sandbox-cli 0.2.37__tar.gz → 0.2.39__tar.gz

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sandbox-cli
-Version: 0.2.37
+Version: 0.2.39
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.2.37"
+version = "0.2.39"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -87,13 +87,14 @@ ignore_missing_imports = true
 
 [tool.ruff]
 lint.select = [
-  "E",  # pycodestyle errors
-  "W",  # pycodestyle warnings
-  "F",  # pyflakes
-  "I",  # isort
-  "B",  # flake8-bugbear
-  "C4", # flake8-comprehensions
-  "UP", # pyupgrade
+  "E",    # pycodestyle errors
+  "W",    # pycodestyle warnings
+  "F",    # pyflakes
+  "I",    # isort
+  "B",    # flake8-bugbear
+  "C4",   # flake8-comprehensions
+  "UP",   # pyupgrade
+  "F401", # unused-imports
 ]
 lint.ignore = [
   "E501", # line too long, handled by black

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/cli/__init__.py

@@ -2,6 +2,7 @@
 Register all commands here
 """
 
+from colorama import init
 from cyclopts import App
 
 from sandbox_cli.cli.reporter import generate_report, open_browser
@@ -9,6 +10,7 @@ from sandbox_cli.cli.unpack import unpack_logs
 from sandbox_cli.console import console
 from sandbox_cli.internal.config import configpath, settings
 
+init() # colorama stuff for working on windows
 
 def get_version() -> str:
     import importlib.metadata

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/cli/downloader.py

@@ -11,12 +11,10 @@ from uuid import UUID
 import aiofiles
 import aiohttp
 import aiohttp.client_exceptions
-import orjson
-from colorama import init
 from cyclopts import Parameter
 from ptsandbox import Sandbox
 from ptsandbox.models import Artifact, SandboxBaseTaskResponse
-from rich.progress import Progress, SpinnerColumn, TaskID, TextColumn, TimeElapsedColumn
+from rich.progress import Progress, SpinnerColumn, TextColumn, TimeElapsedColumn
 
 from sandbox_cli.console import console
 from sandbox_cli.internal.config import settings
@@ -51,12 +49,12 @@ def get_key_and_task(key: str, task: str) -> tuple[Sandbox, UUID] | tuple[None,
 
 async def download_command(
     tasks_id: Annotated[
-        list[str],
+        list[str] | None,
         Parameter(
             help="Links to tasks or task ids",
             negative="",
         ),
-    ] = [],
+    ] = None,
     /,
     *,
     key: Annotated[
@@ -184,7 +182,8 @@ async def download_command(
     Download any artifact from the sandbox.
     """
 
-    init() # colorama stuff for working on windows
+    if tasks_id is None:
+        tasks_id = []
 
     progress = Progress(
         SpinnerColumn(),

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/cli/reporter.py

@@ -53,6 +53,14 @@ def generate_report(
             negative="",
         ),
     ] = False,
+    suspicious: Annotated[
+        bool,
+        Parameter(
+            name=["--supicious", "-s"],
+            help="Include suspicious detects",
+            negative="",
+        ),
+    ] = False,
 ) -> None:
     """
     Generate short report from sandbox scans.
@@ -118,7 +126,7 @@ def generate_report(
                 {
                     "sample": report.artifacts[0].file_info.file_path,  # type: ignore
                     "image": image,
-                    "verdict": delimeter.join(extract_verdict_from_trace(corr_trace)),
+                    "verdict": delimeter.join(extract_verdict_from_trace(corr_trace, suspicious)),
                     "static": delimeter.join(extract_static(report)),
                     "memory": delimeter.join(extract_memory(report)),
                     "network": delimeter.join(extract_network_from_trace(corr_trace)),

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/cli/rules/__init__.py

@@ -15,7 +15,6 @@ rules = App(
 
 @rules.command(name="compile")
 async def compile_rules(
-    *,
     rules: Annotated[
         Path,
         Parameter(
@@ -24,6 +23,7 @@ async def compile_rules(
             validator=validators.Path(exists=True),
         ),
     ],
+    /,
     out: Annotated[
         Path,
         Parameter(
@@ -57,7 +57,6 @@ async def compile_rules(
 
