Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- # Copyright (C) 2010-2014 Cuckoo Foundation.
- # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
- # See the file 'docs/LICENSE' for copying permission.
- from lib.common.abstracts import Package
- from lib.api.process import Process
- from lib.common.exceptions import CuckooPackageError
- class Exe(Package):
- """EXE analysis package."""
- def start(self, path):
- free = self.options.get("free", False)
- args = self.options.get("arguments", None)
- dll = self.options.get("dll", None)
- suspended = True
- if free:
- suspended = False
- p = Process()
- if not p.execute(path=path, args=args, suspended=suspended):
- raise CuckooPackageError("Unable to execute initial process, "
- "analysis aborted")
- if not free and suspended:
- p.inject(dll)
- p.resume()
- p.close()
- return p.pid
- else:
- return None
- def check(self):
- return True
- def finish(self):
- if self.options.get("procmemdump", False):
- for pid in self.pids:
- p = Process(pid=pid)
- p.dump_memory()
- return True
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement