sandbox-cli 0.2.26__py3-none-any.whl

sandbox_cli/utils/scanner/rescan.py

@@ -0,0 +1,258 @@
+import asyncio
+import sys
+from collections.abc import Coroutine
+from io import BytesIO
+from pathlib import Path
+from typing import Any
+from zipfile import BadZipFile, ZipFile
+
+import aiohttp
+import aiohttp.client_exceptions
+from ptsandbox import Sandbox
+from ptsandbox.models import (
+    SandboxBaseScanTaskRequest,
+    SandboxKey,
+    SandboxUploadException,
+)
+from rich.progress import Progress, SpinnerColumn, TaskID, TextColumn, TimeElapsedColumn
+
+from sandbox_cli.console import console
+from sandbox_cli.internal.config import settings
+from sandbox_cli.internal.helpers import get_key_by_name
+from sandbox_cli.utils.compiler import compile_rules_internal
+from sandbox_cli.utils.downloader import download
+from sandbox_cli.utils.scanner import format_link
+from sandbox_cli.utils.unpack import Unpack
+
+
+async def _get_compiled_rules(progress: Progress, rules_dir: Path | None, is_local: bool) -> bytes | None:
+    if not rules_dir:
+        progress.disable = False
+        progress.start()
+        return None
+
+    inner_progress = Progress(
+        TextColumn(console.INFO),
+        SpinnerColumn(),
+        TextColumn(text_format="{task.description}"),
+        "•",
+        TimeElapsedColumn(),
+        console=console,
+    )
+    task_id: TaskID
+
+    text = (
+        "Compiling rules locally"
+        if is_local
+        else f"Compiling rules on the remote • [medium_purple]{settings.sandbox[0].host}[/]"
+    )
+    task_id = inner_progress.add_task(text)
+
+    with inner_progress:
+        result = await compile_rules_internal(rules_dir=rules_dir, is_local=is_local)
+        inner_progress.stop_task(task_id=task_id)
+
+    inner_progress.stop()
+
+    progress.disable = False
+    progress.start()
+
+    return result
+
+
+async def _prepare_rescan_options(
+    progress: Progress,
+    rules_dir: Path | None,
+    sandbox_key: SandboxKey,
+    is_local: bool,
+) -> tuple[Sandbox, SandboxBaseScanTaskRequest.Options]:
+    sandbox = Sandbox(sandbox_key)
+
+    sandbox_options = SandboxBaseScanTaskRequest.Options(analysis_depth=2, passwords_for_unpack=settings.passwords)
+
+    # process custom options
+    compiled_rules = await _get_compiled_rules(rules_dir=rules_dir, is_local=is_local, progress=progress)
+
+    if compiled_rules:
+        try:
+            rules_uri = (await sandbox.api.upload_file(compiled_rules)).data.file_uri
+            sandbox_options.sandbox.debug_options["rules_url"] = rules_uri
+        except aiohttp.client_exceptions.ClientResponseError:
+            console.error(f"Can't upload compiled rules {rules_dir} to sandbox")
+
+    return (sandbox, sandbox_options)
+
+
+async def rescan_internal(
+    *,  # no not keyword args
+    traces: list[Path],
+    rules_dir: Path | None,
+    out_dir: Path,
+    key_name: str,
+    is_local: bool,
+    unpack: bool,
+    debug: bool,
+) -> None:
+    key = get_key_by_name(key_name)
+    sandbox_sem = asyncio.Semaphore(value=key.max_workers)
+
+    progress = Progress(
+        SpinnerColumn(),
+        TextColumn("{task.fields[idx]}"),
+        "•",
+        TextColumn("{task.description}"),
+        "•",
+        TextColumn("{task.fields[url]}"),
+        "•",
+        TimeElapsedColumn(),
+        console=console,
+        disable=True,
+        transient=True,
+    )
+
+    async def process_trace(
+        drakvuf_trace: Path | BytesIO,
+        tcpdump_pcap: Path | BytesIO,
+        trace: Path,
+        out_dir: Path,
+        idx: str,
+    ) -> None:
+        idx = f"[turquoise2 bold]{idx}[/]"
+
+        async with sandbox_sem:
+            task_id = progress.add_task(description="Creating task", idx=idx, url="...")
+
+            wait_time = (
+                round(sandbox_options.sandbox.analysis_duration * 1.5)
+                if sandbox_options.sandbox.analysis_duration > 70
+                else 70
+            )
+
+            try:
+                rescan_result = await sandbox.create_rescan(
+                    drakvuf_trace,
+                    tcpdump_pcap,
+                    options=sandbox_options,
+                    rules=None,
+                    read_timeout=wait_time,
+                )
+            except SandboxUploadException as e:
+                console.error(f"[yellow]{trace}[/] • an error occurred when uploading a file to the server • {e}")
+                progress.remove_task(task_id)
+                return
+            except aiohttp.client_exceptions.ClientResponseError as e:
+                console.error(f"[yellow]{trace}[/] • {e}")
+                progress.remove_task(task_id)
+                return
+
+            formatted_link = f"[medium_purple]{format_link(rescan_result, key=key)}[/]"
+            final_output = f"[yellow]{trace.name}[/] • {formatted_link}"
+
+            progress.update(
+                task_id=task_id,
+                description=f"Waiting for full report for [yellow]{trace.name}[/]",
+                url=formatted_link,
+            )
+            if not (awaited_report := await sandbox.wait_for_report(rescan_result, wait_time)):
+                console.error(f"Rescan failed for [yellow]{trace.name}[/] • {formatted_link} • {rescan_result}")
+                progress.remove_task(task_id)
+                return
+
+            rescan_result = awaited_report
+
+        # write report.json
+        (out_dir / settings.report_name).write_text(rescan_result.model_dump_json(indent=4), encoding="utf-8")
+
+        # get full report?
+        if not (long_report := rescan_result.get_long_report()):
+            console.error(f"{final_output} • full report not available")
+            progress.remove_task(task_id)
+            return
+
+        progress.update(task_id=task_id, description="Downloading results...")
+
+        await download(long_report, sandbox, out_dir, logs=True, debug=debug)
+
+        console.done(final_output)
+
+        progress.remove_task(task_id)
+
+        if unpack:
+            Unpack(out_dir).run()
+
+    async def wrapper(trace: Path, out_dir: Path, idx: str) -> None:
+        """
+        Internal function for prepare raw traces for re-scan
+
+        :param trace
+            file - zip file with drakvuf-trace.log.gz/drakvuf-trace.log.zst and tcpdump.pcap inside
+
+            dir - directory with drakvuf-trace.log.gz/drakvuf-trace.log.zst and tcpdump.pcap files
+
+        :param out_dir - save dir for current trace
+        :param idx - just nice index for output
+        """
+
+        drakvuf_trace: Path | BytesIO
+        tcpdump_pcap: Path | BytesIO
+        if trace.is_dir():
+            drakvuf_trace = trace / "drakvuf-trace.log.gz"
+            if not drakvuf_trace.exists():
+                # handle case with modern zst format
+                drakvuf_trace = trace / "drakvuf-trace.log.zst"
+                if not drakvuf_trace.exists():
+                    console.error(
+                        f"drakvuf-trace.log.gz or drakvuf-trace.log.zst doesn't exists in {trace.expanduser().resolve()}"
+                    )
+                    sys.exit(1)
+
+            tcpdump_pcap = trace / "tcpdump.pcap"
+            if not tcpdump_pcap.exists():
+                console.error(f"tcpdump.pcap don't exists in {trace}")
+                sys.exit(1)
+        else:
+            try:
+                with ZipFile(trace) as zip:
+                    log_file = ""
+                    for file in zip.filelist:
+                        if file.filename in {"drakvuf-trace.log.gz", "drakvuf-trace.log.zst"}:
+                            log_file = file.filename
+                            break
+
+                    raw_trace = zip.read(log_file)
+                    if raw_trace == b"":
+                        console.error(f"Empty {log_file} in {trace}")
+                        sys.exit(1)
+
+                    drakvuf_trace = BytesIO(raw_trace)
+                    tcpdump_pcap = BytesIO(zip.read("tcpdump.pcap"))
+            except BadZipFile:
+                console.error(f"{trace} not a zip file")
+                sys.exit(1)
+
+        await process_trace(drakvuf_trace, tcpdump_pcap, trace, out_dir, idx)
+
+    console.info(f"Using key: name={key.name} max_workers={key.max_workers}")
+
+    tasks: list[Coroutine[Any, Any, None]] = []
+    with progress:
+        sandbox, sandbox_options = await _prepare_rescan_options(progress, rules_dir, key, is_local)
+
+        if len(traces) == 1:
+            local_out_dir = out_dir / "rescan"
+            local_out_dir.mkdir(parents=True, exist_ok=True)
+            tasks.append(wrapper(traces[0], local_out_dir, "1/1"))
+        else:
+            for i, trace in enumerate(traces):
+                local_out_dir = out_dir / f"rescan_{i + 1}"
+
+                # nice names for zip files
+                if trace.suffix == ".zip":
+                    local_out_dir = out_dir / trace.stem
+
+                local_out_dir.mkdir(parents=True, exist_ok=True)
+                idx = f"{i + 1}/{len(traces)}"
+                tasks.append(wrapper(trace, local_out_dir, idx))
+
+        await asyncio.gather(*tasks)
+        await sandbox.api.session.close()

