dissect.cobaltstrike 1.2.2.dev2__tar.gz → 1.2.2.dev4__tar.gz

{dissect_cobaltstrike-1.2.2.dev2 → dissect_cobaltstrike-1.2.2.dev4}/.pre-commit-config.yaml

@@ -1,16 +1,15 @@
 repos:
   - repo: https://github.com/charliermarsh/ruff-pre-commit
-    rev: v0.6.9
+    rev: v0.15.6
     hooks:
-      - id: ruff
-  - repo: https://github.com/psf/black
-    rev: 24.10.0
-    hooks:
-    - id: black
-      args: [--check, --diff]
-      language_version: python3
+    - id: ruff          # used by `fix`
+      alias: ruff-fix
+      args: [--fix]
+    - id: ruff          # used by `lint`
+      alias: ruff-lint
+    - id: ruff-format   # replaces black
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.3.0
+    rev: v2.4.2
     hooks:
       - id: codespell
         args: [--ignore-words=docs/codespell-ignore-words.txt]

{dissect_cobaltstrike-1.2.2.dev2 → dissect_cobaltstrike-1.2.2.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: dissect.cobaltstrike
-Version: 1.2.2.dev2
+Version: 1.2.2.dev4
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
@@ -19,28 +19,29 @@ Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: Microsoft :: Windows
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
-Requires-Python: >=3.9
-Requires-Dist: dissect-cstruct>=4.6.dev
-Requires-Dist: lark
+Requires-Python: >=3.10
+Requires-Dist: dissect-cstruct>=4.7
+Requires-Dist: dissect-executable>=1.11
+Requires-Dist: dissect-util>=3.24
+Requires-Dist: lark>=1.3.1
+Requires-Dist: pycryptodome>=3.23.0
 Provides-Extra: c2
 Requires-Dist: flow-record; extra == 'c2'
 Requires-Dist: httpx; extra == 'c2'
-Requires-Dist: pycryptodome; extra == 'c2'
 Provides-Extra: docs
 Requires-Dist: flow-record; extra == 'docs'
 Requires-Dist: httpx; extra == 'docs'
 Requires-Dist: ipython; extra == 'docs'
 Requires-Dist: pickleshare; extra == 'docs'
-Requires-Dist: pycryptodome; extra == 'docs'
 Requires-Dist: pyshark; extra == 'docs'
 Requires-Dist: rich; extra == 'docs'
 Requires-Dist: sphinx; extra == 'docs'
@@ -51,18 +52,15 @@ Requires-Dist: sphinx-rtd-theme>=2.0; extra == 'docs'
 Provides-Extra: full
 Requires-Dist: flow-record; extra == 'full'
 Requires-Dist: httpx; extra == 'full'
-Requires-Dist: pycryptodome; extra == 'full'
 Requires-Dist: pyshark; extra == 'full'
 Requires-Dist: rich; extra == 'full'
 Provides-Extra: pcap
 Requires-Dist: flow-record; extra == 'pcap'
 Requires-Dist: httpx; extra == 'pcap'
-Requires-Dist: pycryptodome; extra == 'pcap'
 Requires-Dist: pyshark; extra == 'pcap'
 Provides-Extra: test
 Requires-Dist: flow-record; extra == 'test'
 Requires-Dist: httpx; extra == 'test'
-Requires-Dist: pycryptodome; extra == 'test'
 Requires-Dist: pyshark; extra == 'test'
 Requires-Dist: pytest; extra == 'test'
 Requires-Dist: pytest-cov; extra == 'test'
@@ -99,7 +97,7 @@ If you want to install the latest pre-release version, use the ``--pre`` flag::
 
    $ pip install --pre dissect.cobaltstrike
 
-**dissect.cobaltstrike** requires Python 3.9 or later.
+**dissect.cobaltstrike** requires Python 3.10 or later.
 
 Documentation
 -------------

{dissect_cobaltstrike-1.2.2.dev2 → dissect_cobaltstrike-1.2.2.dev4}/README.rst

@@ -27,7 +27,7 @@ If you want to install the latest pre-release version, use the ``--pre`` flag::
 
    $ pip install --pre dissect.cobaltstrike
 
-**dissect.cobaltstrike** requires Python 3.9 or later.
+**dissect.cobaltstrike** requires Python 3.10 or later.
 
 Documentation
 -------------

dissect_cobaltstrike-1.2.2.dev4/dissect/cobaltstrike/_version.py

@@ -0,0 +1,24 @@
+# file generated by vcs-versioning
+# don't change, don't track in version control
+from __future__ import annotations
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+version: str
+__version__: str
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
+
+__version__ = version = '1.2.2.dev4'
+__version_tuple__ = version_tuple = (1, 2, 2, 'dev4')
+
+__commit_id__ = commit_id = None

{dissect_cobaltstrike-1.2.2.dev2 → dissect_cobaltstrike-1.2.2.dev4}/dissect/cobaltstrike/artifact.py

@@ -10,26 +10,35 @@ import contextlib
 import io
 import logging
 import sys
-from typing import BinaryIO, Iterator, NamedTuple, Optional
+from typing import BinaryIO, Iterator, Optional
 
 from dissect.cobaltstrike import utils
 
 logger = logging.getLogger(__name__)
 
 
-class ArtifactKitPayload(NamedTuple):
-    """Namedtuple containing the ArtifactKit metadata and decoded payload"""
+class ArtifactKitPayload(io.BytesIO):
+    """Decoded ArtifactKit payload with its metadata."""
 
-    offset: int
-    """Offset of the ArtifactKit metadata in the file"""
-    size: int
-    """Size of the payload"""
-    xorkey: bytes
-    """4-byte random xor mask"""
-    hints: bytes
-    """Loader hints (GetModuleHandleA, GetProcAddress)"""
-    payload: bytes
-    """Decoded ArtifactKit payload"""
+    def __init__(self, offset: int, size: int, xorkey: bytes, hints: bytes, payload: bytes):
+        super().__init__(payload)
+        self.offset = offset
+        """Offset of the ArtifactKit metadata in the file"""
+        self.size = size
+        """Size of the payload"""
+        self.xorkey = xorkey
+        """4-byte random xor mask"""
+        self.hints = hints
+        """Loader hints (GetModuleHandleA, GetProcAddress)"""
+        self.payload = payload
+        """Decoded ArtifactKit payload"""
+        self.fh = io.BytesIO(payload)
+
+    def __repr__(self) -> str:
+        return f"<ArtifactKitPayload offset=0x{self.offset:x} size={self.size} xorkey={self.xorkey!r}>"
+
+    def get_name(self) -> str:
+        return "ArtifactKitPayload"
 
 
 def iter_artifactkit_payloads(
@@ -68,7 +77,8 @@ def iter_artifactkit_payloads(
             hints = fobj.read(8)
             data = fobj.read(size)
             payload = utils.xor(data, xorkey)
-            yield ArtifactKitPayload(offset=pos, size=size, xorkey=xorkey, hints=hints, payload=payload)
+            if size > 0:
+                yield ArtifactKitPayload(offset=pos, size=size, xorkey=xorkey, hints=hints, payload=payload)
         pos += 1