sandbox-cli 0.2.38__tar.gz → 0.2.40__tar.gz

{sandbox_cli-0.2.38 → sandbox_cli-0.2.40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sandbox-cli
-Version: 0.2.38
+Version: 0.2.40
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli

{sandbox_cli-0.2.38 → sandbox_cli-0.2.40}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.2.38"
+version = "0.2.40"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"

{sandbox_cli-0.2.38 → sandbox_cli-0.2.40}/sandbox_cli/cli/reporter.py

@@ -53,6 +53,14 @@ def generate_report(
             negative="",
         ),
     ] = False,
+    suspicious: Annotated[
+        bool,
+        Parameter(
+            name=["--supicious", "-s"],
+            help="Include suspicious detects",
+            negative="",
+        ),
+    ] = False,
 ) -> None:
     """
     Generate short report from sandbox scans.
@@ -118,7 +126,7 @@ def generate_report(
                 {
                     "sample": report.artifacts[0].file_info.file_path,  # type: ignore
                     "image": image,
-                    "verdict": delimeter.join(extract_verdict_from_trace(corr_trace)),
+                    "verdict": delimeter.join(extract_verdict_from_trace(corr_trace, suspicious)),
                     "static": delimeter.join(extract_static(report)),
                     "memory": delimeter.join(extract_memory(report)),
                     "network": delimeter.join(extract_network_from_trace(corr_trace)),

{sandbox_cli-0.2.38 → sandbox_cli-0.2.40}/sandbox_cli/utils/downloader/__init__.py

@@ -6,6 +6,7 @@ from typing import Any
 from uuid import UUID
 
 import aiofiles
+import aiohttp
 import zstandard
 from ptsandbox import Sandbox
 from ptsandbox.models import (
@@ -65,13 +66,20 @@ async def _save_artifact(
             else:
                 task_id = progress.add_task(rf"\[[green1]{scan_id}[/]] {escape(path.name)}")
         try:
-            downloaded_data = await sandbox.get_file(uri)
+            # a 5-minute timeout for downloading large files
+            downloaded_data = await sandbox.get_file(uri, read_timeout=300)
         except SandboxFileNotFoundException:
             console.warning(f"File {path.name} not found in storage: {uri=} {scan_id=}")
             if progress:
                 progress.stop_task(task_id)
                 progress.update(task_id=task_id, visible=False)
             return
+        except aiohttp.SocketTimeoutError as e:
+            if progress:
+                progress.stop_task(task_id)
+                progress.update(task_id=task_id, visible=False)
+
+            raise e
 
         if decompress:
             try:
@@ -138,7 +146,11 @@ async def download(
             if sandbox_result.details.sandbox is None:
                 continue
 
-            if sandbox_result.details.sandbox.image and (image_id := sandbox_result.details.sandbox.image.image_id) and out_dir.parts[-1] != image_id:
+            if (
+                sandbox_result.details.sandbox.image
+                and (image_id := sandbox_result.details.sandbox.image.image_id)
+                and out_dir.parts[-1] != image_id
+            ):
                 output = out_dir / image_id
             else:
                 output = out_dir

{sandbox_cli-0.2.38 → sandbox_cli-0.2.40}/sandbox_cli/utils/extractors.py

@@ -4,18 +4,16 @@ from ptsandbox.models import ArtifactType, EngineSubsystem, SandboxBaseTaskRespo
 from sandbox_cli.models.detections import Detections
 
 
-def extract_verdict_from_trace(trace: bytes) -> set[str]:
-    non_generics: set[str] = set()
-    generics: set[str] = set()
-
+def extract_verdict_from_trace(trace: bytes, suspicious: bool = False) -> list[str]:
     d = Detections(trace)
-    for detect in d.malware:
-        if detect.name.split(".")[-2] == "Generic":
-            generics.add(detect.name)
-        else:
-            non_generics.add(detect.name)
-
-    return non_generics if len(non_generics) != 0 else generics
+    malware_detects: list[str] = list({detect.name for detect in d.malware})
+    suspicious_detects: set[str] = set()
+    if suspicious:
+        for detect in d.suspicious:
+            suspicious_detects.add(detect.name)
+
+    # malware detects always on top
+    return malware_detects + sorted(suspicious_detects)
 
 
 def extract_network_from_trace(trace: bytes) -> set[str]:

