Package modules :: Package processing :: Module procmon
[hide private]
[frames] | no frames]

Source Code for Module modules.processing.procmon

 1  # Copyright (C) 2016 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
 5  import os.path 
 6   
 7  from lib.cuckoo.common.abstracts import Processing 
 8   
 9  try: 
10      import lxml.etree 
11      HAVE_LXML = True 
12  except ImportError: 
13      HAVE_LXML = False 
14   
15 -class ProcmonLog(list):
16 """Yields each API call event to the parent handler.""" 17
18 - def __init__(self, filepath):
19 self.filepath = filepath
20
21 - def __iter__(self):
22 procmon = open(self.filepath, "rb") 23 for _, element in lxml.etree.iterparse(procmon, tag="event"): 24 entry = {} 25 for child in element.getchildren(): 26 entry[child.tag] = child.text 27 yield entry
28
29 - def __nonzero__(self):
30 # For documentation on this please refer to MonitorProcessLog. 31 return True
32
33 -class Procmon(Processing):
34 """Extracts events from procmon.exe output.""" 35 36 key = "procmon" 37
38 - def run(self):
39 procmon_xml = os.path.join(self.logs_path, "procmon.xml") 40 if not os.path.exists(procmon_xml): 41 return 42 43 return ProcmonLog(procmon_xml)
44