Package lib :: Package cuckoo :: Package common :: Module logtbl
[hide private]
[frames] | no frames]

Source Code for Module lib.cuckoo.common.logtbl

  1  # Copyright (C) 2010-2014 Cuckoo Foundation. 
  2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
  3  # See the file 'docs/LICENSE' for copying permission. 
  4   
  5  """Table for all hook logging statements. 
  6   
  7  This table is not automatically generated at the moment, but kept up-to-date 
  8  by hand. 
  9   
 10  """ 
 11  table = [ 
 12      ("__process__", "__init__", ("",)), 
 13      ("__thread__", "__init__", ("",)), 
 14      ("NtDeleteFile", "filesystem", ("O", "FileName")), 
 15      ("CreateDirectoryW", "filesystem", ("u", "DirectoryName")), 
 16      ("CreateDirectoryExW", "filesystem", ("u", "DirectoryName")), 
 17      ("RemoveDirectoryA", "filesystem", ("s", "DirectoryName")), 
 18      ("RemoveDirectoryW", "filesystem", ("u", "DirectoryName")), 
 19      ("FindFirstFileExA", "filesystem", ("s", "FileName")), 
 20      ("FindFirstFileExW", "filesystem", ("u", "FileName")), 
 21      ("DeleteFileA", "filesystem", ("s", "FileName")), 
 22      ("DeleteFileW", "filesystem", ("u", "FileName")), 
 23      ("UnhookWindowsHookEx", "hooking", ("p", "HookHandle")), 
 24      ("LdrGetDllHandle", "system", ("oP", "FileName", "ModuleHandle")), 
 25      ("ExitWindowsEx", "system", ("ll", "Flags", "Reason")), 
 26      ("IsDebuggerPresent", "system", ("",)), 
 27      ("LookupPrivilegeValueW", "system", ("uu", "SystemName", "PrivilegeName")), 
 28      ("NtClose", "system", ("p", "Handle")), 
 29      ("URLDownloadToFileW", "network", ("uu", "URL", "FileName")), 
 30      ("InternetReadFile", "network", ("pB", "InternetHandle", "Buffer")), 
 31      ("InternetWriteFile", "network", ("pB", "InternetHandle", "Buffer")), 
 32      ("InternetCloseHandle", "network", ("p", "InternetHandle")), 
 33      ("DnsQuery_A", "network", ("sil", "Name", "Type", "Options")), 
 34      ("DnsQuery_UTF8", "network", ("sil", "Name", "Type", "Options")), 
 35      ("DnsQuery_W", "network", ("uil", "Name", "Type", "Options")), 
 36      ("getaddrinfo", "network", ("ss", "NodeName", "ServiceName")), 
 37      ("GetAddrInfoW", "network", ("uu", "NodeName", "ServiceName")), 
 38      ("NtTerminateProcess", "process", ("pl", "ProcessHandle", "ExitCode")), 
 39      ("ExitProcess", "process", ("l", "ExitCode")), 
 40      ("system", "process", ("s", "Command")), 
 41      ("RegOpenKeyExA", "registry", ("psP", "Registry", "SubKey", "Handle")), 
 42      ("RegOpenKeyExW", "registry", ("puP", "Registry", "SubKey", "Handle")), 
 43      ("RegDeleteKeyA", "registry", ("ps", "Handle", "SubKey")), 
 44      ("RegDeleteKeyW", "registry", ("pu", "Handle", "SubKey")), 
 45      ("RegEnumKeyW", "registry", ("plu", "Handle", "Index", "Name")), 
 46      ("RegDeleteValueA", "registry", ("ps", "Handle", "ValueName")), 
 47      ("RegDeleteValueW", "registry", ("pu", "Handle", "ValueName")), 
 48      ("RegCloseKey", "registry", ("p", "Handle")), 
 49      ("NtRenameKey", "registry", ("po", "KeyHandle", "NewName")), 
 50      ("NtEnumerateKey", "registry", ("pl", "KeyHandle", "Index")), 
 51      ("NtDeleteKey", "registry", ("p", "KeyHandle")), 
 52      ("NtDeleteValueKey", "registry", ("po", "KeyHandle", "ValueName")), 
 53      ("NtLoadKey", "registry", ("OO", "TargetKey", "SourceFile")), 
 54      ("NtSaveKey", "registry", ("pp", "KeyHandle", "FileHandle")), 
 55      ("ControlService", "services", ("pl", "ServiceHandle", "ControlCode")), 
 56      ("DeleteService", "services", ("p", "ServiceHandle")), 
 57      ("NtDelayExecution", "system", ("ls", "Milliseconds", "Status")), 
 58      ("NtDelayExecution", "system", ("l", "Milliseconds")), 
 59      ("WSAStartup", "socket", ("p", "VersionRequested")), 
 60      ("gethostbyname", "socket", ("s", "Name")), 
 61      ("socket", "socket", ("lll", "af", "type", "protocol")), 
 62      ("connect", "socket", ("p", "socket")), 
 63      ("send", "socket", ("pb", "socket", "buffer")), 
 64      ("sendto", "socket", ("pb", "socket", "buffer")), 
 65      ("recv", "socket", ("pb", "socket", "buffer")), 
 66      ("recvfrom", "socket", ("pb", "socket", "buffer")), 
 67      ("accept", "socket", ("pp", "socket", "ClientSocket")), 
 68      ("bind", "socket", ("psl", "socket", "ip", "port")), 
 69      ("bind", "socket", ("p", "socket")), 
 70      ("setsockopt", "socket", ("pllb", "socket", "level", "optname", "optval")), 
 71      ("listen", "socket", ("p", "socket")), 
 72      ("select", "socket", ("p", "socket")), 
 73      ("ioctlsocket", "socket", ("pl", "socket", "command")), 
 74      ("closesocket", "socket", ("p", "socket")), 
 75      ("shutdown", "socket", ("pl", "socket", "how")), 
 76      ("WSARecv", "socket", ("p", "socket")), 
 77      ("WSARecvFrom", "socket", ("p", "socket")), 
 78      ("WSASend", "socket", ("p", "Socket")), 
 79      ("WSASendTo", "socket", ("p", "Socket")), 
 80      ("WSASocketA", "socket", ("lll", "af", "type", "protocol")), 
 81      ("WSASocketW", "socket", ("lll", "af", "type", "protocol")), 
 82      ("ConnectEx", "socket", ("pB", "socket", "SendBuffer")), 
 83      ("NtOpenMutant", "synchronization", ("PO", "Handle", "MutexName")), 
 84      ("NtGetContextThread", "threading", ("p", "ThreadHandle")), 
 85      ("NtSetContextThread", "threading", ("p", "ThreadHandle")), 
 86      ("NtResumeThread", "threading", ("pL", "ThreadHandle", "SuspendCount")), 
 87      ("NtTerminateThread", "threading", ("pl", "ThreadHandle", "ExitStatus")), 
 88      ("ExitThread", "threading", ("l", "ExitCode")), 
 89      ("FindWindowA", "windows", ("ss", "ClassName", "WindowName")), 
 90      ("FindWindowW", "windows", ("uu", "ClassName", "WindowName")), 
 91      ("FindWindowExA", "windows", ("ls", "ClassName", "WindowName")), 
 92      ("FindWindowExA", "windows", ("ss", "ClassName", "WindowName")), 
 93      ("FindWindowExW", "windows", ("lu", "ClassName", "WindowName")), 
 94      ("FindWindowExW", "windows", ("uu", "ClassName", "WindowName")), 
 95      ("NtCreateFile", "filesystem", ("PpOll", "FileHandle", "DesiredAccess", "FileName", "CreateDisposition", "ShareAccess")), 
 96      ("NtOpenFile", "filesystem", ("PpOl", "FileHandle", "DesiredAccess", "FileName", "ShareAccess")), 
 97      ("NtReadFile", "filesystem", ("pb", "FileHandle", "Buffer")), 
 98      ("NtWriteFile", "filesystem", ("pb", "FileHandle", "Buffer")), 
 99      ("NtDeviceIoControlFile", "filesystem", ("pbb", "FileHandle", "InputBuffer", "OutputBuffer")), 
100      ("NtQueryDirectoryFile", "filesystem", ("pbo", "FileHandle", "FileInformation", "FileName")), 
101      ("NtQueryInformationFile", "filesystem", ("pb", "FileHandle", "FileInformation")), 
