update wsb builder

Author: unrooted

.gitignore

@@ -1,4 +1,5 @@
-.DS_Store
+**/.DS_Store
+**/._DS_Store
 
 Utils/Toolkits/*
 !Utils/Toolkits/.gitkeep
@@ -12,5 +13,8 @@ Input/*
 Output/*
 !Output/.gitkeep
 
+Tools/*
+!Tools/.gitkeep
+
 # Work-in-progress profiles — not yet released
 .drafts/

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to RedSand are documented here. Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Note: the artifacts here are Windows Sandbox configs and PowerShell scripts rather than a versioned API, so semver is followed loosely — minor version bumps reflect meaningful additions to the user-facing surface.
 
+## [2.2] - 2026-05-28
+
+### Added
+- **`build-wsb.ps1`** - added an option to provide local directory that will be mapped into the Sandbox
+
+### Changed
+- **Profiles** - by default, mapping gitignored `Tools` directory, to drop-in portable tooling, can be further tweaked - check out README's `Using your own tools` section
+
 ## [2.1] — 2026-05-19
 
 ### Added

README.md

@@ -79,6 +79,7 @@ RedSand/
 ├── Files/                      # Read-write scratch (default profile only)
 ├── Input/                      # Read-only sample / evidence drop (Analysis + Forensics)
 ├── Output/                     # Read-write results dir (Analysis + Forensics)
+├── Tools/                      # Read-only BYO tools (mapped by every profile, see Customization)
 └── Utils/
     ├── Toolkits/               # Tools downloaded by OnHost scripts land here
     └── Scripts/
@@ -162,6 +163,37 @@ powershell.exe -ExecutionPolicy Bypass -File .\Utils\Scripts\AdditionalScripts\O
 
 The tool-pack builder asks for install scope — pick **Global** for the sandbox (admin install via scoop's `--global`) or **Per-user** if you're generating something for your everyday machine. The generated script adapts: per-user output drops the `#Requires -RunAsAdministrator` line and the `--global` flag, so the same builder works for both RedSand and standalone use.
 
+### Using your own tools (`Tools/`)
+
+Every profile maps `Tools/` read-only into the sandbox at `C:\users\WDAGUtilityAccount\Desktop\Tools\`. Three ways to put things there:
+
+1. **Drop files directly.** Copy a portable tool's folder (e.g. an extracted `dnSpy/`) into `Tools/`. It shows up inside the sandbox immediately on next launch.
+2. **Junction to an existing host install.** If a tool already lives somewhere on your host (e.g. `C:\Program Files\IDA Free 9.0`), create a directory junction without copying anything:
+   ```cmd
+   mklink /J Tools\IDA "C:\Program Files\IDA Free 9.0"
+   ```
+   `/J` doesn't require admin (unlike `/D` symlinks). The sandbox sees `Desktop\Tools\IDA\` mapped to that host directory — read-only, so the sandbox can't mutate your install.
+3. **Map an arbitrary host path directly in a wsb.** When a tool lives somewhere awkward (different drive, path with spaces, etc.) and you don't want a junction, add a `MappedFolder` to your profile's `.wsb` with an explicit `<SandboxFolder>` destination:
+   ```xml
+   <MappedFolder>
+     <HostFolder>D:\Reverse Engineering\Binary Ninja</HostFolder>  <!-- where it lives on YOUR machine -->
+     <SandboxFolder>C:\BinaryNinja</SandboxFolder>                 <!-- where it appears INSIDE the sandbox -->
+     <ReadOnly>true</ReadOnly>
+   </MappedFolder>
+   ```
+   `<HostFolder>` is the source on the host; `<SandboxFolder>` is the *destination* inside the VM. Omit `<SandboxFolder>` and the mapping defaults to `C:\users\WDAGUtilityAccount\Desktop\<basename>\` — fine for most folders, but `<SandboxFolder>` is useful when (a) you want a clean path like `C:\BinaryNinja\` that scripts inside the sandbox can reference, (b) two host folders share a basename and would collide on the default Desktop scheme, or (c) the host folder name contains spaces and you'd rather not navigate `Desktop\Binary Ninja\` in PowerShell.
+
+   **Don't want to hand-edit XML?** `build-wsb.ps1` handles this interactively. When you say yes to "Add another mapped folder?" it prompts for:
+   ```
+     Host path (any: ..\Input\, or absolute like D:\Tools\Binja): D:\Reverse Engineering\Binary Ninja
+     Read-only? [Y/n]: y
+     Map to a specific path inside the sandbox (defaults to Desktop\<folder name>)? [y/N]: y
+       Sandbox path (e.g. C:\BinaryNinja): C:\BinaryNinja
+   ```
+   The generated wsb gets a `MappedFolder` block with both `<HostFolder>` and `<SandboxFolder>` set. The summary screen shows custom destinations as `host -> sandbox` so you can verify before writing.
+
+`Tools/` itself is gitignored, so anything you put there stays local to your machine.
+
 ## Security notes
 
