sflock
Sample staging & detonation utility to be used as unpacking engine for other analysis tools. Since version 0.3.14 sflock is compatible with Python >= 3.6
Birds tend to move around in flocks, therefore the sflock utility can digest a flock of samples, but also inverse flocks, i.e., sflock unpacks various archive file formats to extract embedded samples.
Simply put, sflock provides a staging area where binary data is investigated and split into one or more files to be analyzed further by other tools. In particular sflock focuses on integration and usage with Cuckoo Sandbox.
Installation
As-is sflock has been designed to be used to its full extent on Ubuntu/Debian-like systems. For optimal usage it is recommended to install the following packages alongside sflock. It is currently not possible to run the unpackers that require native tooling support on non-Linux platforms.
On Ubuntu/Debian-like systems, the following packages are required:
$ sudo apt-get install rar unace-nonfree cabextract lzip libjpeg8-dev zlib1g-dev zpaq gnupg
On macOS, the following packages can be installed with Homebrew:
$ brew install rar unar cabextract lzip jpeg zlib zpaq gnupg
Installation of sflock itself may be done as follows.
On Linux:
$ sudo pip install -U "sflock2[linux]"
Or in a virtualenv environment.
(venv)$ pip install -U "sflock2[linux]"
On Windows:
> pip install -U "sflock2[windows]"
Or in a virtualenv environment.
(venv)> pip install -U "sflock2[windows]"
Supported archives
SFlock supports a number of (semi-)archive types, sorted by extension:
- .7z (7-Zip archive,
requires native tooling) - .ace (ACE archive,
requires native tooling) - .bup (McAfee quarantine files)
- .cab (Microsoft Cabinet archive,
requires native tooling) - .daa (PowerISO,
requires included Linux native tooling) - .eml (MIME RFC 822 email representation)
- .gzip (gzip compressed data,
requires native tooling) - .iso (ISO file container,
requires native tooling) - .lzh (LZH/LHA archive,
requires native tooling) - .lz (Lzip compressed data,
requires native tooling) - .msg (Outlook mail message)
- .mso (Microsoft Office Macro reference file)
- .pdf (Attachments embedded in PDF files)
- .rar (RAR archive,
requires native tooling) - .tar (Unix file archive)
- .tar.bz2 (bzip2 compressed Unix file archive)
- .tar.gz (gzip compressed Unix file archive)
- .zip (ZIP archive)
- .win (Windows imaging (WIM) image)
Security
Due to its nature of unpacking malicious archives with, depending on the extension, native tools (i.e., .7z, .ace, .cab, .daa, .gzip, .iso, .lzh, and .rar), it is important that such operations happen securely. SFlock therefore wraps execution of the native tools in zipjail, a usermode sandbox written exactly for this purpose.
Documentation
1 maintainer
Release files for SFlock2 0.3.88
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| sflock2-0.3.88.tar.gz | 3.6 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| sflock2-0.3.88-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 7.2 MB
Release files / sflock2-0.3.88.tar.gz
| Download URL | sflock2-0.3.88.tar.gz |
|---|---|
| Size | 3.6 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
6cb6df8bfba9fd1582fe80cbf85f5dd7772e47afab5a3616020f0a52945852d3
|
|
BLAKE2b-256 checksum How to use checksums |
9b8e648f3c0c7dac211e60b59ea0b0434be2c6ce8400d01153f51d7d27aebfa8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 10, 2026.
Transparency logRelease files / sflock2-0.3.88-py3-none-any.whl
| Download URL | sflock2-0.3.88-py3-none-any.whl |
|---|---|
| Size | 3.7 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
971d14ffb80407042b91c72aa4c5dcf6282659d92cfeb976a165be118a36752f
|
|
BLAKE2b-256 checksum How to use checksums |
3d25be891939459f9848476acf1d8d4025c4714ffb389a9d447fe9ba966ed779
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 10, 2026.
Transparency log