sandbox_cli/utils/unpack/__init__.py

@@ -0,0 +1,96 @@
+import shutil
+from gzip import GzipFile
+from pathlib import Path
+from zipfile import ZipFile
+
+import zstandard
+
+from sandbox_cli.console import console
+from sandbox_cli.utils.unpack.plugins.abc import BasePlugin
+from sandbox_cli.utils.unpack.plugins.correlation import CorrelatedRules
+from sandbox_cli.utils.unpack.plugins.sort_by_plugins import SortByPlugins
+
+
+class Unpack:
+    def __init__(self, trace: Path) -> None:
+        if not trace.exists():
+            console.error(f"{trace} not exist")
+            return
+
+        # unpack zip file
+        if trace.is_file() and trace.suffix.endswith("zip"):
+            self.trace = Path(trace.with_suffix(""))
+            self.trace.mkdir(exist_ok=True)
+
+            with ZipFile(trace, mode="r") as zip:
+                zip.extractall(path=self.trace)
+        elif trace.is_dir():
+            self.trace = trace
+        else:
+            console.error(f"Unsupported file: {trace}")
+            return
+
+        self.plugins: list[BasePlugin] = [CorrelatedRules(self.trace), SortByPlugins(self.trace)]
+        self.logs = {
+            "drakvuf-trace": Path(""),  # dynamic detect what extension is using
+            "correlated": Path(self.trace / "events-correlated.log.gz"),
+            "normalized": Path(self.trace / "events-normalized.log.gz"),
+            "network": Path(self.trace / "tcpdump.pcap"),
+        }
+        self.raw = Path(self.trace / "raw")
+
+    def _extract_logs(self) -> None:
+        def _extract(file: Path) -> None:
+            if file.exists() and file.suffix.endswith("zst"):
+                dctx = zstandard.ZstdDecompressor()
+                with open(file, mode="rb") as zst, open(file.with_suffix(""), "wb") as out:
+                    dctx.copy_stream(zst, out)
+
+            if file.exists() and file.suffix.endswith("gz"):
+                with GzipFile(file, mode="rb") as gzip, open(file.with_suffix(""), "wb") as out:
+                    out.write(gzip.read())
+
+        for log in self.logs.values():
+            _extract(log)
+
+    def _create_dirs(self) -> None:
+        def _create(dir: Path) -> None:
+            if dir.exists() and dir.is_dir():
+                shutil.rmtree(dir)
+            dir.mkdir(exist_ok=True)
+
+        for dir in self.logs:
+            _create(Path(self.trace / dir))
+
+    def _move_files(self) -> None:
+        self.raw.mkdir(exist_ok=True)
+        for log in self.logs.values():
+            if log.exists() and log.is_file():
+                shutil.copy(log, self.raw)
+
+        for dir, file in self.logs.items():
+            if not file.exists() or file.is_dir():
+                continue
+
+            if file.suffix.endswith("gz") or file.suffix.endswith("zst"):
+                shutil.move(file.with_suffix(""), self.trace / dir)
+            else:
+                shutil.move(file, self.trace / dir)
+
+    def run(self) -> None:
+        if Path(self.trace / "drakvuf-trace.log.gz").exists():
+            self.logs["drakvuf-trace"] = Path(self.trace / "drakvuf-trace.log.gz")
+        if Path(self.trace / "drakvuf-trace.log.zst").exists():
+            self.logs["drakvuf-trace"] = Path(self.trace / "drakvuf-trace.log.zst")
+
+        self._extract_logs()
+        self._create_dirs()
+        self._move_files()
+
+        # Run plugins
+        for plugin in self.plugins:
+            plugin.run()
+
+        # Remove files
+        for log in self.logs.values():
+            log.unlink(missing_ok=True)

