Package modules :: Package packages :: Module dll
[hide private]
[frames] | no frames]

Source Code for Module modules.packages.dll

 1  # Copyright (C) 2010-2015 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os 
 6  import shutil 
 7   
 8  from lib.common.abstracts import Package 
 9   
10 -class Dll(Package):
11 """DLL analysis package.""" 12 PATHS = [ 13 ("SystemRoot", "system32", "rundll32.exe"), 14 ] 15
16 - def start(self, path):
17 rundll32 = self.get_path("rundll32.exe") 18 function = self.options.get("function", "DllMain") 19 arguments = self.options.get("arguments") 20 loader_name = self.options.get("loader") 21 22 # Check file extension. 23 ext = os.path.splitext(path)[-1].lower() 24 # If the file doesn't have the proper .dll extension force it 25 # and rename it. This is needed for rundll32 to execute correctly. 26 # See ticket #354 for details. 27 if ext != ".dll": 28 new_path = path + ".dll" 29 os.rename(path, new_path) 30 path = new_path 31 32 args = "{0},{1}".format(path, function) 33 if arguments: 34 args += " {0}".format(arguments) 35 36 if loader_name: 37 loader = os.path.join(os.path.dirname(rundll32), loader_name) 38 shutil.copy(rundll32, loader) 39 rundll32 = loader 40 41 return self.execute(rundll32, args)
42