sandbox-cli 0.3.1__tar.gz → 0.3.3__tar.gz

{sandbox_cli-0.3.1 → sandbox_cli-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: sandbox-cli
-Version: 0.3.1
+Version: 0.3.3
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli
@@ -14,10 +14,10 @@ Requires-Python: >=3.11
 Requires-Dist: aiofiles>=25.1.0
 Requires-Dist: asyncssh>=2.24.0
 Requires-Dist: colorama>=0.4.6
-Requires-Dist: cryptography>=49.0.0
-Requires-Dist: cyclopts>=4.20.0
+Requires-Dist: cryptography>=50.0.0
+Requires-Dist: cyclopts>=4.25.0
 Requires-Dist: docker>=7.2.0
-Requires-Dist: ptsandbox>=5.1.0
+Requires-Dist: ptsandbox>=5.1.5
 Requires-Dist: rich>=15.0.0
 Requires-Dist: zstandard>=0.25.0
 Description-Content-Type: text/markdown

{sandbox_cli-0.3.1 → sandbox_cli-0.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.3.1"
+version = "0.3.3"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -11,10 +11,10 @@ dependencies = [
   "aiofiles>=25.1.0",
   "asyncssh>=2.24.0",
   "colorama>=0.4.6",
-  "cryptography>=49.0.0",
-  "cyclopts>=4.20.0",
+  "cryptography>=50.0.0",
+  "cyclopts>=4.25.0",
   "docker>=7.2.0",
-  "ptsandbox>=5.1.0",
+  "ptsandbox>=5.1.5",
   "rich>=15.0.0",
   "zstandard>=0.25.0",
 ]

{sandbox_cli-0.3.1 → sandbox_cli-0.3.3}/sandbox_cli/cli/__init__.py

@@ -58,7 +58,7 @@ def completion(
         path = app.install_completion(shell=shell)
         console.info(f"Completion installed to {path}")
     else:
-        console.print(app.generate_completion(shell=shell), end="")
+        print(app.generate_completion(shell=shell))
 
 
 app.command(name="completion")(completion)
@@ -81,55 +81,54 @@ app.command(
     help="Open sandbox link in the default browser.",
 )
 
-if len(settings.sandbox_keys) > 0:
-    scanner_app = App(name="scanner", help="Scan with the sandbox.", help_format="markdown", console=console)
-    scanner_app.command(
-        "sandbox_cli.cli.scanner.scan:scan",
-        name="scan",
-        help="Send files to scan with the sandbox.",
-    )
-    scanner_app.command(
-        "sandbox_cli.cli.scanner.scan_new:scan_new",
-        name="scan-new",
-        help="Send files to scan with the sandbox (advanced scan).",
-    )
-    scanner_app.command(
-        "sandbox_cli.cli.scanner.re_scan:re_scan",
-        name="re-scan",
-        help="Send traces to re-scan.",
-    )
-    app.command(scanner_app)
-
-    rules_app = App(
-        name="rules",
-        help="Working with raw sandbox rules.",
-        help_format="markdown",
-        console=console,
-    )
-    rules_app.command(
-        "sandbox_cli.cli.rules.compile:compile_rules",
-        name="compile",
-        help="Get compiled rules for working with third-party services.",
-    )
-    rules_app.command(
-        "sandbox_cli.cli.rules.test:test_rules",
-        name="test",
-        help="Testing written rules.",
-    )
-    app.command(rules_app)
-
-    app.command(
-        "sandbox_cli.cli.images:get_images",
-        name="images",
-        help="Get available images in the sandbox.",
-    )
-    app.command(
-        "sandbox_cli.cli.download:download_command",
-        name="download",
-        help="Download any artifact from the sandbox.",
-    )
-    app.command(
-        "sandbox_cli.cli.download:download_email",
-        name="email",
-        help="Upload an email and get its headers.",
-    )
+scanner_app = App(name="scanner", help="Scan with the sandbox.", help_format="markdown", console=console)
+scanner_app.command(
+    "sandbox_cli.cli.scanner.scan:scan",
+    name="scan",
+    help="Send files to scan with the sandbox.",
+)
+scanner_app.command(
+    "sandbox_cli.cli.scanner.scan_new:scan_new",
+    name="scan-new",
+    help="Send files to scan with the sandbox (advanced scan).",
+)
+scanner_app.command(
+    "sandbox_cli.cli.scanner.re_scan:re_scan",
+    name="re-scan",
+    help="Send traces to re-scan.",
+)
+app.command(scanner_app)
+
+rules_app = App(
+    name="rules",
+    help="Working with raw sandbox rules.",
+    help_format="markdown",
+    console=console,
+)
+rules_app.command(
+    "sandbox_cli.cli.rules.compile:compile_rules",
+    name="compile",
+    help="Get compiled rules for working with third-party services.",
+)
+rules_app.command(
+    "sandbox_cli.cli.rules.test:test_rules",
+    name="test",
+    help="Testing written rules.",
+)
+app.command(rules_app)
+
+app.command(
+    "sandbox_cli.cli.images:get_images",
+    name="images",
+    help="Get available images in the sandbox.",
+)
+app.command(
+    "sandbox_cli.cli.download:download_command",
+    name="download",
+    help="Download any artifact from the sandbox.",
+)
+app.command(
+    "sandbox_cli.cli.download:download_email",
+    name="email",
+    help="Upload an email and get its headers.",
+)

