modules.packages.dll

Package modules :: Package packages :: Module dll |
[hide private]
[frames] | no frames]

# Source Code for Module modules.packages.dll

     1  # Copyright (C) 2010-2013 Claudio Guarnieri.
     2  # Copyright (C) 2014-2016 Cuckoo Foundation.
     3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
     4  # See the file 'docs/LICENSE' for copying permission.
     5
     6  import os
     7  import shlex
     8  import shutil
     9
    10  from lib.common.abstracts import Package
    11
    12 -class Dll(Package):
    13      """DLL analysis package."""
    14      PATHS = [
    15          ("System32", "rundll32.exe"),
    16      ]
    17
    18 -    def start(self, path):
    19          rundll32 = self.get_path("rundll32.exe")
    20          function = self.options.get("function", "DllMain")
    21          arguments = self.options.get("arguments", "")
    22          loader_name = self.options.get("loader")
    23
    24          # Check file extension.
    25          ext = os.path.splitext(path)[-1].lower()
    26
    27          # If the file doesn't have the proper .dll extension force it
    28          # and rename it. This is needed for rundll32 to execute correctly.
    29          # See ticket #354 for details.
    30          if ext != ".dll":
    31              new_path = path + ".dll"
    32              os.rename(path, new_path)
    33              path = new_path
    34
    35          args = ["%s,%s" % (path, function)]
    36          if arguments:
    37              args += shlex.split(arguments)
    38
    39          if loader_name:
    40              loader = os.path.join(os.path.dirname(rundll32), loader_name)
    41              shutil.copy(rundll32, loader)
    42              rundll32 = loader
    43
    44          return self.execute(rundll32, args=args)
    45