From 632c8f566b4bcc8a3aa7d558287666e3e24c2a61 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 18 Apr 2026 11:09:01 +0200
Subject: [PATCH] python3Packages.iocx: init at 0.6.0

IOC extraction engine for PE binaries and text

https://github.com/iocx-dev/iocx
---
 .../python-modules/iocx/default.nix           | 52 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 54 insertions(+)
 create mode 100644 pkgs/development/python-modules/iocx/default.nix

diff --git a/pkgs/development/python-modules/iocx/default.nix b/pkgs/development/python-modules/iocx/default.nix
new file mode 100644
index 000000000000..2f19b87cde71
--- /dev/null
+++ b/pkgs/development/python-modules/iocx/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pefile,
+  pytestCheckHook,
+  python-magic,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "iocx";
+  version = "0.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "iocx-dev";
+    repo = "iocx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WdUHqQXq/qJyqZ5O9+E777+fQaQowvftDtQ0mj67FHw=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pefile
+    python-magic
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "iocx" ];
+
+  preCheck = ''
+    export PATH="$PATH:$out/bin";
+  '';
+
+  disabledTests = [
+    # Test requires go to be available
+    "test_cli_with_real_go_binary"
+  ];
+
+  meta = {
+    description = "IOC extraction engine for PE binaries and text";
+    homepage = "https://github.com/iocx-dev/iocx";
+    changelog = "https://github.com/iocx-dev/iocx/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 19766c3d076b..e5872c423aaf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7633,6 +7633,8 @@ self: super: with self; {
 
   ioctl-opt = callPackage ../development/python-modules/ioctl-opt { };
 
+  iocx = callPackage ../development/python-modules/iocx { };
+
   iodata = callPackage ../development/python-modules/iodata { };
 
   iometer = callPackage ../development/python-modules/iometer { };