windows_decode_access_mask.py

import sys

# Define the access rights and their corresponding bit values
ACCESS_RIGHTS = {
    "DELETE": 0x00010000,
    "READ_CONTROL": 0x00020000,
    "WRITE_DAC": 0x00040000,
    "WRITE_OWNER": 0x00080000,
    "SYNCHRONIZE": 0x00100000,
    "KEY_QUERY_VALUE": 0x00000001,
    "KEY_SET_VALUE": 0x00000002,
    "KEY_CREATE_SUB_KEY": 0x00000004,
    "KEY_ENUMERATE_SUB_KEYS": 0x00000008,
    "KEY_NOTIFY": 0x00000010,
    "KEY_CREATE_LINK": 0x00000020,
}

def decode_access_mask(access_mask):
    print(f"Decoding Access Mask: {access_mask:#010x}")
    for right, bitmask in ACCESS_RIGHTS.items():
        if access_mask & bitmask:
            print(right)

def main():
    if len(sys.argv) != 2:
        print("Usage: python decode_access_mask.py <access_mask>")
        sys.exit(1)

    try:
        access_mask = int(sys.argv[1], 0)  # Automatically handles hex (0x) and decimal input
    except ValueError:
        print("Invalid access mask. Please provide a valid integer.")
        sys.exit(1)

    decode_access_mask(access_mask)

if __name__ == "__main__":
    main()