Package modules :: Package packages :: Module dll
[hide private]
[frames] | no frames]

Source Code for Module modules.packages.dll

 1  # Copyright (C) 2010-2014 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  from lib.common.abstracts import Package 
 6  from lib.api.process import Process 
 7  from lib.common.exceptions import CuckooPackageError 
 8   
9 -class Dll(Package):
10 """DLL analysis package.""" 11
12 - def start(self, path):
13 free = self.options.get("free", False) 14 function = self.options.get("function", "DllMain") 15 arguments = self.options.get("arguments", None) 16 dll = self.options.get("dll", None) 17 suspended = True 18 if free: 19 suspended = False 20 21 args = "{0},{1}".format(path, function) 22 if arguments: 23 args += " {0}".format(arguments) 24 25 p = Process() 26 if not p.execute(path="C:\\WINDOWS\\system32\\rundll32.exe", args=args, suspended=suspended): 27 raise CuckooPackageError("Unable to execute rundll32, " 28 "analysis aborted") 29 30 if not free and suspended: 31 p.inject(dll) 32 p.resume() 33 return p.pid 34 else: 35 return None
36
37 - def check(self):
38 return True
39
40 - def finish(self):
41 if self.options.get("procmemdump", False): 42 for pid in self.pids: 43 p = Process(pid=pid) 44 p.dump_memory() 45 46 return True
47