sandbox-cli 0.2.42__tar.gz → 0.2.44__tar.gz

{sandbox_cli-0.2.42 → sandbox_cli-0.2.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sandbox-cli
-Version: 0.2.42
+Version: 0.2.44
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli
@@ -14,10 +14,10 @@ Requires-Python: >=3.11
 Requires-Dist: aiofiles>=24.1.0
 Requires-Dist: asyncssh>=2.21.1
 Requires-Dist: colorama>=0.4.6
-Requires-Dist: cryptography>=46.0.1
-Requires-Dist: cyclopts>=3.24.0
+Requires-Dist: cryptography>=46.0.2
+Requires-Dist: cyclopts>=4.2.5
 Requires-Dist: docker>=7.1.0
-Requires-Dist: ptsandbox>=5.0.6
+Requires-Dist: ptsandbox>=5.0.8
 Requires-Dist: pyzipper>=0.3.6
 Requires-Dist: rich>=14.1.0
 Requires-Dist: zstandard>=0.23.0

{sandbox_cli-0.2.42 → sandbox_cli-0.2.44}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.2.42"
+version = "0.2.44"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -11,10 +11,10 @@ dependencies = [
   "aiofiles>=24.1.0",
   "asyncssh>=2.21.1",
   "colorama>=0.4.6",
-  "cryptography>=46.0.1",
-  "cyclopts>=3.24.0",
+  "cryptography>=46.0.2",
+  "cyclopts>=4.2.5",
   "docker>=7.1.0",
-  "ptsandbox>=5.0.6",
+  "ptsandbox>=5.0.8",
   "pyzipper>=0.3.6",
   "rich>=14.1.0",
   "zstandard>=0.23.0",

{sandbox_cli-0.2.42 → sandbox_cli-0.2.44}/sandbox_cli/cli/__init__.py

@@ -10,7 +10,8 @@ from sandbox_cli.cli.unpack import unpack_logs
 from sandbox_cli.console import console
 from sandbox_cli.internal.config import configpath, settings
 
-init() # colorama stuff for working on windows
+init()  # colorama stuff for working on windows
+
 
 def get_version() -> str:
     import importlib.metadata
@@ -32,6 +33,8 @@ app = App(
     console=console,
 )
 
+app.register_install_completion_command(add_to_startup=False)
+
 app.command(name=["conv", "unpack"])(unpack_logs)
 app.command(name="report")(generate_report)
 app.command(name="browser")(open_browser)

{sandbox_cli-0.2.42 → sandbox_cli-0.2.44}/sandbox_cli/cli/scanner/__init__.py

@@ -494,7 +494,7 @@ async def scan_new(
         Path | None,
         Parameter(
             name=["--syscall-hooks", "-s"],
-            help="Path to files with syscall hooks (file with syscall names splitted by newline)",
+            help="Path to file with syscall hooks (file with syscall names splitted by newline)",
             group="Sandbox Options",
         ),
     ] = None,
@@ -506,6 +506,14 @@ async def scan_new(
             group="Sandbox Options",
         ),
     ] = None,
+    unimon_hooks: Annotated[
+        Path | None,
+        Parameter(
+            name=["--unimon-hooks", "-u"],
+            help="Path to file with unimon hooks",
+            group="Sandbox Options",
+        ),
+    ] = None,
     custom_command: Annotated[
         str | None,
         Parameter(
@@ -540,6 +548,15 @@ async def scan_new(
             negative="",
         ),
     ] = False,
+    disable_lightweight_dumps: Annotated[
+        bool,
+        Parameter(
+            name=["--disable-lightweight-dumps", "-dl"],
+            help="Disable lightweight memory dumps (mostly for testing purposes)",
+            group="Sandbox Options",
+            negative="",
+        ),
+    ] = False,
     bootkitmon: Annotated[
         bool,
         Parameter(
@@ -729,12 +746,14 @@ async def scan_new(
         is_local=is_local,
         analysis_duration=analysis_duration,
         syscall_hooks=syscall_hooks,
+        unimon_hooks=unimon_hooks,
         custom_command=custom_command,
         dll_hooks_dir=dll_hooks_dir,
         fake_name=fake_name,
         unpack=unpack,
         priority=priority,
         no_procdumps_on_finish=no_procdumps_on_finish,
+        disable_lightweight_dumps=disable_lightweight_dumps,
         bootkitmon=bootkitmon,
         bootkitmon_duration=bootkitmon_duration,
         mitm_disabled=mitm_disabled,

