1
2
3
4
5 import os
6
7 from lib.api.process import Process
8 from lib.common.exceptions import CuckooPackageError
9
11 """Base abstract analysis package."""
12 PATHS = []
13
15 """@param options: options dict."""
16 self.options = options
17 self.pids = []
18
20 """Update list of monitored PIDs in the package context.
21 @param pids: list of pids.
22 """
23 self.pids = pids
24
26 """Run analysis package.
27 @raise NotImplementedError: this method is abstract.
28 """
29 raise NotImplementedError
30
32 """Check."""
33 return True
34
36 """Enumerate available paths."""
37 for path in self.PATHS:
38 basedir = path[0]
39 if basedir == "SystemRoot":
40 yield os.path.join(os.getenv("SystemRoot"), *path[1:])
41 elif basedir == "ProgramFiles":
42 yield os.path.join(os.getenv("ProgramFiles"), *path[1:])
43 if os.getenv("ProgramFiles(x86)"):
44 yield os.path.join(os.getenv("ProgramFiles(x86)"),
45 *path[1:])
46 elif basedir == "HomeDrive":
47
48
49 homedrive = os.getenv("HomeDrive") + "\\"
50 yield os.path.join(homedrive, *path[1:])
51 else:
52 yield os.path.join(*path)
53
55 """Search for an application in all available paths.
56 @param applicaiton: application executable name
57 @return: executable path
58 """
59 for path in self._enum_paths():
60 if os.path.exists(path):
61 return path
62
63 raise CuckooPackageError("Unable to find any %s executable." %
64 application)
65
67 """Starts an executable for analysis.
68 @param path: executable path
69 @param args: executable arguments
70 @return: process pid
71 """
72 dll = self.options.get("dll")
73 free = self.options.get("free")
74 suspended = True
75 if free:
76 suspended = False
77
78 p = Process()
79 if not p.execute(path=path, args=args, suspended=suspended):
80 raise CuckooPackageError("Unable to execute the initial process, "
81 "analysis aborted.")
82
83 if not free and suspended:
84 p.inject(dll)
85 p.resume()
86 p.wait()
87 p.close()
88
89 return p.pid
90
92 """A list of files to upload to host.
93 The list should be a list of tuples (<path on guest>, <name of file in package_files folder>).
94 (package_files is a folder that will be created in analysis folder).
95 """
96 return None
97
99 """Finish run.
100 If specified to do so, this method dumps the memory of
101 all running processes.
102 """
103 if self.options.get("procmemdump"):
104 for pid in self.pids:
105 p = Process(pid=pid)
106 p.dump_memory()
107
108 return True
109
112