From 1c07c82faa8b60b22dc8a76a9235d250294061bd Mon Sep 17 00:00:00 2001
From: Ana Maria Martinez Gomez <ana.martinez@mandiant.com>
Date: Tue, 30 Jan 2024 11:31:37 +0100
Subject: [PATCH] [libraries.python3] Install lznt1 Python library

LZNT1 compression is widely used in malware. So I think it would be
useful to be able to use LZNT1 compression/decompression in FLARE-VM.
Add the lznt1 Python library to libraries.python3.vm to provide this
functionality.
---
 .../libraries.python3.vm/libraries.python3.vm.nuspec  |  2 +-
 packages/libraries.python3.vm/tools/modules.xml       | 11 ++++++-----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/packages/libraries.python3.vm/libraries.python3.vm.nuspec b/packages/libraries.python3.vm/libraries.python3.vm.nuspec
index 180b9f392..45c148a2a 100644
--- a/packages/libraries.python3.vm/libraries.python3.vm.nuspec
+++ b/packages/libraries.python3.vm/libraries.python3.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>libraries.python3.vm</id>
-    <version>0.0.0.20231220</version>
+    <version>0.0.0.20240130</version>
     <description>Metapackage to install common Python libraries</description>
     <authors>Several, check in pypi.org for every of the libraries</authors>
     <dependencies>
diff --git a/packages/libraries.python3.vm/tools/modules.xml b/packages/libraries.python3.vm/tools/modules.xml
index 427655400..55c75827e 100644
--- a/packages/libraries.python3.vm/tools/modules.xml
+++ b/packages/libraries.python3.vm/tools/modules.xml
@@ -3,30 +3,31 @@
     <module name="acefile"/>
     <module name="art"/>
     <module name="binwalk" url="https://github.com/ReFirmLabs/binwalk/archive/refs/tags/v2.3.3.zip"/>
-    <module name="flare-capa"/>
     <module name="capstone-windows"/>
     <module name="dissect"/>
-    <module name="dnfile"/>
     <module name="dncil"/>
+    <module name="dnfile"/>
+    <module name="flare-capa"/>
     <module name="hexdump"/>
     <module name="ldapdomaindump"/>
+    <module name="lznt1"/>
     <module name="mkyara"/>
     <module name="msoffcrypto-tool"/>
     <module name="olefile"/>
     <module name="oletools"/>
     <module name="pefile"/>
+    <module name="psutil"/>
     <module name="pyasn1"/>
     <module name="pycryptodome"/>
     <module name="pyftpdlib"/>
+    <module name="pyOpenSSL"/>
     <module name="pyreadline3"/>
     <module name="pythonnet"/>
-    <module name="pyOpenSSL"/>
-    <module name="psutil"/>
     <module name="requests"/>
     <module name="stringsifter"/>
     <module name="uncompyle6"/>
-    <module name="unpy2exe"/>
     <module name="unicorn"/>
+    <module name="unpy2exe"/>
     <module name="vivisect"/>
     <module name="XLMMacroDeobfuscator"/>
     <module name="yara-python"/>