{sandbox_cli-0.2.42 → sandbox_cli-0.2.44}/sandbox_cli/utils/scanner/advanced.py

@@ -91,9 +91,11 @@ async def _prepare_sandbox_new_scan(
     is_local: bool,
     analysis_duration: int,
     syscall_hooks: Path | None,
+    unimon_hooks: Path | None,
     dll_hooks_dir: Path | None,
     custom_command: str | None,
     no_procdumps_on_finish: bool,
+    disable_lightweight_dumps: bool,
     bootkitmon: bool,
     bootkitmon_duration: int,
     mitm_disabled: bool,
@@ -155,6 +157,8 @@ async def _prepare_sandbox_new_scan(
     # all debug options available in library
     sandbox_options.debug_options["save_debug_files"] = True
     sandbox_options.debug_options["extract_crashdumps"] = True
+    # by default we want to use lightweight memory dumps
+    sandbox_options.debug_options["procdump_lightweight_mode"] = not disable_lightweight_dumps
 
     # process custom options
     compiled_rules = await _get_compiled_rules(rules_dir=rules_dir, is_local=is_local, progress=progress)
@@ -170,6 +174,13 @@ async def _prepare_sandbox_new_scan(
         syscall_hooks_uri = (await sandbox.api.upload_file(data)).data.file_uri
         sandbox_options.debug_options["custom_syscall_hooks"] = syscall_hooks_uri
 
+    if unimon_hooks:
+        progress.console.print(f"{console.INFO} Upload unimon hooks: {unimon_hooks}")
+        async with aiofiles.open(unimon_hooks, mode="rb") as fd:
+            data = await fd.read()
+        unimon_hooks_uri = (await sandbox.api.upload_file(data)).data.file_uri
+        sandbox_options.debug_options["custom_unimon_hooks"] = unimon_hooks_uri
+
     if dll_hooks_dir:
         progress.console.print(f"{console.INFO} Upload dll hooks: {dll_hooks_dir}")
         data = merge_dll_hooks(Path(dll_hooks_dir))
@@ -205,12 +216,14 @@ async def scan_internal_advanced(
     is_local: bool,
     analysis_duration: int,
     syscall_hooks: Path | None,
+    unimon_hooks: Path | None,
     dll_hooks_dir: Path | None,
     custom_command: str | None,
     fake_name: str | None,
     unpack: bool,
     priority: int,
     no_procdumps_on_finish: bool,
+    disable_lightweight_dumps: bool,
     bootkitmon: bool,
     bootkitmon_duration: int,
     mitm_disabled: bool,
@@ -383,9 +396,11 @@ async def scan_internal_advanced(
             is_local,
             analysis_duration,
             syscall_hooks,
+            unimon_hooks,
             dll_hooks_dir,
             custom_command,
             no_procdumps_on_finish,
+            disable_lightweight_dumps,
             bootkitmon,
             bootkitmon_duration,
             mitm_disabled,

{sandbox_cli-0.2.42 → sandbox_cli-0.2.44}/sandbox_cli/utils/unpack/plugins/correlation.py

@@ -35,16 +35,16 @@ class CorrelatedRules(BasePlugin):
                         pass
 
         if len(malware) > 0:
-            with open(f"{file}.malware", "w", encoding="utf-8") as fd:
+            with open(base_path / "malware.log", "w", encoding="utf-8") as fd:
                 for line in malware:
                     fd.write(line)
 
         for key, lines in silent.items():
-            with open(f"{file}.silent.{key}", "w", encoding="utf-8") as fd:
+            with open(base_path / f"{key}.silent.log", "w", encoding="utf-8") as fd:
                 for line in lines:
                     fd.write(line)
 
         for key, lines in suspicious.items():
-            with open(f"{file}.suspicious.{key}", "w", encoding="utf-8") as fd:
+            with open(base_path / f"{key}.suspicious.log", "w", encoding="utf-8") as fd:
                 for line in lines:
                     fd.write(line)

{sandbox_cli-0.2.42 → sandbox_cli-0.2.44}/sandbox_cli/utils/unpack/plugins/sort_by_plugins.py

@@ -23,6 +23,6 @@ class SortByPlugins(BasePlugin):
                 plugins[data["plugin"]].append(line)
 
         for plugin, lines in plugins.items():
-            with open(f"{file}.{plugin}", "w", encoding="utf-8") as fd:
+            with open(base_path / f"{plugin}.log", "w", encoding="utf-8") as fd:
                 for line in lines:
                     fd.write(line)