Package lib :: Package common :: Module abstracts :: Class Package
[hide private]
[frames] | no frames]

Class Package

source code

object --+
         |
        Package

Base abstract analysis package.

Instance Methods [hide private]
 
__init__(self, options={}, analyzer=None)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
set_pids(self, pids)
Update list of monitored PIDs in the package context.
source code
 
start(self, target)
Run analysis package.
source code
 
check(self)
Check.
source code
 
enum_paths(self)
Enumerate available paths.
source code
 
get_path(self, application)
Search for the application in all available paths.
source code
 
get_path_glob(self, application)
Search for the application in all available paths with glob support.
source code
 
move_curdir(self, filepath)
Move a file to the current working directory so it can be executed from there.
source code
 
init_regkeys(self, regkeys)
Initializes the registry to avoid annoying popups, configure settings, etc.
source code
 
execute(self, path, args, mode=None, maximize=False, env=None, source=None, trigger=None)
Starts an executable for analysis.
source code
 
package_files(self)
A list of files to upload to host.
source code
 
finish(self)
Finish run.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  PATHS = []
  REGKEYS = []
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, options={}, analyzer=None)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Parameters:
  • options - options dict.
Overrides: object.__init__

set_pids(self, pids)

source code 

Update list of monitored PIDs in the package context.

Parameters:
  • pids - list of pids.

start(self, target)

source code 

Run analysis package.

Raises:
  • NotImplementedError - this method is abstract.

get_path(self, application)

source code 

Search for the application in all available paths.

Parameters:
  • applicaiton - application executable name
Returns:
executable path

get_path_glob(self, application)

source code 

Search for the application in all available paths with glob support.

Parameters:
  • applicaiton - application executable name
Returns:
executable path

move_curdir(self, filepath)

source code 

Move a file to the current working directory so it can be executed from there.

Parameters:
  • filepath - the file to be moved
Returns:
the new filepath

init_regkeys(self, regkeys)

source code 

Initializes the registry to avoid annoying popups, configure settings, etc.

Parameters:
  • regkeys - the root keys, subkeys, and key/value pairs.

execute(self, path, args, mode=None, maximize=False, env=None, source=None, trigger=None)

source code 

Starts an executable for analysis.

Parameters:
  • path - executable path
  • args - executable arguments
  • mode - monitor mode - which functions to instrument
  • maximize - whether the GUI should start maximized
  • env - additional environment variables
  • source - parent process of our process
  • trigger - trigger to indicate analysis start
Returns:
process pid

package_files(self)

source code 

A list of files to upload to host. The list should be a list of tuples (<path on guest>, <name of file in package_files folder>). (package_files is a folder that will be created in analysis folder).

finish(self)

source code 

Finish run. If specified to do so, this method dumps the memory of all running processes.