1
2
3
4
5
6 import os
7 import shlex
8 import shutil
9
10 from lib.common.abstracts import Package
11
13 """DLL analysis package."""
14 PATHS = [
15 ("System32", "rundll32.exe"),
16 ]
17
19 rundll32 = self.get_path("rundll32.exe")
20 function = self.options.get("function", "DllMain")
21 arguments = self.options.get("arguments", "")
22 loader_name = self.options.get("loader")
23
24
25 ext = os.path.splitext(path)[-1].lower()
26
27
28
29
30 if ext != ".dll":
31 new_path = path + ".dll"
32 os.rename(path, new_path)
33 path = new_path
34
35 args = ["%s,%s" % (path, function)]
36 if arguments:
37 args += shlex.split(arguments)
38
39 if loader_name:
40 loader = os.path.join(os.path.dirname(rundll32), loader_name)
41 shutil.copy(rundll32, loader)
42 rundll32 = loader
43
44 return self.execute(rundll32, args=args)
45