Package lib :: Package api :: Module process :: Class Process
[hide private]
[frames] | no frames]

Class Process

source code

Windows process.

Instance Methods [hide private]
 
__init__(self, pid=0, h_process=0, thread_id=0, h_thread=0) source code
 
__del__(self)
Close open handles.
source code
 
get_system_info(self)
Get system information.
source code
 
open(self)
Open a process and/or thread.
source code
 
close(self)
Close any open handles.
source code
 
exit_code(self)
Get process exit code.
source code
 
get_filepath(self)
Get process image file path.
source code
 
is_alive(self)
Process is alive?
source code
 
get_parent_pid(self)
Get the Parent Process ID.
source code
 
execute(self, path, args=None, suspended=False)
Execute sample process.
source code
 
resume(self)
Resume a suspended thread.
source code
 
terminate(self)
Terminate process.
source code
 
inject(self, dll=None, apc=False)
Cuckoo DLL injection.
source code
 
wait(self) source code
 
dump_memory(self)
Dump process memory.
source code
Class Variables [hide private]
  first_process = True
Method Details [hide private]

__init__(self, pid=0, h_process=0, thread_id=0, h_thread=0)
(Constructor)

source code 
Parameters:
  • pid - PID.
  • h_process - process handle.
  • thread_id - thread id.
  • h_thread - thread handle.

open(self)

source code 

Open a process and/or thread.

Returns:
operation status.

close(self)

source code 

Close any open handles.

Returns:
operation status.

exit_code(self)

source code 

Get process exit code.

Returns:
exit code value.

get_filepath(self)

source code 

Get process image file path.

Returns:
decoded file path.

is_alive(self)

source code 

Process is alive?

Returns:
process status.

execute(self, path, args=None, suspended=False)

source code 

Execute sample process.

Parameters:
  • path - sample path.
  • args - process args.
  • suspended - is suspended.
Returns:
operation status.

resume(self)

source code 

Resume a suspended thread.

Returns:
operation status.

terminate(self)

source code 

Terminate process.

Returns:
operation status.

inject(self, dll=None, apc=False)

source code 

Cuckoo DLL injection.

Parameters:
  • dll - Cuckoo DLL path.
  • apc - APC use.

dump_memory(self)

source code 

Dump process memory.

Returns:
operation status.