 @rules.command(name="test")
 async def test_rules(
-    *,
     rules: Annotated[
         Path,
         Parameter(
@@ -66,6 +65,7 @@ async def test_rules(
             validator=validators.Path(exists=True),
         ),
     ],
+    /,
     is_local: Annotated[
         bool,
         Parameter(

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/utils/downloader/__init__.py

@@ -6,6 +6,7 @@ from typing import Any
 from uuid import UUID
 
 import aiofiles
+import aiohttp
 import zstandard
 from ptsandbox import Sandbox
 from ptsandbox.models import (
@@ -18,7 +19,6 @@ from rich.markup import escape
 from rich.progress import Progress, TaskID
 
 from sandbox_cli.console import console
-from sandbox_cli.internal.config import settings
 
 semaphore = asyncio.Semaphore(value=16)
 
@@ -66,13 +66,20 @@ async def _save_artifact(
             else:
                 task_id = progress.add_task(rf"\[[green1]{scan_id}[/]] {escape(path.name)}")
         try:
-            downloaded_data = await sandbox.get_file(uri)
+            # a 5-minute timeout for downloading large files
+            downloaded_data = await sandbox.get_file(uri, read_timeout=300)
         except SandboxFileNotFoundException:
             console.warning(f"File {path.name} not found in storage: {uri=} {scan_id=}")
             if progress:
                 progress.stop_task(task_id)
                 progress.update(task_id=task_id, visible=False)
             return
+        except aiohttp.SocketTimeoutError as e:
+            if progress:
+                progress.stop_task(task_id)
+                progress.update(task_id=task_id, visible=False)
+
+            raise e
 
         if decompress:
             try:
@@ -139,7 +146,11 @@ async def download(
             if sandbox_result.details.sandbox is None:
                 continue
 
-            if sandbox_result.details.sandbox.image and (image_id := sandbox_result.details.sandbox.image.image_id) and out_dir.parts[-1] != image_id:
+            if (
+                sandbox_result.details.sandbox.image
+                and (image_id := sandbox_result.details.sandbox.image.image_id)
+                and out_dir.parts[-1] != image_id
+            ):
                 output = out_dir / image_id
             else:
                 output = out_dir

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/utils/extractors.py

@@ -4,18 +4,16 @@ from ptsandbox.models import ArtifactType, EngineSubsystem, SandboxBaseTaskRespo
 from sandbox_cli.models.detections import Detections
 
 
-def extract_verdict_from_trace(trace: bytes) -> set[str]:
-    non_generics: set[str] = set()
-    generics: set[str] = set()
-
+def extract_verdict_from_trace(trace: bytes, suspicious: bool = False) -> list[str]:
     d = Detections(trace)
-    for detect in d.malware:
-        if detect.name.split(".")[-2] == "Generic":
-            generics.add(detect.name)
-        else:
-            non_generics.add(detect.name)
-
-    return non_generics if len(non_generics) != 0 else generics
+    malware_detects: list[str] = list({detect.name for detect in d.malware})
+    suspicious_detects: set[str] = set()
+    if suspicious:
+        for detect in d.suspicious:
+            suspicious_detects.add(detect.name)
+
+    # malware detects always on top
+    return malware_detects + sorted(suspicious_detects)
 
 
 def extract_network_from_trace(trace: bytes) -> set[str]:

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/utils/scanner/advanced.py

@@ -8,9 +8,21 @@ import aiofiles
 import aiohttp
 import aiohttp.client_exceptions
 from ptsandbox import Sandbox, SandboxKey
-from ptsandbox.models import SandboxOptionsAdvanced, SandboxUploadException, VNCMode
+from ptsandbox.models import (
+    SandboxOptionsAdvanced,
+    SandboxUploadException,
+    SandboxWaitTimeoutException,
+    VNCMode,
+)
 from rich.markup import escape
-from rich.progress import Progress, SpinnerColumn, TaskID, TextColumn, TimeElapsedColumn
+from rich.progress import (
+    Progress,
+    SpinnerColumn,
+    Task,
+    TaskID,
+    TextColumn,
+    TimeElapsedColumn,
+)
 
 from sandbox_cli.console import console
 from sandbox_cli.internal.config import VMImage, settings
@@ -64,6 +76,13 @@ async def _get_compiled_rules(progress: Progress, rules_dir: Path | None, is_loc
     return result
 
