Cstruct changes

[twiggler]

Make cobaltstrike compatible with changes to the struct API.

Note: After cstruct is released, update the dependency

[yunzheng]

does cstruct provide a better or a public api for accessing the values? If not, that might be a nice contract/feature to add so it doesn't break in a future cstruct update :)

[twiggler]

Yeah so although __values__ has a lot of underscores, that is mostly to avoid collisions with user defined fields; it is considered part of the public interface.

Alternative would be to loop over the field names and get the attributes, I think this is slightly cleaner.

[codecov]

Codecov Report

Attention: Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 76.40%. Comparing base (ef91243) to head (fa832ae).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
dissect/cobaltstrike/pcap.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #81   +/-   ##
=======================================
  Coverage   76.40%   76.40%           
=======================================
  Files          12       12           
  Lines        2729     2729           
=======================================
  Hits         2085     2085           
  Misses        644      644           

Flag	Coverage Δ
unittests	76.40% <50.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[yunzheng]

Make cobaltstrike compatible with changes to the struct API.

Note: After cstruct is released, update the dependency

In which version of cstruct did this API change?

[twiggler]

Make cobaltstrike compatible with changes to the struct API.
Note: After cstruct is released, update the dependency

In which version of cstruct did this API change?

The change will be part of 4.6 https://github.com/fox-it/dissect.cstruct/blob/main/CHANGELOG.md

[yunzheng]

LGTM