1
2
3
4
5 import os
6 import shutil
7
8 from lib.common.abstracts import Package
9
11 """DLL analysis package."""
12 PATHS = [
13 ("SystemRoot", "system32", "rundll32.exe"),
14 ]
15
17 rundll32 = self.get_path("rundll32.exe")
18 function = self.options.get("function", "DllMain")
19 arguments = self.options.get("arguments")
20 loader_name = self.options.get("loader")
21
22
23 ext = os.path.splitext(path)[-1].lower()
24
25
26
27 if ext != ".dll":
28 new_path = path + ".dll"
29 os.rename(path, new_path)
30 path = new_path
31
32 args = "{0},{1}".format(path, function)
33 if arguments:
34 args += " {0}".format(arguments)
35
36 if loader_name:
37 loader = os.path.join(os.path.dirname(rundll32), loader_name)
38 shutil.copy(rundll32, loader)
39 rundll32 = loader
40
41 return self.execute(rundll32, args)
42