lib.api.process.Process

Package lib :: Package api :: Module process :: Class Process |
[hide private]
[frames] | no frames]

# Class Process

source code

    object --+
             |
            Process

Windows process.

Instance Methods | [hide private]
__init__(self, pid=None, tid=None, process_name=None) x.__init__(...) initializes x; see help(type(x)) for signature | source code
get_system_info(self) Get system information. | source code
open_process(self) Open a process handle. | source code
open_thread(self) Open a thread handle. | source code
exit_code(self) Get process exit code. | source code
get_filepath(self) Get process image file path. | source code
is_alive(self) Process is alive? | source code
get_parent_pid(self) Get the Parent Process ID. | source code
shortpath(self, path) Returns the shortpath for a file. | source code
_encode_args(self, args) Convert a list of arguments to a string that can be passed along on the command-line. | source code
is32bit(self, pid=None, process_name=None, path=None) Is a PE file 32-bit or does a process identifier belong to a 32-bit process. | source code
execute(self, path, args=None, dll=None, free=False, curdir=None, source=None, mode=None, maximize=False, env=None, trigger=None) Execute sample process. | source code
terminate(self) Terminate process. | source code
inject(self, dll=None, apc=False, track=True, mode=None) Inject our monitor into the specified process. | source code
drop_config(self, track=True, mode=None, trigger=None) Helper function to drop the configuration for a new process. | source code
dump_memory(self, addr=None, length=None) Dump process memory, optionally target only a certain memory range. | source code
dump_memory_block(self, addr=None, length=None) Dump process memory, optionally target only a certain memory range. | source code
Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Static Methods | [hide private]
set_config(config) Sets the analyzer configuration once. | source code

Class Variables | [hide private]
| first_process = `True`
| config = `None`
| dumpmem = `{}`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, pid=None, tid=None, process_name=None) (Constructor) | source code
x.__init__(...) initializes x; see help(type(x)) for signature Parameters: `pid` - process identifier. `tid` - thread identifier. `process_name` - process name. Overrides: object.__init__

### exit_code(self) | source code
Get process exit code. Returns: exit code value.

### get_filepath(self) | source code
Get process image file path. Returns: decoded file path.

### is_alive(self) | source code
Process is alive? Returns: process status.

### shortpath(self, path) | source code
Returns the shortpath for a file. As Python 2.7 does not support passing along unicode strings in subprocess.Popen() and alike this will have to do. See also: http://stackoverflow.com/questions/2595448/unicode-filename-to-python-subprocess-call

### _encode_args(self, args) | source code
Convert a list of arguments to a string that can be passed along on the command-line. Parameters: `args` - list of arguments Returns: the command-line equivalent

### is32bit(self, pid=None, process_name=None, path=None) | source code
Is a PE file 32-bit or does a process identifier belong to a 32-bit process. Parameters: `pid` - process identifier. `process_name` - process name. `path` - path to a PE file. Returns: boolean or exception.

### execute(self, path, args=None, dll=None, free=False, curdir=None, source=None, mode=None, maximize=False, env=None, trigger=None) | source code
Execute sample process. Parameters: `path` - sample path. `args` - process args. `dll` - dll path. `free` - do not inject our monitor. `curdir` - current working directory. `source` - process identifier or process name which will become the parent process for the new process. `mode` - monitor mode - which functions to instrument. `maximize` - whether the GUI should be maximized. `env` - environment variables. `trigger` - trigger to indicate analysis start Returns: operation status.

### terminate(self) | source code
Terminate process. Returns: operation status.

### inject(self, dll=None, apc=False, track=True, mode=None) | source code
Inject our monitor into the specified process. Parameters: `dll` - Cuckoo DLL path. `apc` - Use APC injection. `track` - Track this process in the analyzer. `mode` - Monitor mode - which functions to instrument.

### dump_memory(self, addr=None, length=None) | source code
Dump process memory, optionally target only a certain memory range. Returns: operation status.

### dump_memory_block(self, addr=None, length=None) | source code
Dump process memory, optionally target only a certain memory range. Returns: operation status.