 
+def get_elapsed_time(task: Task) -> str:
+    hours = int(task.elapsed) // 3600
+    minutes = (int(task.elapsed) % 3600) // 60
+    seconds = int(task.elapsed) % 60
+    return f"[yellow]{hours}:{minutes:02d}:{seconds:02d}[/]"
+
+
 async def _prepare_sandbox_new_scan(
     progress: Progress,
     scan_images: set[VMImage | str],
@@ -133,7 +152,7 @@ async def _prepare_sandbox_new_scan(
     )
 
     # some enabled options by default
-    # All debug options available in library
+    # all debug options available in library
     sandbox_options.debug_options["save_debug_files"] = True
     sandbox_options.debug_options["extract_crashdumps"] = True
 
@@ -241,6 +260,7 @@ async def scan_internal_advanced(
 
         async with sandbox_sem:
             task_id = progress.add_task(description="Creating task", idx=idx, image=formatted_image, url="...")
+            task = progress.tasks[task_id]
 
             wait_time = sandbox_options.analysis_duration * 4 + (300 if sandbox_options.analysis_duration < 80 else 120)
 
@@ -261,7 +281,7 @@ async def scan_internal_advanced(
                 progress.remove_task(task_id)
                 return
             except aiohttp.client_exceptions.ClientResponseError as e:
-                console.error(f"{image_string} • [yellow]{file_path.name}[/] • {e}")
+                console.error(f"{image_string} • [yellow]{file_path.name}[/] • {e} • {get_elapsed_time(task)}")
                 progress.remove_task(task_id)
                 return
 
@@ -276,8 +296,13 @@ async def scan_internal_advanced(
                 description=f"Waiting [yellow]{file_path.name}[/]",
                 url=formatted_link,
             )
-            if not (awaited_report := await sandbox.wait_for_report(scan_result, wait_time)):
-                console.error(f"{final_output} • scan failed")
+            try:
+                if not (awaited_report := await sandbox.wait_for_report(scan_result, wait_time)):
+                    console.error(f"{final_output} • scan failed • {get_elapsed_time(task)}")
+                    progress.remove_task(task_id)
+                    return
+            except SandboxWaitTimeoutException:
+                console.error(f"{final_output} • got timeout while waiting • {get_elapsed_time(task)}")
                 progress.remove_task(task_id)
                 return
 
@@ -287,32 +312,37 @@ async def scan_internal_advanced(
         (out_dir / settings.report_name).write_text(scan_result.model_dump_json(indent=4), encoding="utf-8")
 
         if not (long_report := scan_result.get_long_report()):
-            console.error(f"{final_output} • full report not available")
+            console.error(f"{final_output} • full report not available • {get_elapsed_time(task)}")
             progress.remove_task(task_id)
             return
 
         progress.update(task_id=task_id, description="Downloading results...")
 
-        await download(
-            long_report,
-            sandbox,
-            out_dir,
-            all=all,
-            artifacts=artifacts,
-            crashdumps=crashdumps,
-            debug=debug,
-            decompress=decompress,
-            files=download_files,
-            logs=True,  # by default download logs
-            procdumps=procdumps,
-            progress=progress,
-            video=True,  # by default download video
-            idx=idx,
-            image=formatted_image,
-            link=formatted_link,
-        )
+        try:
+            await download(
+                long_report,
+                sandbox,
+                out_dir,
+                all=all,
+                artifacts=artifacts,
+                crashdumps=crashdumps,
+                debug=debug,
+                decompress=decompress,
+                files=download_files,
+                logs=True,  # by default download logs
+                procdumps=procdumps,
+                progress=progress,
+                video=True,  # by default download video
+                idx=idx,
+                image=formatted_image,
+                link=formatted_link,
+            )
+        except aiohttp.SocketTimeoutError:
+            console.error(f"{final_output} • got timeout while downloading results • {get_elapsed_time(task)}")
+            progress.remove_task(task_id)
+            return
 
