Package modules :: Package packages :: Module dll
[hide private]
[frames] | no frames]

Source Code for Module modules.packages.dll

 1  # Copyright (C) 2010-2013 Claudio Guarnieri. 
 2  # Copyright (C) 2014-2016 Cuckoo Foundation. 
 3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 4  # See the file 'docs/LICENSE' for copying permission. 
 5   
 6  import os 
 7  import shlex 
 8  import shutil 
 9   
10  from lib.common.abstracts import Package 
11   
12 -class Dll(Package):
13 """DLL analysis package.""" 14 PATHS = [ 15 ("System32", "rundll32.exe"), 16 ] 17
18 - def start(self, path):
19 rundll32 = self.get_path("rundll32.exe") 20 function = self.options.get("function", "DllMain") 21 arguments = self.options.get("arguments", "") 22 loader_name = self.options.get("loader") 23 24 # Check file extension. 25 ext = os.path.splitext(path)[-1].lower() 26 27 # If the file doesn't have the proper .dll extension force it 28 # and rename it. This is needed for rundll32 to execute correctly. 29 # See ticket #354 for details. 30 if ext != ".dll": 31 new_path = path + ".dll" 32 os.rename(path, new_path) 33 path = new_path 34 35 args = ["%s,%s" % (path, function)] 36 if arguments: 37 args += shlex.split(arguments) 38 39 if loader_name: 40 loader = os.path.join(os.path.dirname(rundll32), loader_name) 41 shutil.copy(rundll32, loader) 42 rundll32 = loader 43 44 return self.execute(rundll32, args=args)
45