CaRT Neutering Format Library

1.2.3 · active · verified Thu Apr 16

Compressed and RC4 Transport (CaRT) is a file format and an associated Python library used to 'neuter' files for secure distribution, particularly in the malware analysis community. It encrypts and compresses files, optionally embedding metadata, to prevent execution and detection by antivirus software. The library provides functionalities for packing and unpacking CaRT files and currently supports format version 1. It is actively maintained by Cybercentre Canada, with the latest stable release being 1.2.3.

Common errors

```
ImportError: No module named 'cart'
```
cause The `cart` package is not installed in the current Python environment.

fix Run `pip install cart` to install the package.
```
FileNotFoundError: [Errno 2] No such file or directory: 'non_existent_file.txt'
```
cause The input file specified for packing or unpacking does not exist at the given path.

fix Verify that the path to the input file (e.g., `original_file` or `cart_file`) is correct and the file exists. Use absolute paths for clarity.
```
cart.exceptions.CaRTException: ARC4 key mismatch. Unpack aborted.
```
cause Attempted to unpack a CaRT file that was created with a private key, but no key or an incorrect key was provided during the unpack operation.

fix Ensure the correct private key (as `bytes`) is passed to the `key` parameter of the `unpack_file` or `unpack_stream` function. If no key was used, ensure the default key behavior is assumed by not passing a `key` argument, or explicitly passing `None` if that's supported.

Warnings

breaking Python 2 support has been entirely removed starting from versions 1.2.0 and 1.2.1. Attempting to use `cart` with Python 2 will result in `ImportError` or `SyntaxError`.
Fix: Ensure your project runs on Python 3.6 or newer. Upgrade your Python environment if necessary.
gotcha The CaRT format uses ARC4 encryption, with a default key (the first 8 digits of Pi, twice) unless explicitly overridden. If a private key is used during packing, the same private key MUST be provided for unpacking, otherwise decryption will fail.
Fix: When unpacking a CaRT file created with a private key, pass the identical key to the `key` argument of `unpack_file` or `unpack_stream` functions. For example: `unpack_file(cart_path, output_path, key=b'your_private_key')`.
gotcha A vulnerability related to path traversal by crafting metadata filenames was addressed in v1.2.3. Older versions might be susceptible if processing untrusted `.cartmeta` files.
Fix: Upgrade to `cart` version 1.2.3 or higher to benefit from the fix that prevents root path possibilities from metadata filenames.

Install

pip install cart Install latest version

Imports

pack_file
wrong:
```
import cart.pack_file
```
correct:
```
from cart.pack import pack_file
```
Functions for packing files are nested under the 'pack' submodule.
unpack_file
wrong:
```
import cart.unpack_file
```
correct:
```
from cart.unpack import unpack_file
```
Functions for unpacking files are nested under the 'unpack' submodule.
async_pack_file
```
from cart.pack import async_pack_file
```
Asynchronous packing functionality was introduced in v1.2.3.

Quickstart

This example demonstrates how to pack a simple text file into the CaRT format and then unpack it using the synchronous API. The library handles compression and default ARC4 encryption.

import os
from cart.pack import pack_file
from cart.unpack import unpack_file

# Create a dummy file to pack
original_file = 'test_original.txt'
with open(original_file, 'w') as f:
    f.write('This is a test file for CaRT neutering.')

# Pack the file
cart_file = 'test_original.cart'
pack_file(original_file, cart_file)
print(f"File packed: {original_file} -> {cart_file}")

# Unpack the file
unpacked_file = 'test_unpacked.txt'
unpack_file(cart_file, unpacked_file)
print(f"File unpacked: {cart_file} -> {unpacked_file}")

# Verify content (optional)
with open(unpacked_file, 'r') as f:
    content = f.read()
    print(f"Unpacked content: {content}")

# Clean up
os.remove(original_file)
os.remove(cart_file)
os.remove(unpacked_file)

view raw JSON →