Package modules :: Package packages :: Module vbs
[hide private]
[frames] | no frames]

Source Code for Module modules.packages.vbs

 1  # Copyright (C) 2010-2014 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os 
 6   
 7  from lib.common.abstracts import Package 
 8  from lib.api.process import Process 
 9  from lib.common.exceptions import CuckooPackageError 
10   
11  # Originally proposed by kidrek: 
12  # https://github.com/cuckoobox/cuckoo/pull/136 
13   
14 -class VBS(Package):
15 """VBS analysis package.""" 16
17 - def get_path(self):
18 paths = [ 19 os.path.join(os.getenv("SystemRoot"), "system32", "wscript.exe") 20 ] 21 22 for path in paths: 23 if os.path.exists(path): 24 return path 25 26 return None
27
28 - def start(self, path):
29 wscript = self.get_path() 30 if not wscript: 31 raise CuckooPackageError("Unable to find any WScript " 32 "executable available") 33 34 dll = self.options.get("dll", None) 35 free = self.options.get("free", False) 36 suspended = True 37 if free: 38 suspended = False 39 40 p = Process() 41 if not p.execute(path=wscript, args="\"{0}\"".format(path), suspended=suspended): 42 raise CuckooPackageError("Unable to execute initial WScript " 43 "process, analysis aborted") 44 45 if not free and suspended: 46 p.inject(dll) 47 p.resume() 48 return p.pid 49 else: 50 return None
51
52 - def check(self):
53 return True
54
55 - def finish(self):
56 if self.options.get("procmemdump", False): 57 for pid in self.pids: 58 p = Process(pid=pid) 59 p.dump_memory() 60 61 return True
62