{sandbox_cli-0.2.38 → sandbox_cli-0.2.40}/sandbox_cli/utils/scanner/advanced.py

@@ -15,7 +15,14 @@ from ptsandbox.models import (
     VNCMode,
 )
 from rich.markup import escape
-from rich.progress import Progress, SpinnerColumn, TaskID, TextColumn, TimeElapsedColumn
+from rich.progress import (
+    Progress,
+    SpinnerColumn,
+    Task,
+    TaskID,
+    TextColumn,
+    TimeElapsedColumn,
+)
 
 from sandbox_cli.console import console
 from sandbox_cli.internal.config import VMImage, settings
@@ -69,6 +76,13 @@ async def _get_compiled_rules(progress: Progress, rules_dir: Path | None, is_loc
     return result
 
 
+def get_elapsed_time(task: Task) -> str:
+    hours = int(task.elapsed) // 3600
+    minutes = (int(task.elapsed) % 3600) // 60
+    seconds = int(task.elapsed) % 60
+    return f"[yellow]{hours}:{minutes:02d}:{seconds:02d}[/]"
+
+
 async def _prepare_sandbox_new_scan(
     progress: Progress,
     scan_images: set[VMImage | str],
@@ -246,6 +260,8 @@ async def scan_internal_advanced(
 
         async with sandbox_sem:
             task_id = progress.add_task(description="Creating task", idx=idx, image=formatted_image, url="...")
+            # because progress.tasks is .values() from dict, not an actual list
+            task = next(t for t in progress.tasks if t.id == task_id)
 
             wait_time = sandbox_options.analysis_duration * 4 + (300 if sandbox_options.analysis_duration < 80 else 120)
 
@@ -266,7 +282,7 @@ async def scan_internal_advanced(
                 progress.remove_task(task_id)
                 return
             except aiohttp.client_exceptions.ClientResponseError as e:
-                console.error(f"{image_string} • [yellow]{file_path.name}[/] • {e}")
+                console.error(f"{image_string} • [yellow]{file_path.name}[/] • {e} • {get_elapsed_time(task)}")
                 progress.remove_task(task_id)
                 return
 
@@ -283,11 +299,11 @@ async def scan_internal_advanced(
             )
             try:
                 if not (awaited_report := await sandbox.wait_for_report(scan_result, wait_time)):
-                    console.error(f"{final_output} • scan failed")
+                    console.error(f"{final_output} • scan failed • {get_elapsed_time(task)}")
                     progress.remove_task(task_id)
                     return
             except SandboxWaitTimeoutException:
-                console.error(f"{final_output} • got timeout while waiting")
+                console.error(f"{final_output} • got timeout while waiting • {get_elapsed_time(task)}")
                 progress.remove_task(task_id)
                 return
 
@@ -297,32 +313,37 @@ async def scan_internal_advanced(
         (out_dir / settings.report_name).write_text(scan_result.model_dump_json(indent=4), encoding="utf-8")
 
         if not (long_report := scan_result.get_long_report()):
-            console.error(f"{final_output} • full report not available")
+            console.error(f"{final_output} • full report not available • {get_elapsed_time(task)}")
             progress.remove_task(task_id)
             return
 
         progress.update(task_id=task_id, description="Downloading results...")
 
-        await download(
-            long_report,
-            sandbox,
-            out_dir,
-            all=all,
-            artifacts=artifacts,
-            crashdumps=crashdumps,
-            debug=debug,
-            decompress=decompress,
-            files=download_files,
-            logs=True,  # by default download logs
-            procdumps=procdumps,
-            progress=progress,
-            video=True,  # by default download video
-            idx=idx,
-            image=formatted_image,
-            link=formatted_link,
-        )
+        try:
+            await download(
+                long_report,
+                sandbox,
+                out_dir,
+                all=all,
+                artifacts=artifacts,
+                crashdumps=crashdumps,
+                debug=debug,
+                decompress=decompress,
+                files=download_files,
+                logs=True,  # by default download logs
+                procdumps=procdumps,
+                progress=progress,
+                video=True,  # by default download video
+                idx=idx,
+                image=formatted_image,
+                link=formatted_link,
+            )
+        except aiohttp.SocketTimeoutError:
+            console.error(f"{final_output} • got timeout while downloading results • {get_elapsed_time(task)}")
+            progress.remove_task(task_id)
+            return
 
-        console.done(final_output)
+        console.done(f"{final_output} • {get_elapsed_time(task)}")
 
         progress.remove_task(task_id)