 A few things worth knowing before you drop sensitive material into the sandbox:

Tools/.gitkeep

@@ -92,15 +92,20 @@ Write-Host ""
 Write-Host "--- Mapped folders (paths are relative to the .wsb's location) ---" -ForegroundColor Cyan
 
 if (Read-YesNo -Prompt 'Add standard RedSand mappings (..\Utils\ read-only, ..\Files\ read-write)?' -Default $true) {
-    $mappedFolders += @{ Host = '..\Utils\'; ReadOnly = $true }
-    $mappedFolders += @{ Host = '..\Files\'; ReadOnly = $false }
+    $mappedFolders += @{ Host = '..\Utils\'; ReadOnly = $true;  Sandbox = $null }
+    $mappedFolders += @{ Host = '..\Files\'; ReadOnly = $false; Sandbox = $null }
 }
 
 while (Read-YesNo -Prompt 'Add another mapped folder?' -Default $false) {
-    $hostPath = Read-Host '  Host path (e.g. ..\Input\)'
+    $hostPath = Read-Host '  Host path (any: ..\Input\, or absolute like D:\Tools\Binja)'
     if ([string]::IsNullOrWhiteSpace($hostPath)) { continue }
     $ro = Read-YesNo -Prompt '  Read-only?' -Default $true
-    $mappedFolders += @{ Host = $hostPath; ReadOnly = $ro }
+    $sandboxPath = $null
+    if (Read-YesNo -Prompt '  Map to a specific path inside the sandbox (defaults to Desktop\<folder name>)?' -Default $false) {
+        $sandboxPath = Read-Host '    Sandbox path (e.g. C:\BinaryNinja)'
+        if ([string]::IsNullOrWhiteSpace($sandboxPath)) { $sandboxPath = $null }
+    }
+    $mappedFolders += @{ Host = $hostPath; ReadOnly = $ro; Sandbox = $sandboxPath }
 }
 
 # Logon command - three-way
@@ -134,7 +139,8 @@ if ($mappedFolders.Count -gt 0) {
     Write-Host "Mapped folders:"
     foreach ($mf in $mappedFolders) {
         $mode = if ($mf.ReadOnly) { 'read-only' } else { 'read-write' }
-        Write-Host ("  - {0} ({1})" -f $mf.Host, $mode)
+        $dest = if ($mf.Sandbox) { " -> $($mf.Sandbox)" } else { '' }
+        Write-Host ("  - {0}{1} ({2})" -f $mf.Host, $dest, $mode)
     }
 }
 Write-Host "LogonCommand:         $logonChoice"
@@ -164,6 +170,9 @@ if ($mappedFolders.Count -gt 0) {
     foreach ($mf in $mappedFolders) {
         $lines += '   <MappedFolder>'
         $lines += "     <HostFolder>$(Escape-Xml $mf.Host)</HostFolder>"
+        if ($mf.Sandbox) {
+            $lines += "     <SandboxFolder>$(Escape-Xml $mf.Sandbox)</SandboxFolder>"
+        }
         $lines += "     <ReadOnly>$($mf.ReadOnly.ToString().ToLower())</ReadOnly>"
         $lines += '   </MappedFolder>'
     }

Utils/Scripts/AdditionalScripts/OnHost/build-wsb.ps1

@@ -32,6 +32,11 @@
      <HostFolder>..\Output\</HostFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
+   <!-- Bring-your-own tools: drop binaries in ..\Tools\ or junction to existing host installs. See README. -->
+   <MappedFolder>
+     <HostFolder>..\Tools\</HostFolder>
+     <ReadOnly>true</ReadOnly>
+   </MappedFolder>
 </MappedFolders>
 <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:\users\WDAGUtilityAccount\Desktop\Utils\Scripts\DefaultScripts\setup.ps1</Command>

profiles/RedSand-Analysis.wsb

@@ -31,6 +31,11 @@
      <HostFolder>..\Output\</HostFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
+   <!-- Bring-your-own tools: drop binaries in ..\Tools\ or junction to existing host installs. See README. -->
+   <MappedFolder>
+     <HostFolder>..\Tools\</HostFolder>
+     <ReadOnly>true</ReadOnly>
+   </MappedFolder>
 </MappedFolders>
 <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:\users\WDAGUtilityAccount\Desktop\Utils\Scripts\DefaultScripts\setup.ps1</Command>

profiles/RedSand-Forensics.wsb

@@ -15,6 +15,11 @@
      <HostFolder>..\Files\</HostFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
+   <!-- Bring-your-own tools: drop binaries in ..\Tools\ or junction to existing host installs. See README. -->
+   <MappedFolder>
+     <HostFolder>..\Tools\</HostFolder>
+     <ReadOnly>true</ReadOnly>
+   </MappedFolder>
 </MappedFolders>
 <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:\users\WDAGUtilityAccount\Desktop\Utils\Scripts\DefaultScripts\setup.ps1</Command>