到列ID的字典
var columnDictionary = Api.GetColumnDictionary(sesId, _tableid);
// 遍历所有表
Api.MoveBeforeFirst(sesId, _tableid);
while (Api.TryMoveNext(sesId, _tableid))
{
var accountExpiresColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["accountExpires"]]
};
var displayNameColumn = new StringColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["displayName"]]
};
var distinguishedNameTagColumn = new Int32ColumnValue {
Columnid = columnDictionary["DNT_col"]
};
var groupTypeColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["groupType"]]
};
var isDeletedColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["isDeleted"]]
};
var lastLogonColumn = new LdapDateTimeColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["lastLogonTimestamp"]]
};
var lmColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["dBCSPwd"]]
};
var lmHistoryColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["lmPwdHistory"]]
};
var nameColumn = new StringColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["name"]]
};
var ntColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["unicodePwd"]]
};
var ntHistoryColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["ntPwdHistory"]]
};
var objColumn = new BoolColumnValue {
Columnid = columnDictionary["OBJ_col"]
};
var objectCategoryColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["objectCategory"]]
};
var objectSidColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["objectSid"]]
};
var parentDistinguishedNameTagColumn = new Int32ColumnValue {
Columnid = columnDictionary["PDNT_col"]
};
var passwordLastSetColumn = new LdapDateTimeColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["pwdLastSet"]]
};
var pekListColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["pekList"]]
};
var primaryGroupIdColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["primaryGroupID"]]
};
var rdnTypeColumn = new Int32ColumnValue {
Columnid = columnDictionary["RDNtyp_col"]
}; // The RDNTyp_col holds the Attribute-ID for the attribute being used as the RDN, such as CN, OU, DC
var samAccountNameColumn = new StringColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["sAMAccountName"]]
};
var timeColumn = new LdapDateTimeColumnValue {
Columnid = columnDictionary["time_col"]
};
var userAccountControlColumn = new Int32ColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["userAccountControl"]]
};
var supplementalCredentialsColumn = new BytesColumnValue {
Columnid = columnDictionary[ldapDisplayNameToDatatableColumnNameDictionary["supplementalCredentials"]]
};
var columns = new List <ColumnValue>
{
accountExpiresColumn,
displayNameColumn,
distinguishedNameTagColumn,
groupTypeColumn,
isDeletedColumn,
lastLogonColumn,
nameColumn,
objColumn,
objectCategoryColumn,
objectSidColumn,
parentDistinguishedNameTagColumn,
passwordLastSetColumn,
primaryGroupIdColumn,
rdnTypeColumn,
samAccountNameColumn,
timeColumn,
userAccountControlColumn,
// dumpHashes
pekListColumn,
lmColumn,
ntColumn,
supplementalCredentialsColumn,
// includeHistoryHashes
lmHistoryColumn,
ntHistoryColumn,
};
Api.RetrieveColumns(sesId, _tableid, columns.ToArray());
// 跳过删除的对象
if (isDeletedColumn.Value.HasValue && isDeletedColumn.Value != 0)
{
deletedCount++;
continue;
}
// 一些已删除的对象没有isDeleted标志，但确实在DN后面附加了一个字符串 (https://support.microsoft.com/en-us/help/248047/phantoms--tombstones-and-the-infrastructure-master)
if (nameColumn.Value?.Contains("\nDEL:") ?? false)
{
deletedCount++;
continue;
}
SecurityIdentifier sid = null;
uint rid = 0;
if (objectSidColumn.Error == JET_wrn.Success)
{
var sidBytes = objectSidColumn.Value;
var ridBytes = sidBytes.Skip(sidBytes.Length - sizeof(int)).Take(sizeof(int)).Reverse().ToArray();
sidBytes = sidBytes.Take(sidBytes.Length - sizeof(int)).Concat(ridBytes).ToArray();
rid = BitConverter.ToUInt32(ridBytes, 0);
sid = new SecurityIdentifier(sidBytes, 0);
}
var row = new DatatableRow
{
AccountExpires = accountExpiresColumn.Value,
DisplayName = displayNameColumn.Value,
Dnt = distinguishedNameTagColumn.Value,
GroupType = groupTypeColumn.Value,
LastLogon = lastLogonColumn.Value,
Name = nameColumn.Value,
ObjectCategoryDnt = objectCategoryColumn.Value,
Rid = rid,
Sid = sid,
ParentDnt = parentDistinguishedNameTagColumn.Value,
Phantom = objColumn.Value == false,
LastPasswordChange = passwordLastSetColumn.Value,
PrimaryGroupDnt = primaryGroupIdColumn.Value,
RdnType = rdnTypeColumn.Value,
SamAccountName = samAccountNameColumn.Value,
UserAccountControlValue = userAccountControlColumn.Value,
};
if (pekListColumn.Value != null)
{
row.PekList = pekListColumn.Value;
}
if (lmColumn.Value != null)
{
row.EncryptedLmHash = lmColumn.Value;
}
if (ntColumn.Value != null)
{
row.EncryptedNtHash = ntColumn.Value;
}
if (lmHistoryColumn.Value != null)
{
row.EncryptedLmHistory = lmHistoryColumn.Value;
}
if (ntHistoryColumn.Value != null)
{
row.EncryptedNtHistory = ntHistoryColumn.Value;
}
if (supplementalCredentialsColumn.Value != null)
{
row.SupplementalCredentialsBlob = supplementalCredentialsColumn.Value;
}
datatable.Add(row);
}
}
return(datatable.ToArray());
}
private IEnumerator <BlockTxNode> ReadBlockTransactions(UInt256 blockHash, bool requireTx)
{
using (var handle = this.cursorCache.TakeItem())
{
var cursor = handle.Item;
using (var jetTx = cursor.jetSession.BeginTransaction())
{
int blockIndex;
if (!TryGetBlockIndex(cursor, blockHash, out blockIndex))
{
throw new MissingDataException(blockHash);
}
Api.JetSetCurrentIndex(cursor.jetSession, cursor.blocksTableId, "IX_BlockIndexTxIndex");
Api.MakeKey(cursor.jetSession, cursor.blocksTableId, blockIndex, MakeKeyGrbit.NewKey);
Api.MakeKey(cursor.jetSession, cursor.blocksTableId, 0, MakeKeyGrbit.None);
if (!Api.TrySeek(cursor.jetSession, cursor.blocksTableId, SeekGrbit.SeekGE))
{
throw new MissingDataException(blockHash);
}
Api.MakeKey(cursor.jetSession, cursor.blocksTableId, blockIndex, MakeKeyGrbit.NewKey);
Api.MakeKey(cursor.jetSession, cursor.blocksTableId, int.MaxValue, MakeKeyGrbit.None);
if (!Api.TrySetIndexRange(cursor.jetSession, cursor.blocksTableId, SetIndexRangeGrbit.RangeUpperLimit))
{
throw new MissingDataException(blockHash);
}
do
{
var txIndexColumn = new Int32ColumnValue {
Columnid = cursor.txIndexColumnId
};
var blockDepthColumn = new Int32ColumnValue {
Columnid = cursor.blockDepthColumnId
};
var blockTxHashColumn = new BytesColumnValue {
Columnid = cursor.blockTxHashColumnId
};
var blockTxBytesColumn = new BytesColumnValue {
Columnid = cursor.blockTxBytesColumnId
};
Api.RetrieveColumns(cursor.jetSession, cursor.blocksTableId, txIndexColumn, blockDepthColumn, blockTxHashColumn, blockTxBytesColumn);
var txIndex = txIndexColumn.Value.Value;
var depth = blockDepthColumn.Value.Value;
var txHash = DbEncoder.DecodeUInt256(blockTxHashColumn.Value);
var txBytes = blockTxBytesColumn.Value;
// determine if transaction is pruned by its depth
var pruned = depth >= 0;
depth = Math.Max(0, depth);
if (pruned && requireTx)
{
throw new MissingDataException(blockHash);
}
var blockTxNode = new BlockTxNode(txIndex, depth, txHash, pruned, txBytes?.ToImmutableArray());
yield return(blockTxNode);
}while (Api.TryMoveNext(cursor.jetSession, cursor.blocksTableId));
}
}
}
