package common;

import aggressor.*;
import javax.swing.*;
import java.awt.*;

public class License
{
    private static long life;
    private static long today;
    private static long start;
    private static long difference;
    
    private static long getTimeSinceStart() {
        final Prefs options = Prefs.getPreferences();
        License.today = System.currentTimeMillis();
        License.start = options.getLongNumber("cobaltstrike.start.int", 0L);
        if (License.start == 0L) {
            options.set("cobaltstrike.start.int", License.today + "");
            options.save();
            License.start = License.today;
        }
        return License.difference = (License.today - License.start) / 86400000L;
    }
    
    public static void checkLicenseGUI(final Authorization auth) {
        getTimeSinceStart();
        if (License.difference > License.life || License.today - License.start < 0L) {
            JOptionPane.showMessageDialog(null, "Your Cobalt Strike trial is now expired.\nPlease purchase a license and use the\nsoftware update feature to continue.\n\nFor details, visit:\nhttps://www.cobaltstrike.com/", null, 0);
            System.exit(0);
        }
        else {
            final long left = License.life - License.difference;
            String form = left + " day";
            if (left != 1L) {
                form += "s";
            }
            CommonUtils.print_warn("This is a trial version of Cobalt Strike. You have " + form + " left of your trial. If you purchased Cobalt Strike. Run the Update program and enter your license.");
            CommonUtils.print_trial("WARNING! This trial is *built* to get caught by standard defenses. The licensed product does not have these restrictions. See: http://blog.cobaltstrike.com/2015/10/14/the-cobalt-strike-trials-evil-bit/");
            JOptionPane.showMessageDialog(null, "This is a trial version of Cobalt Strike.\nYou have " + form + " left of your trial.\n\nIf you purchased Cobalt Strike. Run the\nUpdate program and enter your license.", null, 1);
        }
    }
    
    public static boolean isTrial() {
        return true;
    }
    
    public static void checkLicenseConsole(final Authorization auth) {
        getTimeSinceStart();
        if (License.difference > License.life || License.today - License.start < 0L) {
            CommonUtils.print_error("Your Cobalt Strike trial is now expired. Please purchase a license and use the software update feature to continue. For details, visit: https://www.cobaltstrike.com/");
            System.exit(0);
        }
        else {
            final long left = License.life - License.difference;
            String form = left + " day";
            if (left != 1L) {
                form += "s";
            }
            CommonUtils.print_warn("This is a trial version of Cobalt Strike. You have " + form + " left of your trial. If you purchased Cobalt Strike. Run the Update program and enter your license.");
            CommonUtils.print_trial("WARNING! This trial is *built* to get caught by standard defenses. The licensed product does not have these restrictions. See: http://blog.cobaltstrike.com/2015/10/14/the-cobalt-strike-trials-evil-bit/");
        }
    }
    
    static {
        License.life = 21L;
        License.today = 0L;
        License.start = 0L;
        License.difference = 0L;
    }
}

...
else if (Listener.isEgressBeacon(payload) && DataUtils.isBeaconDefined(this.datal) && !name.equals(DataUtils.getEgressBeaconListener(this.datal))) {
    DialogUtils.showError("You may only define one egress Beacon per team server.\nThere are a few things I need to sort before you can\nput multiple Beacon HTTP/DNS listeners on one server.\nSpin up a new team server and add your listener there.");
}
...

-  result.append("5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\u0000");
+  result.append("123\u0000");

-  $eicar = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
+  $eicar = ''

-  c2profile.addCommand(".http-get.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
-  c2profile.addCommand(".http-post.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
-  c2profile.addCommand(".http-stager.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
-  c2profile.addCommand(".stage.transform-x86", "append", "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
-  c2profile.addCommand(".stage.transform-x64", "append", "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");

if (License.isTrial()) {
    packer.addString("X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
    CommonUtils.print_trial("Added EICAR string to " + s);
}

public static byte[] _XorEncode(final byte[] data, final String arch) {
    AssertUtils.TestArch(arch);
    if ("x86".equals(arch)) {
        final byte[] decoder = XorStub();
        final byte[] payload = XorEncoder.encode(data);
        return CommonUtils.join(decoder, payload);
    }
    if ("x64".equals(arch)) {
        final byte[] decoder = CommonUtils.readResource("resources/xor64.bin");
        final byte[] payload = XorEncoder.encode(data);
        return CommonUtils.join(decoder, payload);
    }
    return new byte[0];
}

public static byte[] XorEncode(final byte[] data, final String arch) {
    if (License.isTrial()) {
        CommonUtils.print_trial("Disabled " + arch + " payload stage encoding.");
        return data;
    }
    AssertUtils.Test(data.length > 16384, "XorEncode used on a stager (or some other small thing)");
    return _XorEncode(data, arch);
}