sandbox-cli 0.2.44__tar.gz → 0.2.46__tar.gz

{sandbox_cli-0.2.44 → sandbox_cli-0.2.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sandbox-cli
-Version: 0.2.44
+Version: 0.2.46
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli

{sandbox_cli-0.2.44 → sandbox_cli-0.2.46}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.2.44"
+version = "0.2.46"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"

{sandbox_cli-0.2.44 → sandbox_cli-0.2.46}/sandbox_cli/cli/scanner/__init__.py

@@ -514,6 +514,14 @@ async def scan_new(
             group="Sandbox Options",
         ),
     ] = None,
+    fileextractor_excludes: Annotated[
+        Path | None,
+        Parameter(
+            name=["--fileextractor-excludes", "-fe"],
+            help="Path to file with fileextractor excludes",
+            group="Sandbox Options",
+        ),
+    ] = None,
     custom_command: Annotated[
         str | None,
         Parameter(
@@ -699,6 +707,14 @@ async def scan_new(
             negative="",
         ),
     ] = False,
+    preserve_filename: Annotated[
+        bool,
+        Parameter(
+            name=["--preserve-filename", "-pf"],
+            help="Do not change filename for analysis.  \nWhen set to false (default behaviour): local/path/to/malware.exe[_~] -> sandbox/guest/os/malware.exe  \nWhen set to true name will remain unchanged.",
+            negative="",
+        ),
+    ] = False,
 ) -> None:
     """
     Send files to scan with the sandbox (advanced scan).
@@ -749,6 +765,7 @@ async def scan_new(
         unimon_hooks=unimon_hooks,
         custom_command=custom_command,
         dll_hooks_dir=dll_hooks_dir,
+        fileextractor_excludes=fileextractor_excludes,
         fake_name=fake_name,
         unpack=unpack,
         priority=priority,
@@ -771,5 +788,6 @@ async def scan_new(
         procdumps=procdumps,
         decompress=decompress,
         open_browser=open_browser,
+        preserve_filename=preserve_filename,
         outbound_connections=outbound_connections,
     )

{sandbox_cli-0.2.44 → sandbox_cli-0.2.46}/sandbox_cli/utils/scanner/advanced.py

@@ -39,6 +39,7 @@ from sandbox_cli.utils.merge_dll_hooks import merge_dll_hooks
 from sandbox_cli.utils.unpack import Unpack
 
 DELIMETER = "\n"
+SAFE_SUFFIXES = "_~"
 
 
 async def _get_compiled_rules(progress: Progress, rules_dir: Path | None, is_local: bool) -> bytes | None:
@@ -93,6 +94,7 @@ async def _prepare_sandbox_new_scan(
     syscall_hooks: Path | None,
     unimon_hooks: Path | None,
     dll_hooks_dir: Path | None,
+    filextractor_excludes: Path | None,
     custom_command: str | None,
     no_procdumps_on_finish: bool,
     disable_lightweight_dumps: bool,
@@ -187,6 +189,13 @@ async def _prepare_sandbox_new_scan(
         dll_hooks_uri = (await sandbox.api.upload_file(data)).data.file_uri
         sandbox_options.debug_options["custom_dll_hooks"] = dll_hooks_uri
 
+    if filextractor_excludes:
+        progress.console.print(f"{console.INFO} Upload fileextractor excludes: {filextractor_excludes}")
+        async with aiofiles.open(filextractor_excludes, mode="rb") as fd:
+            data = await fd.read()
+        fileextractor_excludes_uri = (await sandbox.api.upload_file(data)).data.file_uri
+        sandbox_options.debug_options["custom_fileextractor_exclude"] = fileextractor_excludes_uri
+
     if custom_command:
         progress.console.print(f"{console.INFO} Commandline: {custom_command}")
         sandbox_options.custom_command = custom_command
@@ -218,6 +227,7 @@ async def scan_internal_advanced(
     syscall_hooks: Path | None,
     unimon_hooks: Path | None,
     dll_hooks_dir: Path | None,
+    fileextractor_excludes: Path | None,
     custom_command: str | None,
     fake_name: str | None,
     unpack: bool,
@@ -241,6 +251,7 @@ async def scan_internal_advanced(
     procdumps: bool,
     decompress: bool,
     open_browser: bool,
+    preserve_filename: bool,
     outbound_connections: list[str] | None,
 ) -> None:
     key = get_key_by_name(key_name)
@@ -282,9 +293,13 @@ async def scan_internal_advanced(
                 wait_time = wait_timeout
 
             try:
+                guest_filename = file_path.name
+                if not preserve_filename:
+                    guest_filename = guest_filename.rstrip(SAFE_SUFFIXES)
+
                 scan_result = await sandbox.create_advanced_scan(
                     file_path,
-                    file_name=fake_name or file_path.name,
+                    file_name=fake_name or guest_filename,
                     extra_files=extra_files,
                     async_result=True,
                     priority=priority,
@@ -389,25 +404,26 @@ async def scan_internal_advanced(
     tasks: list[Coroutine[Any, Any, None]] = []
     with progress:
         sandbox, sandbox_options, images = await _prepare_sandbox_new_scan(
-            progress,
-            scan_images,
-            rules_dir,
-            key,
-            is_local,
-            analysis_duration,
-            syscall_hooks,
-            unimon_hooks,
-            dll_hooks_dir,
-            custom_command,
-            no_procdumps_on_finish,
-            disable_lightweight_dumps,
-            bootkitmon,
-            bootkitmon_duration,
-            mitm_disabled,
-            disable_clicker,
-            skip_sample_run,
-            vnc_mode,
-            outbound_connections,
+            progress=progress,
+            scan_images=scan_images,
+            rules_dir=rules_dir,
+            sandbox_key=key,
+            is_local=is_local,
+            analysis_duration=analysis_duration,
+            syscall_hooks=syscall_hooks,
+            unimon_hooks=unimon_hooks,
+            dll_hooks_dir=dll_hooks_dir,
+            filextractor_excludes=fileextractor_excludes,
+            custom_command=custom_command,
+            no_procdumps_on_finish=no_procdumps_on_finish,
+            disable_lightweight_dumps=disable_lightweight_dumps,
+            bootkitmon=bootkitmon,
+            bootkitmon_duration=bootkitmon_duration,
+            mitm_disabled=mitm_disabled,
+            disable_clicker=disable_clicker,
+            skip_sample_run=skip_sample_run,
+            vnc_mode=vnc_mode,
+            outbound_connections=outbound_connections,
         )
         max_image_length = max(len(x) for x in images)
         for i, image_id in enumerate(images):

{sandbox_cli-0.2.44 → sandbox_cli-0.2.46}/sandbox_cli/utils/scanner/rescan.py

@@ -76,6 +76,10 @@ async def _prepare_rescan_options(
 
     sandbox_options = SandboxBaseScanTaskRequest.Options(analysis_depth=2, passwords_for_unpack=settings.passwords)
 
+    # some enabled options by default
+    # all debug options available in library
+    sandbox_options.debug_options["save_debug_files"] = True
+
     # process custom options
     compiled_rules = await _get_compiled_rules(rules_dir=rules_dir, is_local=is_local, progress=progress)