Package modules :: Package packages :: Module pdf
[hide private]
[frames] | no frames]

Source Code for Module modules.packages.pdf

 1  # Copyright (C) 2010-2014 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os 
 6   
 7  from lib.common.abstracts import Package 
 8  from lib.api.process import Process 
 9  from lib.common.exceptions import CuckooPackageError 
10   
11 -class PDF(Package):
12 """PDF analysis package.""" 13
14 - def get_path(self):
15 adobe = os.path.join(os.getenv("ProgramFiles"), "Adobe") 16 paths = [ 17 os.path.join(adobe, "Reader 8.0", "Reader", "AcroRd32.exe"), 18 os.path.join(adobe, "Reader 9.0", "Reader", "AcroRd32.exe"), 19 os.path.join(adobe, "Reader 10.0", "Reader", "AcroRd32.exe"), 20 os.path.join(adobe, "Reader 11.0", "Reader", "AcroRd32.exe"), 21 ] 22 23 for path in paths: 24 if os.path.exists(path): 25 return path 26 27 return None
28
29 - def start(self, path):
30 reader = self.get_path() 31 if not reader: 32 raise CuckooPackageError("Unable to find any Adobe Reader " 33 "executable available") 34 35 dll = self.options.get("dll", None) 36 free = self.options.get("free", False) 37 suspended = True 38 if free: 39 suspended = False 40 41 p = Process() 42 if not p.execute(path=reader, args="\"%s\"" % path, suspended=suspended): 43 raise CuckooPackageError("Unable to execute initial Adobe Reader " 44 "process, analysis aborted") 45 46 if not free and suspended: 47 p.inject(dll) 48 p.resume() 49 return p.pid 50 else: 51 return None
52
53 - def check(self):
54 return True
55
56 - def finish(self):
57 if self.options.get("procmemdump", False): 58 for pid in self.pids: 59 p = Process(pid=pid) 60 p.dump_memory() 61 62 return True
63