Package lib :: Package common :: Module abstracts
[hide private]
[frames] | no frames]

Source Code for Module lib.common.abstracts

  1  # Copyright (C) 2010-2015 Cuckoo Foundation. 
  2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
  3  # See the file 'docs/LICENSE' for copying permission. 
  4   
  5  import os 
  6   
  7  from lib.api.process import Process 
  8  from lib.common.exceptions import CuckooPackageError 
  9   
10 -class Package(object):
11 """Base abstract analysis package.""" 12 PATHS = [] 13
14 - def __init__(self, options={}):
15 """@param options: options dict.""" 16 self.options = options 17 self.pids = []
18
19 - def set_pids(self, pids):
20 """Update list of monitored PIDs in the package context. 21 @param pids: list of pids. 22 """ 23 self.pids = pids
24
25 - def start(self):
26 """Run analysis package. 27 @raise NotImplementedError: this method is abstract. 28 """ 29 raise NotImplementedError
30
31 - def check(self):
32 """Check.""" 33 return True
34
35 - def _enum_paths(self):
36 """Enumerate available paths.""" 37 for path in self.PATHS: 38 basedir = path[0] 39 if basedir == "SystemRoot": 40 yield os.path.join(os.getenv("SystemRoot"), *path[1:]) 41 elif basedir == "ProgramFiles": 42 yield os.path.join(os.getenv("ProgramFiles"), *path[1:]) 43 if os.getenv("ProgramFiles(x86)"): 44 yield os.path.join(os.getenv("ProgramFiles(x86)"), 45 *path[1:]) 46 elif basedir == "HomeDrive": 47 # os.path.join() does not work well when giving just C: 48 # instead of C:\\, so we manually add the backslash. 49 homedrive = os.getenv("HomeDrive") + "\\" 50 yield os.path.join(homedrive, *path[1:]) 51 else: 52 yield os.path.join(*path)
53
54 - def get_path(self, application):
55 """Search for an application in all available paths. 56 @param applicaiton: application executable name 57 @return: executable path 58 """ 59 for path in self._enum_paths(): 60 if os.path.exists(path): 61 return path 62 63 raise CuckooPackageError("Unable to find any %s executable." % 64 application)
65
66 - def execute(self, path, args):
67 """Starts an executable for analysis. 68 @param path: executable path 69 @param args: executable arguments 70 @return: process pid 71 """ 72 dll = self.options.get("dll") 73 free = self.options.get("free") 74 suspended = True 75 if free: 76 suspended = False 77 78 p = Process() 79 if not p.execute(path=path, args=args, suspended=suspended): 80 raise CuckooPackageError("Unable to execute the initial process, " 81 "analysis aborted.") 82 83 if not free and suspended: 84 p.inject(dll) 85 p.resume() 86 p.wait() 87 p.close() 88 89 return p.pid
90
91 - def package_files(self):
92 """A list of files to upload to host. 93 The list should be a list of tuples (<path on guest>, <name of file in package_files folder>). 94 (package_files is a folder that will be created in analysis folder). 95 """ 96 return None
97
98 - def finish(self):
99 """Finish run. 100 If specified to do so, this method dumps the memory of 101 all running processes. 102 """ 103 if self.options.get("procmemdump"): 104 for pid in self.pids: 105 p = Process(pid=pid) 106 p.dump_memory() 107 108 return True
109
110 -class Auxiliary(object):
111 pass
112