A Python 3 implementation of DeriveRestrictedAppContainerSidFromAppContainerSidAndRestrictedName.

ac_sid_from_name.py

# coding=utf-8

"""
@author @FlowerCode_
"""

import hashlib

WellKnownChildPackageNames = (
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '001'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '002'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '003'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '004'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '005'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '006'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '007'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '008'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '009'),
    ('Microsoft.MicrosoftEdge_8wekyb3d8bbwe', '121'),
)


def app_container_sid_from_name(app_container_name):
    app_package_authority = 'S-1-15-'

    sha256 = hashlib.sha256()
    sha256.update(app_container_name.lower().encode('utf-16le'))
    binary_hash = sha256.digest()
    sid = [2]

    for i in range(0, 28, 4):
        sid.append(int.from_bytes(bytes=binary_hash[i:i + 4],
                                  byteorder='little',
                                  signed=False))

    return app_package_authority + '-'.join([str(s) for s in sid])


def child_app_container_sid_from_name(parent_app_container_name, child_app_container_name):
    parent_app_container_sid = app_container_sid_from_name(parent_app_container_name)
    child_app_container_sid = app_container_sid_from_name(child_app_container_name).split('-')

    return '-'.join([parent_app_container_sid,
                     child_app_container_sid[7],
                     child_app_container_sid[8],
                     child_app_container_sid[9],
                     child_app_container_sid[10]])


def main():
    print(app_container_sid_from_name(WellKnownChildPackageNames[0][0]))

    for parent_name, child_name in WellKnownChildPackageNames:
        print(child_app_container_sid_from_name(parent_name, child_name))


if __name__ == '__main__':
    main()