Package modules :: Package processing :: Package platform :: Module windows :: Class MonitorProcessLog
[hide private]
[frames] | no frames]

Class MonitorProcessLog

source code

object --+    
         |    
      list --+
             |
            MonitorProcessLog

Yields each API call event to the parent handler. Optionally it may beautify certain API calls.

Instance Methods [hide private]
new empty list
__init__(self, eventstream, modules)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
init(self) source code
 
_api_COleScript_Compile(self, event) source code
 
_api_CWindow_AddTimeoutCode(self, event) source code
 
_api_CElement_put_innerHTML(self, event) source code
 
_api_CDocument_write(self, event) source code
 
_api_CIFrameElement_CreateElement(self, event)
Lowercases the attribute keys.
source code
 
_remember_service_name(self, event)
Keep track of the name of this service.
source code
 
_api_OpenServiceA(self, event)
Keep track of the name of this service.
source code
 
_api_OpenServiceW(self, event)
Keep track of the name of this service.
source code
 
_api_CreateServiceA(self, event)
Keep track of the name of this service.
source code
 
_api_CreateServiceW(self, event)
Keep track of the name of this service.
source code
 
_add_service_name(self, event) source code
 
_api_StartServiceA(self, event) source code
 
_api_StartServiceW(self, event) source code
 
_api_ControlService(self, event) source code
 
_api_DeleteService(self, event) source code
 
_vbe6_newobject(self, event)
Keep track which instance pointers belong to which classes.
source code
 
_api_vbe6_CreateObject(self, event)
Keep track which instance pointers belong to which classes.
source code
 
_api_vbe6_GetObject(self, event)
Keep track which instance pointers belong to which classes.
source code
 
_api_vbe6_StringConcat(self, event) source code
 
_api_vbe6_Import(self, event) source code
 
_api_vbe6_GetIDFromName(self, event)
Keep track which function has which function index.
source code
 
_api_vbe6_CallByName(self, event)
Only used by the monitor for administrative uses.
source code
 
_api_vbe6_Invoke(self, event) source code
 
_api_pdf_eval(self, event) source code
 
_api_pdf_unescape(self, event) source code
 
_api___exception__(self, event) source code
 
_api_modifier(self, event)
Adds flags field to CLSID and IID instances.
source code
 
__iter__(self)
iter(x)
source code
 
__nonzero__(self)
Required for the JSON reporting module as otherwise the on-demand generated list of API calls would be seen as empty.
source code

Inherited from list: __add__, __contains__, __delitem__, __delslice__, __eq__, __ge__, __getattribute__, __getitem__, __getslice__, __gt__, __iadd__, __imul__, __le__, __len__, __lt__, __mul__, __ne__, __new__, __repr__, __reversed__, __rmul__, __setitem__, __setslice__, __sizeof__, append, count, extend, index, insert, pop, remove, reverse, sort

Inherited from object: __delattr__, __format__, __reduce__, __reduce_ex__, __setattr__, __str__, __subclasshook__

Class Variables [hide private]

Inherited from list: __hash__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, eventstream, modules)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Returns: new empty list
Overrides: object.__init__
(inherited documentation)

_api_vbe6_GetIDFromName(self, event)

source code 

Keep track which function has which function index. This informational call is omitted from the actual logs.

__iter__(self)

source code 

iter(x)

Overrides: list.__iter__
(inherited documentation)

__nonzero__(self)
(Boolean test operator)

source code 

Required for the JSON reporting module as otherwise the on-demand generated list of API calls would be seen as empty.

Note that the result structure is kept between processing and reporting time which means that at reporting time, where this functionality is actually needed, the has_apicalls will already have been set while iterating through the BSON logs iterator in the parse() function of the WindowsMonitor class. We use this knowledge to pass along whether or not this log actually has API call events and thus whether it's "nonzero" or not. (The correctness of this field is required as otherwise the json.dump() function will fail - probably due to buffering issues).