modules.processing.procmemory.ProcessMemory

Package modules :: Package processing :: Module procmemory :: Class ProcessMemory |
[hide private]
[frames] | no frames]

# Class ProcessMemory

source code

                                object --+
                                         |
    lib.cuckoo.common.abstracts.Processing --+
                                             |
                                            ProcessMemory

Analyze process memory dumps.

Instance Methods | [hide private]
read_dump(self, filepath) | source code
create_idapy(self, process) | source code
_fixup_pe_header(self, pe) Fixes the PE header from an in-memory representation to an on-disk representation. | source code
dump_images(self, process, drop_dlls=False) Dump executable images from this process memory dump. | source code
run(self) Run analysis. | source code
Inherited from `lib.cuckoo.common.abstracts.Processing`: `__init__`, `set_baseline`, `set_options`, `set_path`, `set_results`, `set_task` Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Class Variables | [hide private]
Inherited from `lib.cuckoo.common.abstracts.Processing`: `enabled`, `order`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### run(self) | source code
Run analysis. Returns: structured results. Raises: `NotImplementedError` - this method is abstract. Overrides: lib.cuckoo.common.abstracts.Processing.run