dissect.cobaltstrike 1.2.2.dev3__tar.gz → 1.2.2.dev4__tar.gz

{dissect_cobaltstrike-1.2.2.dev3 → dissect_cobaltstrike-1.2.2.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: dissect.cobaltstrike
-Version: 1.2.2.dev3
+Version: 1.2.2.dev4
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
@@ -32,17 +32,16 @@ Requires-Python: >=3.10
 Requires-Dist: dissect-cstruct>=4.7
 Requires-Dist: dissect-executable>=1.11
 Requires-Dist: dissect-util>=3.24
-Requires-Dist: lark
+Requires-Dist: lark>=1.3.1
+Requires-Dist: pycryptodome>=3.23.0
 Provides-Extra: c2
 Requires-Dist: flow-record; extra == 'c2'
 Requires-Dist: httpx; extra == 'c2'
-Requires-Dist: pycryptodome; extra == 'c2'
 Provides-Extra: docs
 Requires-Dist: flow-record; extra == 'docs'
 Requires-Dist: httpx; extra == 'docs'
 Requires-Dist: ipython; extra == 'docs'
 Requires-Dist: pickleshare; extra == 'docs'
-Requires-Dist: pycryptodome; extra == 'docs'
 Requires-Dist: pyshark; extra == 'docs'
 Requires-Dist: rich; extra == 'docs'
 Requires-Dist: sphinx; extra == 'docs'
@@ -53,18 +52,15 @@ Requires-Dist: sphinx-rtd-theme>=2.0; extra == 'docs'
 Provides-Extra: full
 Requires-Dist: flow-record; extra == 'full'
 Requires-Dist: httpx; extra == 'full'
-Requires-Dist: pycryptodome; extra == 'full'
 Requires-Dist: pyshark; extra == 'full'
 Requires-Dist: rich; extra == 'full'
 Provides-Extra: pcap
 Requires-Dist: flow-record; extra == 'pcap'
 Requires-Dist: httpx; extra == 'pcap'
-Requires-Dist: pycryptodome; extra == 'pcap'
 Requires-Dist: pyshark; extra == 'pcap'
 Provides-Extra: test
 Requires-Dist: flow-record; extra == 'test'
 Requires-Dist: httpx; extra == 'test'
-Requires-Dist: pycryptodome; extra == 'test'
 Requires-Dist: pyshark; extra == 'test'
 Requires-Dist: pytest; extra == 'test'
 Requires-Dist: pytest-cov; extra == 'test'

{dissect_cobaltstrike-1.2.2.dev3 → dissect_cobaltstrike-1.2.2.dev4}/dissect/cobaltstrike/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.2.dev3'
-__version_tuple__ = version_tuple = (1, 2, 2, 'dev3')
+__version__ = version = '1.2.2.dev4'
+__version_tuple__ = version_tuple = (1, 2, 2, 'dev4')
 
 __commit_id__ = commit_id = None

{dissect_cobaltstrike-1.2.2.dev3 → dissect_cobaltstrike-1.2.2.dev4}/dissect/cobaltstrike/artifact.py

@@ -10,26 +10,35 @@ import contextlib
 import io
 import logging
 import sys
-from typing import BinaryIO, Iterator, NamedTuple, Optional
+from typing import BinaryIO, Iterator, Optional
 
 from dissect.cobaltstrike import utils
 
 logger = logging.getLogger(__name__)
 
 
-class ArtifactKitPayload(NamedTuple):
-    """Namedtuple containing the ArtifactKit metadata and decoded payload"""
+class ArtifactKitPayload(io.BytesIO):
+    """Decoded ArtifactKit payload with its metadata."""
 
-    offset: int
-    """Offset of the ArtifactKit metadata in the file"""
-    size: int
-    """Size of the payload"""
-    xorkey: bytes
-    """4-byte random xor mask"""
-    hints: bytes
-    """Loader hints (GetModuleHandleA, GetProcAddress)"""
-    payload: bytes
-    """Decoded ArtifactKit payload"""
+    def __init__(self, offset: int, size: int, xorkey: bytes, hints: bytes, payload: bytes):
+        super().__init__(payload)
+        self.offset = offset
+        """Offset of the ArtifactKit metadata in the file"""
+        self.size = size
+        """Size of the payload"""
+        self.xorkey = xorkey
+        """4-byte random xor mask"""
+        self.hints = hints
+        """Loader hints (GetModuleHandleA, GetProcAddress)"""
+        self.payload = payload
+        """Decoded ArtifactKit payload"""
+        self.fh = io.BytesIO(payload)
+
+    def __repr__(self) -> str:
+        return f"<ArtifactKitPayload offset=0x{self.offset:x} size={self.size} xorkey={self.xorkey!r}>"
+
+    def get_name(self) -> str:
+        return "ArtifactKitPayload"
 
 
 def iter_artifactkit_payloads(
@@ -68,7 +77,8 @@ def iter_artifactkit_payloads(
             hints = fobj.read(8)
             data = fobj.read(size)
             payload = utils.xor(data, xorkey)
-            yield ArtifactKitPayload(offset=pos, size=size, xorkey=xorkey, hints=hints, payload=payload)
+            if size > 0:
+                yield ArtifactKitPayload(offset=pos, size=size, xorkey=xorkey, hints=hints, payload=payload)
         pos += 1