{sandbox_cli-0.3.1 → sandbox_cli-0.3.3}/sandbox_cli/cli/download/artifacts.py

@@ -229,6 +229,15 @@ async def download_command(
             group="Download options",
         ),
     ] = False,
+    sample: Annotated[
+        bool,
+        Parameter(
+            name=["--sample", "-s"],
+            help="Download the original sample submitted for analysis",
+            negative="",
+            group="Download options",
+        ),
+    ] = False,
     query: Annotated[
         str | None,
         Parameter(
@@ -281,6 +290,7 @@ async def download_command(
         video=video,
         amsi=amsi,
         dex=dex,
+        sample=sample,
         logs=logs,
         decompress=decompress,
     )

{sandbox_cli-0.3.1 → sandbox_cli-0.3.3}/sandbox_cli/services/downloader.py

@@ -52,6 +52,7 @@ class DownloadOptions:
     video: bool = False
     amsi: bool = False
     dex: bool = False
+    sample: bool = False
 
 
 # At first glance, it's counter-intuitive, but ArtifactType can contain not only predefined fields in it, but also newly added.
@@ -321,11 +322,12 @@ async def download(
     full_report: SandboxBaseTaskResponse | None = None,
     concurrency: int = DEFAULT_CONCURRENCY,
     read_timeout: int = DEFAULT_READ_TIMEOUT,
+    semaphore: asyncio.Semaphore | None = None,
 ) -> None:
     tasks: list[Coroutine[Any, Any, None]] = []
     saved_report_dirs: set[Path] = set()
     claimed: set[Path] = set()
-    semaphore = asyncio.Semaphore(value=concurrency)
+    semaphore = semaphore or asyncio.Semaphore(value=concurrency)
 
     def add_task(out_dir: Path, name: str, file_uri: str, decompress: bool = False, overwrite: bool = False) -> None:
         tasks.append(
@@ -347,6 +349,15 @@ async def download(
             )
         )
 
+    if options.sample:
+        for artifact in report.artifacts:
+            fi = artifact.file_info
+            if fi is None or not fi.file_uri:
+                continue
+
+            name = Path(fi.file_path).name or fi.sha256
+            add_task(out_dir, f"{name}.bin", fi.file_uri)
+
     for artifact in report.artifacts:
         for sandbox_result in artifact.get_sandbox_results():
             if sandbox_result is None or sandbox_result.details is None or sandbox_result.details.sandbox is None:

{sandbox_cli-0.3.1 → sandbox_cli-0.3.3}/sandbox_cli/services/scanner/advanced.py

@@ -28,12 +28,28 @@ from sandbox_cli.core.scan import (
     save_report,
     save_scan_arguments,
 )
-from sandbox_cli.services.downloader import DownloadOptions, download
+from sandbox_cli.services.downloader import DEFAULT_CONCURRENCY as DEFAULT_DOWNLOAD_CONCURRENCY
+from sandbox_cli.services.downloader import (
+    DownloadOptions,
+    download,
+)
 from sandbox_cli.services.scanner.compile import compile_rules
-from sandbox_cli.services.scanner.images import fetch_available_images, resolve_scan_images
+from sandbox_cli.services.scanner.images import (
+    fetch_available_images,
+    resolve_scan_images,
+)
 from sandbox_cli.services.scanner.tasks import build_scan_tasks
-from sandbox_cli.services.scanner.uploads import gather_uploads, upload_dll_hooks, upload_file, upload_rules
-from sandbox_cli.services.scanner.utils import compute_wait_time, get_elapsed_time, shorten_name
+from sandbox_cli.services.scanner.uploads import (
+    gather_uploads,
+    upload_dll_hooks,
+    upload_file,
+    upload_rules,
+)
+from sandbox_cli.services.scanner.utils import (
+    compute_wait_time,
+    get_elapsed_time,
+    shorten_name,
+)
 from sandbox_cli.services.unpack import Unpack
 
 if TYPE_CHECKING:
@@ -210,6 +226,7 @@ async def scan_internal_advanced(
 ) -> None:
     key = get_key_by_name(key_name)
     sandbox_sem = asyncio.Semaphore(value=key.max_workers)
+    download_sem = asyncio.Semaphore(value=DEFAULT_DOWNLOAD_CONCURRENCY)
     progress = make_scan_progress(with_image=True, disable=True)
 
     async def process_file(
@@ -308,6 +325,7 @@ async def scan_internal_advanced(
                 idx=idx,
                 image=formatted_image,
                 link=formatted_link,
+                semaphore=download_sem,
             )
         except aiohttp.SocketTimeoutError:
             console.error(f"{final_output} • got timeout while downloading results • {get_elapsed_time(task)}")
@@ -333,7 +351,12 @@ async def scan_internal_advanced(
             sandbox_options=sandbox_options,
         )
         save_scan_arguments(out_dir, sandbox_arguments)
-        await process_file(sandbox_options, file_path, out_dir, idx)
+
+        image_string = rf"\[{sandbox_options.image_id}]"
+        try:
+            await process_file(sandbox_options, file_path, out_dir, idx)
+        except Exception as e:
+            console.error(f"{image_string} • [yellow]{shorten_name(file_path.name)}[/] • unexpected error • {e}")
 
     console.info(f"Using key: name={key.name} max_workers={key.max_workers}")
 

{sandbox_cli-0.3.1 → sandbox_cli-0.3.3}/sandbox_cli/services/scanner/basic.py

@@ -24,11 +24,23 @@ from sandbox_cli.core.scan import (
     save_report,
     save_scan_arguments,
 )
-from sandbox_cli.services.downloader import DownloadOptions, download
+from sandbox_cli.services.downloader import DEFAULT_CONCURRENCY as DEFAULT_DOWNLOAD_CONCURRENCY
+from sandbox_cli.services.downloader import (
+    DownloadOptions,
+    download,
+)
 from sandbox_cli.services.scanner.compile import compile_rules
-from sandbox_cli.services.scanner.images import fetch_available_images, resolve_scan_images
+from sandbox_cli.services.scanner.images import (
+    fetch_available_images,
+    resolve_scan_images,
+)
 from sandbox_cli.services.scanner.tasks import build_scan_tasks
-from sandbox_cli.services.scanner.uploads import gather_uploads, upload_dll_hooks, upload_file, upload_rules
+from sandbox_cli.services.scanner.uploads import (
+    gather_uploads,
+    upload_dll_hooks,
+    upload_file,
+    upload_rules,
+)
 from sandbox_cli.services.scanner.utils import compute_wait_time, shorten_name
 from sandbox_cli.services.unpack import Unpack
 
@@ -107,6 +119,7 @@ async def scan_internal(
 ) -> None:
     key = get_key_by_name(key_name)
     sandbox_sem = asyncio.Semaphore(value=key.max_workers)
+    download_sem = asyncio.Semaphore(value=DEFAULT_DOWNLOAD_CONCURRENCY)
 
     async def process_file(
         sandbox_options: SandboxBaseScanTaskRequest.Options,
@@ -174,6 +187,7 @@ async def scan_internal(
             sandbox,
             out_dir,
             replace(download_options, video=True, logs=True),
+            semaphore=download_sem,
         )
         console.info(
             rf"\[[magenta]{sandbox_options.sandbox.image_id}[/magenta]] Scan [yellow]{shorten_name(file_path.name)}[/] completed. {link}"
@@ -194,7 +208,12 @@ async def scan_internal(
             sandbox_options=sandbox_options.sandbox,
         )
         save_scan_arguments(out_dir, sandbox_arguments)
-        await process_file(sandbox_options, file_path, out_dir, idx)
+
+        image_string = f"[{sandbox_options.sandbox.image_id}]"
+        try:
+            await process_file(sandbox_options, file_path, out_dir, idx)
+        except Exception as e:
+            console.error(f"{idx} [{image_string}] [yellow]{shorten_name(file_path.name)}[/] • unexpected error • {e}")
 
     console.info(f"Using key: name={key.name} max_workers={key.max_workers}")
 

{sandbox_cli-0.3.1 → sandbox_cli-0.3.3}/sandbox_cli/services/scanner/rescan.py

@@ -28,7 +28,11 @@ from sandbox_cli.core.scan import (
     save_report,
     save_scan_arguments,
 )
-from sandbox_cli.services.downloader import DownloadOptions, download
+from sandbox_cli.services.downloader import DEFAULT_CONCURRENCY as DEFAULT_DOWNLOAD_CONCURRENCY
+from sandbox_cli.services.downloader import (
+    DownloadOptions,
+    download,
+)
 from sandbox_cli.services.scanner.compile import compile_rules
 from sandbox_cli.services.scanner.utils import shorten_name
 from sandbox_cli.services.unpack import Unpack
@@ -122,6 +126,7 @@ async def rescan_internal(
 ) -> None:
     key = get_key_by_name(key_name)
     sandbox_sem = asyncio.Semaphore(value=key.max_workers)
+    download_sem = asyncio.Semaphore(value=DEFAULT_DOWNLOAD_CONCURRENCY)
 
     progress = make_scan_progress(with_image=False, disable=True)
 
@@ -202,6 +207,7 @@ async def rescan_internal(
             sandbox,
             out_dir,
             replace(download_options, logs=True),
+            semaphore=download_sem,
         )
 
         console.done(final_output)
@@ -217,7 +223,10 @@ async def rescan_internal(
             console.error(str(e))
             return
 
-        await process_trace(drakvuf_trace, tcpdump_pcap, trace, out_dir, idx)
+        try:
+            await process_trace(drakvuf_trace, tcpdump_pcap, trace, out_dir, idx)
+        except Exception as e:
+            console.error(f"[yellow]{shorten_name(trace.name)}[/] • unexpected error • {e}")
 
     console.info(f"Using key: name={key.name} max_workers={key.max_workers}")