sandbox_cli/utils/unpack/plugins/abc.py

@@ -0,0 +1,18 @@
+from abc import ABC, abstractmethod
+from pathlib import Path
+
+
+class BasePlugin(ABC):
+    """
+    Base class for all plugins
+
+    It is necessary to designate a single entry point
+    """
+
+    def __init__(self, trace: Path) -> None:
+        self.trace = trace
+
+    @abstractmethod
+    def run(self) -> None:
+        """Invoke plugin"""
+        ...

sandbox_cli/utils/unpack/plugins/correlation.py

@@ -0,0 +1,52 @@
+from collections import defaultdict
+from pathlib import Path
+
+import orjson
+
+from sandbox_cli.console import console
+from sandbox_cli.models.detections import DetectionType
+from sandbox_cli.utils.unpack.plugins.abc import BasePlugin
+
+
+class CorrelatedRules(BasePlugin):
+    def run(self) -> None:
+        base_path = self.trace / "correlated"
+        file = Path(base_path / "events-correlated.log")
+        if not file.exists():
+            console.warning(f"{file} not exist")
+            return
+
+        with open(file, errors="ignore", encoding="utf-8") as fd:
+            raw_trace = fd.readlines()
+
+        suspicious: defaultdict[str, list[str]] = defaultdict(list)
+        silent: defaultdict[str, list[str]] = defaultdict(list)
+        malware: list[str] = []
+
+        for line in raw_trace:
+            data: dict[str, str] = orjson.loads(line)
+            if data.get("detect.type"):
+                match data["detect.type"]:
+                    case DetectionType.malware:
+                        malware.append(line)
+                    case DetectionType.suspicious:
+                        suspicious[data["detect.name"]].append(line)
+                    case DetectionType.silent:
+                        silent[data["detect.name"]].append(line)
+                    case _:
+                        pass
+
+        if len(malware) > 0:
+            with open(f"{file}.malware", "w", encoding="utf-8") as fd:
+                for line in malware:
+                    fd.write(line)
+
+        for key, lines in silent.items():
+            with open(f"{file}.silent.{key}", "w", encoding="utf-8") as fd:
+                for line in lines:
+                    fd.write(line)
+
+        for key, lines in suspicious.items():
+            with open(f"{file}.suspicious.{key}", "w", encoding="utf-8") as fd:
+                for line in lines:
+                    fd.write(line)

