1
2
3
4
5 import os
6
7 from lib.common.abstracts import Package
8 from lib.api.process import Process
9 from lib.common.exceptions import CuckooPackageError
10
12 """Control Panel Applet analysis package."""
13
15 path = os.path.join(os.getenv("SystemRoot"), "system32", "control.exe")
16 if os.path.exists(path):
17 return path
18
19 return
20
22 control = self.get_path()
23 if not control:
24 raise CuckooPackageError("Unable to find any control.exe "
25 "executable available")
26
27 dll = self.options.get("dll", None)
28 free = self.options.get("free", False)
29 suspended = True
30 if free:
31 suspended = False
32
33 p = Process()
34 if not p.execute(path=control, args="\"%s\"" % path,
35 suspended=suspended):
36 raise CuckooPackageError("Unable to execute initial Control "
37 "process, analysis aborted")
38
39 if not free and suspended:
40 p.inject(dll)
41 p.resume()
42 return p.pid
43 else:
44 return None
45
48
50 if self.options.get("procmemdump", False):
51 for pid in self.pids:
52 p = Process(pid=pid)
53 p.dump_memory()
54
55 return True
56