Package modules :: Package processing :: Module procmemory
[hide private]
[frames] | no frames]

Source Code for Module modules.processing.procmemory

 1  # Copyright (C) 2010-2015 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os 
 6   
 7  from lib.cuckoo.common.abstracts import Processing 
 8  from lib.cuckoo.common.objects import File 
 9  from lib.cuckoo.common.constants import CUCKOO_ROOT 
10   
11 -class ProcessMemory(Processing):
12 """Analyze process memory dumps.""" 13
14 - def run(self):
15 """Run analysis. 16 @return: structured results. 17 """ 18 self.key = "procmemory" 19 results = [] 20 21 if os.path.exists(self.pmemory_path): 22 for dmp in os.listdir(self.pmemory_path): 23 dmp_path = os.path.join(self.pmemory_path, dmp) 24 dmp_file = File(dmp_path) 25 26 proc = dict( 27 file=dmp_path, 28 pid=os.path.splitext(os.path.basename(dmp_path))[0], 29 yara=dmp_file.get_yara(os.path.join(CUCKOO_ROOT, "data", "yara", "index_memory.yar")) 30 ) 31 32 results.append(proc) 33 34 return results
35