sandbox_cli/utils/unpack/plugins/sort_by_plugins.py

@@ -0,0 +1,30 @@
+from collections import defaultdict
+from pathlib import Path
+
+import orjson
+
+from sandbox_cli.console import console
+from sandbox_cli.utils.unpack.plugins.abc import BasePlugin
+
+
+class SortByPlugins(BasePlugin):
+    def run(self) -> None:
+        base_path = self.trace / "normalized"
+        file = Path(base_path / "events-normalized.log")
+        if not file.exists():
+            console.warning(f"{file} not exist")
+            return
+
+        with open(file, errors="ignore") as fd:
+            raw_trace = fd.readlines()
+
+        plugins: defaultdict[str, list[str]] = defaultdict(list)
+        for line in raw_trace:
+            data: dict[str, str] = orjson.loads(line)
+            if data.get("plugin"):
+                plugins[data["plugin"]].append(line)
+
+        for plugin, lines in plugins.items():
+            with open(f"{file}.{plugin}", "w", encoding="utf-8") as fd:
+                for line in lines:
+                    fd.write(line)

sandbox_cli-0.2.26.dist-info/METADATA

@@ -0,0 +1,139 @@
+Metadata-Version: 2.4
+Name: sandbox-cli
+Version: 0.2.26
+Summary: Command line tool for interaction with sandboxes
+Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
+Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli
+Project-URL: Repository, https://github.com/Security-Experts-Community/sandbox-cli
+Project-URL: Issues, https://github.com/Security-Experts-Community/sandbox-cli/issues
+Author: Alexey Kolesnikov
+License-Expression: MIT
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.11
+Requires-Dist: aiofiles>=24.1.0
+Requires-Dist: asyncssh>=2.19.0
+Requires-Dist: cryptography>=44.0.0
+Requires-Dist: cyclopts>=3.9.0
+Requires-Dist: docker>=7.1.0
+Requires-Dist: ptsandbox
+Requires-Dist: pyzipper>=0.3.6
+Requires-Dist: rich>=13.9.4
+Requires-Dist: zstandard>=0.23.0
+Description-Content-Type: text/markdown
+
+![Image](https://raw.githubusercontent.com/Security-Experts-Community/sandbox-cli/refs/heads/main/docs/assets/logo_with_text.svg)
+
+<p align="center">
+    <em>Work with PT Sandbox like a pro</em>
+</p>
+
+---
+
+**Documentation**: <a href="https://security-experts-community.github.io/sandbox-cli">https://security-experts-community.github.io/sandbox-cli</a>
+
+**Source Code**: <a href="https://github.com/Security-Experts-Community/sandbox-cli">https://github.com/Security-Experts-Community/sandbox-cli</a>
+
+---
+
+> [!NOTE]
+> `python >= 3.11` is required.
+
+## Installation
+
+Using `pipx`:
+
+```sh
+pipx install sandbox-cli
+```
+
+Using `PyPi`:
+
+```sh
+pip install sandbox-cli
+```
+
+NixOS:
+
+```
+Add inputs.sandbox-cli.overlays.default to your nixpkgs overlay
+TBA: ...
+```
+
+### Config
+
+You must create default config file as described in `docs/config-examples/config.toml`:
+
+Linux/MacOS:
+
+```sh
+~/.config/sandbox-cli/config.toml
+or
+$XDG_HOME_CONFIG_HOME/sandbox-cli/config.toml
+```
+
+Windows:
+
+```ps1
+%APPDATA%\sandbox-cli\config.toml
+```
+
+## Available options
+
+- `scanner` - Scan with the sandbox.
+- `images` - Get available images in the sandbox.
+- `download` - Download any artifact from the sandbox.
+- `email` - Upload an email and get its headers.
+- `report` - Generate short report from sandbox scans.
+- `unpack`/`conv` - Convert sandbox logs into an analysis-friendly format.
+- `rules` - Working with raw sandbox rules.
+
+<p align="middle">
+    <img width="50%" src="https://raw.githubusercontent.com/Security-Experts-Community/sandbox-cli/refs/heads/main/docs/assets/pic_right.svg">
+</p>
+
+## Usage examples
+
+### images
+
+Get all availables images:
+
+```bash
+sandbox-cli images
+```
+
+```bash
+┏━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┓
+┃ Name                  ┃ ID                      ┃ Version    ┃ Product version ┃
+┡━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━┩
+│ altlinux              │ altworkstation-10-x64   │ ...        │ ...             │
+│ astra                 │ astralinux-smolensk-x64 │ ...        │ ...             │
+│ redos                 │ redos-murom-x64         │ ...        │ ...             │
+│ ubuntu                │ ubuntu-jammy-x64        │ ...        │ ...             │
+│ Windows 10 Pro        │ win10-1803-x64          │ ...        │ ...             │
+│ Windows 10 Enterprise │ win10-22H2-x64          │ ...        │ ...             │
+│ Windows 10 Pro        │ win11-23H2-x64          │ ...        │ ...             │
+│ Windows 7 Enterprise  │ win7-sp1-x64            │ ...        │ ...             │
+│ Windows 7 Enterprise  │ win7-sp1-x64-ics        │ ...        │ ...             │
+└───────────────────────┴─────────────────────────┴────────────┴─────────────────┘
+```
+
+### scanner
+
+Scan the file on all available windows images with timeout 60s and with automatic logs unpacking:
+
+```bash
+sandbox-cli scanner scan-new -i windows -t 60 -U malware.exe
+```
+
+<p align="middle">
+    <img width="50%" src="https://raw.githubusercontent.com/Security-Experts-Community/sandbox-cli/refs/heads/main/docs/assets/pic_left.svg">
+</p>
+
+## Development
+
+`uv` is used to build the project.
+
+```bash
+uv sync
+```

