Package modules :: Package processing :: Module procmemory :: Class ProcessMemory
[hide private]
[frames] | no frames]

Class ProcessMemory

source code

                            object --+    
                                     |    
lib.cuckoo.common.abstracts.Processing --+
                                         |
                                        ProcessMemory

Analyze process memory dumps.

Instance Methods [hide private]
 
read_dump(self, filepath) source code
 
create_idapy(self, process) source code
 
_fixup_pe_header(self, pe)
Fixes the PE header from an in-memory representation to an on-disk representation.
source code
 
dump_images(self, process, drop_dlls=False)
Dump executable images from this process memory dump.
source code
 
run(self)
Run analysis.
source code

Inherited from lib.cuckoo.common.abstracts.Processing: __init__, set_baseline, set_options, set_path, set_results, set_task

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]

Inherited from lib.cuckoo.common.abstracts.Processing: enabled, order

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

run(self)

source code 

Run analysis.

Returns:
structured results.
Raises:
  • NotImplementedError - this method is abstract.
Overrides: lib.cuckoo.common.abstracts.Processing.run