github.com/google/osv-scalibr@v0.4.1/detector/weakcredentials/winlocal/samreg/userf.go (about)

     1  // Copyright 2025 Google LLC
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //      http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package samreg
    16  
    17  import "errors"
    18  
    19  const (
    20  	userFAccountEnabledOffset = 0x38
    21  )
    22  
    23  var (
    24  	errUserFTooShort = errors.New("userF structure is too short")
    25  )
    26  
    27  // userF is a lazy-parsed user F structure containing the user's information in the SAM hive.
    28  // Very important: Do not confuse the SAMUSerF and SAMDomainF structures, the first one refers to
    29  // each user's information (is account active, locked, when was password changed, etc.) while the
    30  // second one refers to the domain's information (password policy, portion of the syskey).
    31  // See https://web.archive.org/web/20190717124313/http://www.beginningtoseethelight.org/ntsecurity/index.htm#8603CF0AFBB170DD
    32  // for more information about the F user structure.
    33  type userF struct {
    34  	buffer []byte
    35  	rid    string
    36  }
    37  
    38  // newUserF creates a new lazy-parsed F structure from the SAM hive.
    39  func newUserF(data []byte, rid string) *userF {
    40  	return &userF{
    41  		buffer: data,
    42  		rid:    rid,
    43  	}
    44  }
    45  
    46  // Enabled returns whether the user is enabled or not.
    47  func (s *userF) Enabled() (bool, error) {
    48  	if len(s.buffer) < userFAccountEnabledOffset+1 {
    49  		return false, errUserFTooShort
    50  	}
    51  
    52  	return (s.buffer[userFAccountEnabledOffset] & 0x01) == 0x00, nil
    53  }