Package modules :: Package packages :: Module xls
[hide private]
[frames] | no frames]

Source Code for Module modules.packages.xls

 1  # Copyright (C) 2010-2014 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os 
 6   
 7  from lib.common.abstracts import Package 
 8  from lib.api.process import Process 
 9  from lib.common.exceptions import CuckooPackageError 
10   
11   
12 -class XLS(Package):
13 """Excel analysis package.""" 14
15 - def get_path(self):
16 office = os.path.join(os.getenv("ProgramFiles"), "Microsoft Office") 17 paths = [ 18 os.path.join(office, "EXCEL.EXE"), 19 os.path.join(office, "Office11", "EXCEL.EXE"), 20 os.path.join(office, "Office12", "EXCEL.EXE"), 21 os.path.join(office, "Office14", "EXCEL.EXE"), 22 os.path.join(office, "Office15", "EXCEL.EXE"), 23 ] 24 25 for path in paths: 26 if os.path.exists(path): 27 return path 28 29 return None
30
31 - def start(self, path):
32 excel = self.get_path() 33 if not excel: 34 raise CuckooPackageError("Unable to find any Microsoft " 35 "Office Excel executable available") 36 37 dll = self.options.get("dll", None) 38 free = self.options.get("free", False) 39 suspended = True 40 if free: 41 suspended = False 42 43 p = Process() 44 if not p.execute(path=excel, args="\"%s\"" % path, suspended=suspended): 45 raise CuckooPackageError("Unable to execute initial Microsoft " 46 "Office Excel process, analysis aborted") 47 48 if not free and suspended: 49 p.inject(dll) 50 p.resume() 51 return p.pid 52 else: 53 return None
54
55 - def check(self):
56 return True
57
58 - def finish(self):
59 if self.options.get("procmemdump", False): 60 for pid in self.pids: 61 p = Process(pid=pid) 62 p.dump_memory() 63 64 return True
65