#!/usr/bin/env python3
import winreg
import ctypes
from ctypes import wintypes

keys = [
    ('JD', 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\JD'),
    ('Skew1', 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\Skew1'),
    ('GBG', 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\GBG'),
    ('Data', 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\Data'),
]

advapi32 = ctypes.windll.advapi32

for name, path in keys:
    try:
        k = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, path)
        hkey = k.handle.value
        
        # Get class via RegQueryInfoKeyW
        buf = ctypes.create_unicode_buffer(256)
        bufsz = wintypes.DWORD(256)
        
        result = advapi32.RegQueryInfoKeyW(
            hkey,           # hKey
            buf,            # lpClass
            ctypes.byref(bufsz),  # lpcbClass
            None,           # lpReserved
            None,           # lpdwSubKeys
            None,           # lpcbMaxSubKeyLen
            None,           # lpcbMaxClassLen
            None,           # lpdwValues
            None,           # lpcbMaxValueNameLen
            None,           # lpcbMaxValueLen
            None,           # lpcbSecurityDescriptor
            None            # lpftLastWriteTime
        )
        
        if result == 0:
            # Class name is a null-terminated wide string
            # The boot key is the 16-byte binary data packed in a string
            raw = buf.value.encode('utf-16-le')[:32]
            print(f'{name} ({buf.value}): {raw.hex()} [{len(buf.value)} chars]')
        else:
            print(f'{name}: RegQueryInfoKeyW failed with {result}')
        
        # Also list values
        nvalues = winreg.QueryInfoKey(k)[1]
        for i in range(nvalues):
            vname, vdata, vtype = winreg.EnumValue(k, i)
            if vtype == winreg.REG_BINARY:
                print(f'  Value {vname}: {vdata.hex()}')
            else:
                print(f'  Value {vname}: {vdata}')
        
        winreg.CloseKey(k)
    except Exception as e:
        print(f'{name}: Error - {e}')

print()
# Also try: get class through winreg.SetValue which might show it differently
# Let's also check if there's a class by reading all value data
print("=== All SYSTEM\\CurrentControlSet\\Control\\Lsa\\ subkeys ===")
try:
    k = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, 'SYSTEM\\CurrentControlSet\\Control\\Lsa')
    for i in range(winreg.QueryInfoKey(k)[0]):
        subname = winreg.EnumKey(k, i)
        try:
            sk = winreg.OpenKey(k, subname)
            info = winreg.QueryInfoKey(sk)
            print(f'{subname}: subkeys={info[0]}, values={info[1]}')
            winreg.CloseKey(sk)
        except:
            print(f'{subname}: error')
    winreg.CloseKey(k)
except Exception as e:
    print(f'Error: {e}')
#!/usr/bin/env python3
import winreg
import ctypes
from ctypes import wintypes

keys = [
    ('JD', 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\JD'),
    ('Skew1', 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\Skew1'),
    ('GBG', 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\GBG'),
    ('Data', 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\Data'),
]

advapi32 = ctypes.windll.advapi32

for name, path in keys:
    try:
        k = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, path)
        hkey = int(k.handle)  # In Python 3.12, handle is already an int
        
        buf = ctypes.create_unicode_buffer(256)
        bufsz = wintypes.DWORD(256)
        
        result = advapi32.RegQueryInfoKeyW(
            hkey, buf, ctypes.byref(bufsz),
            None, None, None, None, None, None, None, None, None
        )
        
        if result == 0:
            raw = buf.value.encode('utf-16-le')[:32]
            print(f'{name}: class_raw={raw.hex()} chars={len(buf.value)} repr={repr(buf.value)}')
        else:
            print(f'{name}: RegQueryInfoKeyW failed={result}')
        
        nvalues = winreg.QueryInfoKey(k)[1]
        for i in range(nvalues):
            vname, vdata, vtype = winreg.EnumValue(k, i)
            if vtype == winreg.REG_BINARY:
                print(f'  [{vname}] = {vdata.hex()}')
            else:
                print(f'  [{vname}] = {vdata}')
        
        winreg.CloseKey(k)
    except Exception as e:
        print(f'{name}: Error - {e}')