sandbox_cli-0.2.26.dist-info/RECORD

@@ -0,0 +1,36 @@
+sandbox_cli/__main__.py,sha256=oTOdIxj9pwlwGF-QBzLjUrfqBcDl5sot0YtPeoPrwaE,657
+sandbox_cli/console.py,sha256=i-jaDv2L8f2gubg2gy_FBOd8Mr12MalyuJ4gNw_ZnWw,724
+sandbox_cli/cli/__init__.py,sha256=jdpd01ahycl3JKr4N-8R_CLSZvvoFFGDQEqP2op1K4A,1283
+sandbox_cli/cli/downloader.py,sha256=cygTXJdVl8pkHFRULwwpNBpaiwRrjFQn_GHSilWj9J4,8633
+sandbox_cli/cli/images.py,sha256=Tv-s6-7sDugeNOK0L1lmfeq8XqCF7avbBXGq_yuG1Q8,1263
+sandbox_cli/cli/reporter.py,sha256=NLus8Zi8Gl7AUXLk69_lMnd2uJcHQG5golAY7J-uWio,4588
+sandbox_cli/cli/unpack.py,sha256=zrgyh-ausbBMFc6XlY8qShF1zTrr3MvvjsaSu_g2WBg,1370
+sandbox_cli/cli/rules/__init__.py,sha256=ASnj-zzYMYJ-K2X9-dvsDErL4FcdZ7qZyqsd3PQN7FA,2249
+sandbox_cli/cli/scanner/__init__.py,sha256=FQICErnmNdo2EvmoCeWOOdcGIwEJzGmTUH_y9dV7nsI,18905
+sandbox_cli/internal/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sandbox_cli/internal/config.py,sha256=FUARsPCCdRhVWRXAH-qmzPw635O8OGSA7s5WkmzL5mI,3856
+sandbox_cli/internal/helpers.py,sha256=r9bFq_aghCU-nHEXVXgv-LpS24prFtfYYzraHSv887E,839
+sandbox_cli/models/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sandbox_cli/models/detections.py,sha256=wn6yBevFDVFNT8T8EvvSAZY80NJUpvzGR6D9ejgyN4c,2377
+sandbox_cli/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sandbox_cli/utils/extractors.py,sha256=lFpIHy9hqNyqqdT9VyzGx5GJeqdXKA0E3VMU3vjAuvg,2111
+sandbox_cli/utils/merge_dll_hooks.py,sha256=8prsx6OXDMZsQ7l2nju52IQovccvAMbSL2oLq0szln0,2203
+sandbox_cli/utils/compiler/__init__.py,sha256=LXogwbXl9RjIf-ehiqCrliqxq39qVabthoqzi9v1m-o,1991
+sandbox_cli/utils/compiler/abc.py,sha256=5kQPSks3bNn3HtL631Yj8JY37Jzb4xYU4btBZH0KEfI,1665
+sandbox_cli/utils/compiler/docker.py,sha256=c85JKyRlof9twsn_FSS9jJi9nG96icU7UOfSneZc2Ps,5056
+sandbox_cli/utils/compiler/ssh.py,sha256=e_ndOdat-nHrvuTEPXwuoCnTBrE9HgS57WvRVdDUBuY,7782