-        console.done(final_output)
+        console.done(f"{final_output} • {get_elapsed_time(task)}")
 
         progress.remove_task(task_id)
 
@@ -378,3 +408,6 @@ async def scan_internal_advanced(
 
         await asyncio.gather(*tasks)
         await sandbox.api.session.close()
+
+    # clear last line
+    sys.stdout.write("\033[F\033[K")

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/utils/scanner/rescan.py

@@ -13,6 +13,7 @@ from ptsandbox.models import (
     SandboxBaseScanTaskRequest,
     SandboxKey,
     SandboxUploadException,
+    SandboxWaitTimeoutException,
 )
 from rich.progress import Progress, SpinnerColumn, TaskID, TextColumn, TimeElapsedColumn
 
@@ -157,8 +158,13 @@ async def rescan_internal(
                 description=f"Waiting for full report for [yellow]{trace.name}[/]",
                 url=formatted_link,
             )
-            if not (awaited_report := await sandbox.wait_for_report(rescan_result, timeout)):
-                console.error(f"Rescan failed for [yellow]{trace.name}[/] • {formatted_link} • {rescan_result}")
+            try:
+                if not (awaited_report := await sandbox.wait_for_report(rescan_result, timeout)):
+                    console.error(f"Rescan failed for [yellow]{trace.name}[/] • {formatted_link} • {rescan_result}")
+                    progress.remove_task(task_id)
+                    return
+            except SandboxWaitTimeoutException:
+                console.error(f"{final_output} • got timeout while waiting")
                 progress.remove_task(task_id)
                 return
 

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/utils/unpack/__init__.py

@@ -80,17 +80,24 @@ class Unpack:
     def run(self) -> None:
         if Path(self.trace / "drakvuf-trace.log.gz").exists():
             self.logs["drakvuf-trace"] = Path(self.trace / "drakvuf-trace.log.gz")
-        if Path(self.trace / "drakvuf-trace.log.zst").exists():
+        elif Path(self.trace / "drakvuf-trace.log.zst").exists():
             self.logs["drakvuf-trace"] = Path(self.trace / "drakvuf-trace.log.zst")
 
         self._extract_logs()
         self._create_dirs()
         self._move_files()
 
-        # Run plugins
+        # run plugins
         for plugin in self.plugins:
             plugin.run()
 
-        # Remove files
+        # remove files
         for log in self.logs.values():
+            # drakvuf trace not found
+            if log == Path(""):
+                continue
+
+            if not log.exists():
+                continue
+
             log.unlink(missing_ok=True)

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/utils/unpack/plugins/correlation.py

@@ -3,7 +3,6 @@ from pathlib import Path
 
 import orjson
 
-from sandbox_cli.console import console
 from sandbox_cli.models.detections import DetectionType
 from sandbox_cli.utils.unpack.plugins.abc import BasePlugin
 
@@ -13,7 +12,6 @@ class CorrelatedRules(BasePlugin):
         base_path = self.trace / "correlated"
         file = Path(base_path / "events-correlated.log")
         if not file.exists():
-            console.warning(f"{file} not exist")
             return
 
         with open(file, errors="ignore", encoding="utf-8") as fd:

{sandbox_cli-0.2.37 → sandbox_cli-0.2.39}/sandbox_cli/utils/unpack/plugins/sort_by_plugins.py

@@ -3,7 +3,6 @@ from pathlib import Path
 
 import orjson
 
-from sandbox_cli.console import console
 from sandbox_cli.utils.unpack.plugins.abc import BasePlugin
 
 
@@ -12,7 +11,6 @@ class SortByPlugins(BasePlugin):
         base_path = self.trace / "normalized"
         file = Path(base_path / "events-normalized.log")
         if not file.exists():
-            console.warning(f"{file} not exist")
             return
 
         with open(file, errors="ignore", encoding="utf-8") as fd: