1
2
3
4
5 import os
6
7 from lib.common.abstracts import Package
8 from lib.api.process import Process
9 from lib.common.exceptions import CuckooPackageError
10
12 """Generic analysis package."""
13
15 free = self.options.get("free", False)
16 dll = self.options.get("dll", None)
17 suspended = True
18 if free:
19 suspended = False
20
21 cmd_path = os.path.join(os.getenv("SystemRoot"), "system32", "cmd.exe")
22 cmd_args = "/c start \"{0}\"".format(path)
23
24 p = Process()
25 if not p.execute(path=cmd_path, args=cmd_args, suspended=suspended):
26 raise CuckooPackageError("Unable to execute initial process, "
27 "analysis aborted")
28
29 if not free and suspended:
30 p.inject(dll)
31 p.resume()
32 p.close()
33 return p.pid
34 else:
35 return None
36
39
41 if self.options.get("procmemdump", False):
42 for pid in self.pids:
43 p = Process(pid=pid)
44 p.dump_memory()
45
46 return True
47