Package lib :: Package api :: Module process :: Class Process
[hide private]
[frames] | no frames]

Class Process

source code

object --+
         |
        Process

Windows process.

Instance Methods [hide private]
 
__init__(self, pid=None, tid=None, process_name=None)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
get_system_info(self)
Get system information.
source code
 
open_process(self)
Open a process handle.
source code
 
open_thread(self)
Open a thread handle.
source code
 
exit_code(self)
Get process exit code.
source code
 
get_filepath(self)
Get process image file path.
source code
 
is_alive(self)
Process is alive?
source code
 
get_parent_pid(self)
Get the Parent Process ID.
source code
 
shortpath(self, path)
Returns the shortpath for a file.
source code
 
_encode_args(self, args)
Convert a list of arguments to a string that can be passed along on the command-line.
source code
 
is32bit(self, pid=None, process_name=None, path=None)
Is a PE file 32-bit or does a process identifier belong to a 32-bit process.
source code
 
execute(self, path, args=None, dll=None, free=False, curdir=None, source=None, mode=None, maximize=False, env=None, trigger=None)
Execute sample process.
source code
 
terminate(self)
Terminate process.
source code
 
inject(self, dll=None, apc=False, track=True, mode=None)
Inject our monitor into the specified process.
source code
 
drop_config(self, track=True, mode=None, trigger=None)
Helper function to drop the configuration for a new process.
source code
 
dump_memory(self, addr=None, length=None)
Dump process memory, optionally target only a certain memory range.
source code
 
dump_memory_block(self, addr=None, length=None)
Dump process memory, optionally target only a certain memory range.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Static Methods [hide private]
 
set_config(config)
Sets the analyzer configuration once.
source code
Class Variables [hide private]
  first_process = True
  config = None
  dumpmem = {}
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, pid=None, tid=None, process_name=None)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Parameters:
  • pid - process identifier.
  • tid - thread identifier.
  • process_name - process name.
Overrides: object.__init__

exit_code(self)

source code 

Get process exit code.

Returns:
exit code value.

get_filepath(self)

source code 

Get process image file path.

Returns:
decoded file path.

is_alive(self)

source code 

Process is alive?

Returns:
process status.

shortpath(self, path)

source code 

Returns the shortpath for a file.

As Python 2.7 does not support passing along unicode strings in subprocess.Popen() and alike this will have to do. See also: http://stackoverflow.com/questions/2595448/unicode-filename-to-python-subprocess-call

_encode_args(self, args)

source code 

Convert a list of arguments to a string that can be passed along on the command-line.

Parameters:
  • args - list of arguments
Returns:
the command-line equivalent

is32bit(self, pid=None, process_name=None, path=None)

source code 

Is a PE file 32-bit or does a process identifier belong to a 32-bit process.

Parameters:
  • pid - process identifier.
  • process_name - process name.
  • path - path to a PE file.
Returns:
boolean or exception.

execute(self, path, args=None, dll=None, free=False, curdir=None, source=None, mode=None, maximize=False, env=None, trigger=None)

source code 

Execute sample process.

Parameters:
  • path - sample path.
  • args - process args.
  • dll - dll path.
  • free - do not inject our monitor.
  • curdir - current working directory.
  • source - process identifier or process name which will become the parent process for the new process.
  • mode - monitor mode - which functions to instrument.
  • maximize - whether the GUI should be maximized.
  • env - environment variables.
  • trigger - trigger to indicate analysis start
Returns:
operation status.

terminate(self)

source code 

Terminate process.

Returns:
operation status.

inject(self, dll=None, apc=False, track=True, mode=None)

source code 

Inject our monitor into the specified process.

Parameters:
  • dll - Cuckoo DLL path.
  • apc - Use APC injection.
  • track - Track this process in the analyzer.
  • mode - Monitor mode - which functions to instrument.

dump_memory(self, addr=None, length=None)

source code 

Dump process memory, optionally target only a certain memory range.

Returns:
operation status.

dump_memory_block(self, addr=None, length=None)

source code 

Dump process memory, optionally target only a certain memory range.

Returns:
operation status.