Package modules :: Package processing :: Module dropped
[hide private]
[frames] | no frames]

Source Code for Module modules.processing.dropped

 1  # Copyright (C) 2010-2013 Claudio Guarnieri. 
 2  # Copyright (C) 2014-2016 Cuckoo Foundation. 
 3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 4  # See the file 'docs/LICENSE' for copying permission. 
 5   
 6  import json 
 7  import os 
 8   
 9  from lib.cuckoo.common.abstracts import Processing 
10  from lib.cuckoo.common.objects import File 
11   
12 -class Dropped(Processing):
13 """Dropped files analysis.""" 14
15 - def run(self):
16 """Run analysis. 17 @return: list of dropped files with related information. 18 """ 19 self.key = "dropped" 20 dropped_files, meta = [], {} 21 22 if os.path.exists(self.dropped_meta_path): 23 for line in open(self.dropped_meta_path, "rb"): 24 entry = json.loads(line) 25 filepath = os.path.join(self.analysis_path, entry["path"]) 26 meta[filepath] = { 27 "pids": entry["pids"], 28 "filepath": entry["filepath"], 29 } 30 31 for dir_name, dir_names, file_names in os.walk(self.dropped_path): 32 for file_name in file_names: 33 file_path = os.path.join(dir_name, file_name) 34 file_info = File(file_path=file_path).get_all() 35 file_info.update(meta.get(file_info["path"], {})) 36 dropped_files.append(file_info) 37 38 for dir_name, dir_names, file_names in os.walk(self.package_files): 39 for file_name in file_names: 40 file_path = os.path.join(dir_name, file_name) 41 file_info = File(file_path=file_path).get_all() 42 dropped_files.append(file_info) 43 44 return dropped_files
45