dissect.cobaltstrike 1.2.2.dev2__py3-none-any.whl → 1.2.2.dev4__py3-none-any.whl

dissect/cobaltstrike/_version.py

@@ -1,21 +1,24 @@
-# file generated by setuptools-scm
+# file generated by vcs-versioning
 # don't change, don't track in version control
+from __future__ import annotations
 
-__all__ = ["__version__", "__version_tuple__", "version", "version_tuple"]
-
-TYPE_CHECKING = False
-if TYPE_CHECKING:
-    from typing import Tuple
-    from typing import Union
-
-    VERSION_TUPLE = Tuple[Union[int, str], ...]
-else:
-    VERSION_TUPLE = object
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
 
 version: str
 __version__: str
-__version_tuple__: VERSION_TUPLE
-version_tuple: VERSION_TUPLE
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
+
+__version__ = version = '1.2.2.dev4'
+__version_tuple__ = version_tuple = (1, 2, 2, 'dev4')
 
-__version__ = version = '1.2.2.dev2'
-__version_tuple__ = version_tuple = (1, 2, 2, 'dev2')
+__commit_id__ = commit_id = None

dissect/cobaltstrike/artifact.py

@@ -10,26 +10,35 @@ import contextlib
 import io
 import logging
 import sys
-from typing import BinaryIO, Iterator, NamedTuple, Optional
+from typing import BinaryIO, Iterator, Optional
 
 from dissect.cobaltstrike import utils
 
 logger = logging.getLogger(__name__)
 
 
-class ArtifactKitPayload(NamedTuple):
-    """Namedtuple containing the ArtifactKit metadata and decoded payload"""
+class ArtifactKitPayload(io.BytesIO):
+    """Decoded ArtifactKit payload with its metadata."""
 
-    offset: int
-    """Offset of the ArtifactKit metadata in the file"""
-    size: int
-    """Size of the payload"""
-    xorkey: bytes
-    """4-byte random xor mask"""
-    hints: bytes
-    """Loader hints (GetModuleHandleA, GetProcAddress)"""
-    payload: bytes
-    """Decoded ArtifactKit payload"""
+    def __init__(self, offset: int, size: int, xorkey: bytes, hints: bytes, payload: bytes):
+        super().__init__(payload)
+        self.offset = offset
+        """Offset of the ArtifactKit metadata in the file"""
+        self.size = size
+        """Size of the payload"""
+        self.xorkey = xorkey
+        """4-byte random xor mask"""
+        self.hints = hints
+        """Loader hints (GetModuleHandleA, GetProcAddress)"""
+        self.payload = payload
+        """Decoded ArtifactKit payload"""
+        self.fh = io.BytesIO(payload)
+
+    def __repr__(self) -> str:
+        return f"<ArtifactKitPayload offset=0x{self.offset:x} size={self.size} xorkey={self.xorkey!r}>"
+
+    def get_name(self) -> str:
+        return "ArtifactKitPayload"
 
 
 def iter_artifactkit_payloads(
@@ -68,7 +77,8 @@ def iter_artifactkit_payloads(
             hints = fobj.read(8)
             data = fobj.read(size)
             payload = utils.xor(data, xorkey)
-            yield ArtifactKitPayload(offset=pos, size=size, xorkey=xorkey, hints=hints, payload=payload)
+            if size > 0:
+                yield ArtifactKitPayload(offset=pos, size=size, xorkey=xorkey, hints=hints, payload=payload)
         pos += 1