Package modules :: Package packages :: Module doc
[hide private]
[frames] | no frames]

Source Code for Module modules.packages.doc

 1  # Copyright (C) 2010-2014 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os 
 6   
 7  from lib.common.abstracts import Package 
 8  from lib.api.process import Process 
 9  from lib.common.exceptions import CuckooPackageError 
10   
11 -class DOC(Package):
12 """Word analysis package.""" 13
14 - def get_path(self):
15 ms_office = os.path.join(os.getenv("ProgramFiles"), "Microsoft Office") 16 paths = [ 17 os.path.join(ms_office, "WINWORD.EXE"), 18 os.path.join(ms_office, "Office11", "WINWORD.EXE"), 19 os.path.join(ms_office, "Office12", "WINWORD.EXE"), 20 os.path.join(ms_office, "Office14", "WINWORD.EXE"), 21 os.path.join(ms_office, "Office15", "WINWORD.EXE"), 22 os.path.join(ms_office, "WORDVIEW.EXE"), 23 os.path.join(ms_office, "Office11", "WORDVIEW.EXE") 24 ] 25 26 for path in paths: 27 if os.path.exists(path): 28 return path 29 30 return None
31
32 - def start(self, path):
33 word = self.get_path() 34 if not word: 35 raise CuckooPackageError("Unable to find any Microsoft " 36 "Office Word executable available") 37 38 dll = self.options.get("dll", None) 39 free = self.options.get("free", False) 40 suspended = True 41 if free: 42 suspended = False 43 44 p = Process() 45 if not p.execute(path=word, args="\"%s\"" % path, suspended=suspended): 46 raise CuckooPackageError("Unable to execute initial Microsoft " 47 "Office Word process, analysis aborted") 48 49 if not free and suspended: 50 p.inject(dll) 51 p.resume() 52 return p.pid 53 else: 54 return None
55
56 - def check(self):
57 return True
58
59 - def finish(self):
60 if self.options.get("procmemdump", False): 61 for pid in self.pids: 62 p = Process(pid=pid) 63 p.dump_memory() 64 65 return True
66