102      ("NtSetInformationFile", "filesystem", ("pb", "FileHandle", "FileInformation")), 
103      ("NtOpenDirectoryObject", "filesystem", ("PlO", "DirectoryHandle", "DesiredAccess", "ObjectAttributes")), 
104      ("NtCreateDirectoryObject", "filesystem", ("PlO", "DirectoryHandle", "DesiredAccess", "ObjectAttributes")), 
105      ("MoveFileWithProgressW", "filesystem", ("uu", "ExistingFileName", "NewFileName")), 
106      ("CopyFileA", "filesystem", ("ss", "ExistingFileName", "NewFileName")), 
107      ("CopyFileW", "filesystem", ("uu", "ExistingFileName", "NewFileName")), 
108      ("CopyFileExW", "filesystem", ("uul", "ExistingFileName", "NewFileName", "CopyFlags")), 
109      ("SetWindowsHookExA", "system", ("lppl", "HookIdentifier", "ProcedureAddress", "ModuleAddress", "ThreadId")), 
110      ("SetWindowsHookExW", "system", ("lppl", "HookIdentifier", "ProcedureAddress", "ModuleAddress", "ThreadId")), 
111      ("LdrLoadDll", "system", ("loP", "Flags", "FileName", "BaseAddress")), 
112      ("LdrGetProcedureAddress", "system", ("pSlP", "ModuleHandle", "FunctionName", "Ordinal", "FunctionAddress")), 
113      ("DeviceIoControl", "device", ("plbb", "DeviceHandle", "IoControlCode", "InBuffer", "OutBuffer")), 
114      ("WriteConsoleA", "system", ("pS", "ConsoleHandle", "Buffer")), 
115      ("WriteConsoleW", "system", ("pU", "ConsoleHandle", "Buffer")), 
116      ("InternetOpenA", "network", ("spssp", "Agent", "AccessType", "ProxyName", "ProxyBypass", "Flags")), 
117      ("InternetOpenW", "network", ("upuup", "Agent", "AccessType", "ProxyName", "ProxyBypass", "Flags")), 
118      ("InternetConnectA", "network", ("pslsslp", "InternetHandle", "ServerName", "ServerPort", "Username", "Password", "Service", "Flags")), 
119      ("InternetConnectW", "network", ("puluulp", "InternetHandle", "ServerName", "ServerPort", "Username", "Password", "Service", "Flags")), 
120      ("InternetOpenUrlA", "network", ("psSp", "ConnectionHandle", "URL", "Headers", "Flags")), 
121      ("InternetOpenUrlW", "network", ("puUp", "ConnectionHandle", "URL", "Headers", "Flags")), 
122      ("HttpOpenRequestA", "network", ("psl", "InternetHandle", "Path", "Flags")), 
123      ("HttpOpenRequestW", "network", ("pul", "InternetHandle", "Path", "Flags")), 
124      ("HttpSendRequestA", "network", ("pSb", "RequestHandle", "Headers", "PostData")), 
125      ("HttpSendRequestW", "network", ("pUb", "RequestHandle", "Headers", "PostData")), 
126      ("NtCreateProcess", "process", ("PpO", "ProcessHandle", "DesiredAccess", "FileName")), 
127      ("NtCreateProcessEx", "process", ("PpO", "ProcessHandle", "DesiredAccess", "FileName")), 
128      ("NtCreateUserProcess", "process", ("PPppOOoo", "ProcessHandle", "ThreadHandle", "ProcessDesiredAccess", "ThreadDesiredAccess", "ProcessFileName", "ThreadName", "ImagePathName", "CommandLine")), 
129      ("NtOpenProcess", "process", ("ppp", "ProcessHandle", "DesiredAccess", "ProcessIdentifier")), 
130      ("NtOpenProcess", "process", ("PpP", "ProcessHandle", "DesiredAccess", "ProcessIdentifier")), 
131      ("NtCreateSection", "process", ("PpOp", "SectionHandle", "DesiredAccess", "ObjectAttributes", "FileHandle")), 
132      ("NtOpenSection", "process", ("PpO", "SectionHandle", "DesiredAccess", "ObjectAttributes")), 
133      ("CreateProcessInternalW", "process", ("uupllpp", "ApplicationName", "CommandLine", "CreationFlags", "ProcessId", "ThreadId", "ProcessHandle", "ThreadHandle")), 
134      ("ShellExecuteExW", "process", ("2ul", "FilePath", "Parameters", "Show")), 
135      ("NtAllocateVirtualMemory", "process", ("pPPp", "ProcessHandle", "BaseAddress", "RegionSize", "Protection")), 
136      ("NtReadVirtualMemory", "process", ("2pB", "ProcessHandle", "BaseAddress", "Buffer")), 
137      ("ReadProcessMemory", "process", ("ppB", "ProcessHandle", "BaseAddress", "Buffer")), 
138      ("NtWriteVirtualMemory", "process", ("2pB", "ProcessHandle", "BaseAddress", "Buffer")), 
139      ("WriteProcessMemory", "process", ("ppB", "ProcessHandle", "BaseAddress", "Buffer")), 
140      ("NtProtectVirtualMemory", "process", ("pPPpP", "ProcessHandle", "BaseAddress", "NumberOfBytesProtected", "NewAccessProtection", "OldAccessProtection")), 
141      ("VirtualProtectEx", "process", ("pppp", "ProcessHandle", "Address", "Size", "Protection")), 
142      ("NtFreeVirtualMemory", "process", ("pPPp", "ProcessHandle", "BaseAddress", "RegionSize", "FreeType")), 
143      ("VirtualFreeEx", "process", ("pppl", "ProcessHandle", "Address", "Size", "FreeType")), 
144      ("RegCreateKeyExA", "registry", ("psslP", "Registry", "SubKey", "Class", "Access", "Handle")), 
145      ("RegCreateKeyExW", "registry", ("puulP", "Registry", "SubKey", "Class", "Access", "Handle")), 
146      ("RegEnumKeyExA", "registry", ("plss", "Handle", "Index", "Name", "Class")), 
147      ("RegEnumKeyExW", "registry", ("pluu", "Handle", "Index", "Name", "Class")), 
148      ("RegEnumValueA", "registry", ("plsr", "Handle", "Index", "ValueName", "Data")), 
149      ("RegEnumValueA", "registry", ("plsLL", "Handle", "Index", "ValueName", "Type", "DataLength")), 
150      ("RegEnumValueW", "registry", ("pluR", "Handle", "Index", "ValueName", "Data")), 
151      ("RegEnumValueW", "registry", ("pluLL", "Handle", "Index", "ValueName", "Type", "DataLength")), 
152      ("RegSetValueExA", "registry", ("pslr", "Handle", "ValueName", "Type", "Buffer")), 
153      ("RegSetValueExA", "registry", ("psl", "Handle", "ValueName", "Type")), 
154      ("RegSetValueExW", "registry", ("pulR", "Handle", "ValueName", "Type", "Buffer")), 
155      ("RegSetValueExW", "registry", ("pul", "Handle", "ValueName", "Type")), 
156      ("RegQueryValueExA", "registry", ("psr", "Handle", "ValueName", "Data")), 
157      ("RegQueryValueExA", "registry", ("psLL", "Handle", "ValueName", "Type", "DataLength")), 
158      ("RegQueryValueExW", "registry", ("puR", "Handle", "ValueName", "Data")), 
159      ("RegQueryValueExW", "registry", ("puLL", "Handle", "ValueName", "Type", "DataLength")), 
160      ("RegQueryInfoKeyA", "registry", ("pS6L", "KeyHandle", "Class", "SubKeyCount", "MaxSubKeyLength", "MaxClassLength", "ValueCount", "MaxValueNameLength", "MaxValueLength")), 
161      ("RegQueryInfoKeyW", "registry", ("pU6L", "KeyHandle", "Class", "SubKeyCount", "MaxSubKeyLength", "MaxClassLength", "ValueCount", "MaxValueNameLength", "MaxValueLength")), 
162      ("NtCreateKey", "registry", ("PlOo", "KeyHandle", "DesiredAccess", "ObjectAttributes", "Class")), 
163      ("NtOpenKey", "registry", ("PlO", "KeyHandle", "DesiredAccess", "ObjectAttributes")), 
164      ("NtOpenKeyEx", "registry", ("PlO", "KeyHandle", "DesiredAccess", "ObjectAttributes")), 
165      ("NtReplaceKey", "registry", ("pOO", "KeyHandle", "NewHiveFileName", "BackupHiveFileName")), 
166      ("NtEnumerateValueKey", "registry", ("pll", "KeyHandle", "Index", "KeyValueInformationClass")), 
167      ("NtSetValueKey", "registry", ("polR", "KeyHandle", "ValueName", "Type", "Buffer")), 
168      ("NtSetValueKey", "registry", ("pol", "KeyHandle", "ValueName", "Type")), 
169      ("NtQueryValueKey", "registry", ("polR", "KeyHandle", "ValueName", "Type", "Information")), 
170      ("NtQueryValueKey", "registry", ("po", "KeyHandle", "ValueName")), 
171      ("NtQueryMultipleValueKey", "registry", ("poS", "KeyHandle", "ValueName", "ValueBuffer")), 
172      ("NtLoadKey2", "registry", ("OOl", "TargetKey", "SourceFile", "Flags")), 
173      ("NtLoadKeyEx", "registry", ("pOOl", "TrustClassKey", "TargetKey", "SourceFile", "Flags")), 
174      ("NtQueryKey", "registry", ("pSl", "KeyHandle", "KeyInformation", "KeyInformationClass")), 
175      ("NtSaveKeyEx", "registry", ("ppl", "KeyHandle", "FileHandle", "Format")), 
176      ("OpenSCManagerA", "services", ("ssl", "MachineName", "DatabaseName", "DesiredAccess")), 
177      ("OpenSCManagerW", "services", ("uul", "MachineName", "DatabaseName", "DesiredAccess")), 
178      ("CreateServiceA", "services", ("pss4l3s", "ServiceControlHandle", "ServiceName", "DisplayName", "DesiredAccess", "ServiceType", "StartType", "ErrorControl", "BinaryPathName", "ServiceStartName", "Password")), 
179      ("CreateServiceW", "services", ("puu4l3u", "ServiceControlHandle", "ServiceName", "DisplayName", "DesiredAccess", "ServiceType", "StartType", "ErrorControl", "BinaryPathName", "ServiceStartName", "Password")), 
180      ("OpenServiceA", "services", ("psl", "ServiceControlManager", "ServiceName", "DesiredAccess")), 
181      ("OpenServiceW", "services", ("pul", "ServiceControlManager", "ServiceName", "DesiredAccess")), 
182      ("StartServiceA", "services", ("pa", "ServiceHandle", "Arguments")), 
183      ("StartServiceW", "services", ("pA", "ServiceHandle", "Arguments")), 
184      ("TransmitFile", "socket", ("ppll", "socket", "FileHandle", "NumberOfBytesToWrite", "NumberOfBytesPerSend")), 
185      ("NtCreateMutant", "synchronization", ("POl", "Handle", "MutexName", "InitialOwner")), 
186      ("NtCreateNamedPipeFile", "synchronization", ("PpOl", "NamedPipeHandle", "DesiredAccess", "PipeName", "ShareAccess")), 
187      ("NtCreateThread", "threading", ("PpO", "ThreadHandle", "ProcessHandle", "ObjectAttributes")), 
188      ("NtOpenThread", "threading", ("PlO", "ThreadHandle", "DesiredAccess", "ObjectAttributes")), 
189      ("NtSuspendThread", "threading", ("pL", "ThreadHandle", "SuspendCount")), 
190      ("CreateThread", "threading", ("pplL", "StartRoutine", "Parameter", "CreationFlags", "ThreadId")), 
191      ("CreateRemoteThread", "threading", ("3plL", "ProcessHandle", "StartRoutine", "Parameter", "CreationFlags", "ThreadId")), 
192      ("RtlCreateUserThread", "threading", ("plppPl", "ProcessHandle", "CreateSuspended", "StartAddress", "StartParameter", "ThreadHandle", "ThreadIdentifier")), 
193      ("ZwMapViewOfSection", "process", ("ppPp", "SectionHandle", "ProcessHandle", "BaseAddress", "SectionOffset")), 
194      ("GetSystemMetrics", "misc", ("l", "SystemMetricIndex")), 
195      ("GetCursorPos", "misc", ("ll", "x", "y")), 
196  ] 
197