+sandbox_cli/utils/downloader/__init__.py,sha256=OjxzpBqwg1z3BxFNXYud9FqKtsufbDtKB8O5v0RTatk,5780
+sandbox_cli/utils/scanner/__init__.py,sha256=EHbuGJdd2HxOZgpHbJYPKqrpSMT1vuGjeyNaSAtqPqQ,10567
+sandbox_cli/utils/scanner/advanced.py,sha256=kneArCv0_GoHH_BMAYaRJ-70oZ9pzd1Pw89wLf-xNA8,12671
+sandbox_cli/utils/scanner/rescan.py,sha256=p7uAeIPja_IxaDwrF1htI7I82WUei4URsWuvMN8SIyI,8928
+sandbox_cli/utils/unpack/__init__.py,sha256=GGjwn1PfBCWiCkDsn_PpUHbzjMkolU1FEKMRdXnmqWA,3414
+sandbox_cli/utils/unpack/plugins/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sandbox_cli/utils/unpack/plugins/abc.py,sha256=KO5PpLh8bOPGK8dP7kX09AlIOCOH5uiGzj9qEjT-G2E,349
+sandbox_cli/utils/unpack/plugins/correlation.py,sha256=vFZ1w50bZNpJ6JNvHpgw8Bl521Gr3DfFxiybUbowFPg,1879
+sandbox_cli/utils/unpack/plugins/sort_by_plugins.py,sha256=cOzvIipRfRkPzywBs3tSga5cTFziY6r07hWCT_4hmmQ,956
+sandbox_cli-0.2.26.dist-info/METADATA,sha256=gNeDe1-7vsW2lv8mba9CDYAx5OtXCKpmEUNnRFeRfLc,4663
+sandbox_cli-0.2.26.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+sandbox_cli-0.2.26.dist-info/entry_points.txt,sha256=MSNWgkywjiimrStOm1YiKvWRTF6AgsIeY2Pe1uH58UA,58
+sandbox_cli-0.2.26.dist-info/licenses/LICENSE,sha256=ugWNDYq5trWIIzRbW1KIspTSOb5CdmIitkt2keSP4bY,1083
+sandbox_cli-0.2.26.dist-info/licenses/NOTICE,sha256=dM9C3p-YClC8_a2Z7dEaHpU5cU4GxmNJKGFQrZ4ZiEQ,16036
+sandbox_cli-0.2.26.dist-info/RECORD,,

sandbox_cli-0.2.26.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.27.0
+Root-Is-Purelib: true
+Tag: py3-none-any

sandbox_cli-0.2.26.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+sandbox-cli = sandbox_cli.__main__:main

sandbox_cli-0.2.26.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Security Experts Community
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.