modules.auxiliary.human

Package modules :: Package auxiliary :: Module human |
[hide private]
[frames] | no frames]

# Source Code for Module modules.auxiliary.human

      1  #!/usr/bin/env python
      2  # Copyright (C) 2010-2013 Claudio Guarnieri.
      3  # Copyright (C) 2014-2016 Cuckoo Foundation.
      4  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
      5  # See the file 'docs/LICENSE' for copying permission.
      6
      7  import random
      8  import logging
      9  from threading import Thread
     10  from ctypes import WINFUNCTYPE, POINTER
     11  from ctypes import c_bool, c_int, create_unicode_buffer
     12
     13  from lib.common.abstracts import Auxiliary
     14  from lib.common.defines import KERNEL32, USER32
     15  from lib.common.defines import WM_GETTEXT, WM_GETTEXTLENGTH, BM_CLICK
     16
     17  log = logging.getLogger(__name__)
     18
     19  EnumWindowsProc = WINFUNCTYPE(c_bool, POINTER(c_int), POINTER(c_int))
     20  EnumChildProc = WINFUNCTYPE(c_bool, POINTER(c_int), POINTER(c_int))
     21
     22  RESOLUTION = {
     23      "x": USER32.GetSystemMetrics(0),
     24      "y": USER32.GetSystemMetrics(1)
     25  }
     26
     27 -def foreach_child(hwnd, lparam):
     28      # List of buttons labels to click.
     29      buttons = [
     30          "yes", "oui",
     31          "ok",
     32          "accept", "accepter",
     33          "next", "suivant",
     34          "install", "installer",
     35          "run",
     36          "agree", "j'accepte",
     37          "enable", "activer",
     38          "don't send", "ne pas envoyer",
     39          "continue", "continuer",
     40          "unzip", "dezip",
     41          "open", "ouvrir",
     42          "execute", "executer",
     43          "launch", "lancer",
     44          "save", "sauvegarder"
     45      ]
     46
     47      # List of buttons labels to not click.
     48      dontclick = [
     49          "don't run",
     50      ]
     51
     52      classname = create_unicode_buffer(50)
     53      USER32.GetClassNameW(hwnd, classname, 50)
     54
     55      # Check if the class of the child is button.
     56      if "button" in classname.value.lower():
     57          # Get the text of the button.
     58          length = USER32.SendMessageW(hwnd, WM_GETTEXTLENGTH, 0, 0)
     59          text = create_unicode_buffer(length + 1)
     60          USER32.SendMessageW(hwnd, WM_GETTEXT, length + 1, text)
     61
     62          # Check if the button is set as "clickable" and click it.
     63          textval = text.value.replace("&", "").lower()
     64          for button in buttons:
     65              if button in textval:
     66                  for btn in dontclick:
     67                      if btn in textval:
     68                          break
     69                  else:
     70                      log.info("Found button \"%s\", clicking it" % text.value)
     71                      USER32.SetForegroundWindow(hwnd)
     72                      KERNEL32.Sleep(1000)
     73                      USER32.SendMessageW(hwnd, BM_CLICK, 0, 0)
     74
     75      # Recursively search for childs (USER32.EnumChildWindows).
     76      return True
     77
     78  # Callback procedure invoked for every enumerated window.
     79 -def foreach_window(hwnd, lparam):
     80      # If the window is visible, enumerate its child objects, looking
     81      # for buttons.
     82      if USER32.IsWindowVisible(hwnd):
     83          USER32.EnumChildWindows(hwnd, EnumChildProc(foreach_child), 0)
     84      return True
     85
     86 -def move_mouse():
     87      x = random.randint(0, RESOLUTION["x"])
     88      y = random.randint(0, RESOLUTION["y"])
     89
     90      # Originally was:
     91      # USER32.mouse_event(0x8000, x, y, 0, None)
     92      # Changed to SetCurorPos, since using GetCursorPos would not detect
     93      # the mouse events. This actually moves the cursor around which might
     94      # cause some unintended activity on the desktop. We might want to make
     95      # this featur optional.
     96      USER32.SetCursorPos(x, y)
     97
     98 -def click_mouse():
     99      # Move mouse to top-middle position.
    100      USER32.SetCursorPos(RESOLUTION["x"] / 2, 0)
    101      # Mouse down.
    102      USER32.mouse_event(2, 0, 0, 0, None)
    103      KERNEL32.Sleep(50)
    104      # Mouse up.
    105      USER32.mouse_event(4, 0, 0, 0, None)
    106
    107 -class Human(Auxiliary, Thread):
    108      """Human after all"""
    109
    110 -    def __init__(self, options={}, analyzer=None):
    111          Thread.__init__(self)
    112          Auxiliary.__init__(self, options, analyzer)
    113          self.do_run = True
    114
    115 -    def stop(self):
    116          self.do_run = False
    117
    118 -    def run(self):
    119          # Global disable flag.
    120          if "human" in self.options:
    121              self.do_move_mouse = int(self.options["human"])
    122              self.do_click_mouse = int(self.options["human"])
    123              self.do_click_buttons = int(self.options["human"])
    124          else:
    125              self.do_move_mouse = True
    126              self.do_click_mouse = True
    127              self.do_click_buttons = True
    128
    129          # Per-feature enable or disable flag.
    130          if "human.move_mouse" in self.options:
    131              self.do_move_mouse = int(self.options["human.move_mouse"])
    132
    133          if "human.click_mouse" in self.options:
    134              self.do_click_mouse = int(self.options["human.click_mouse"])
    135
    136          if "human.click_buttons" in self.options:
    137              self.do_click_buttons = int(self.options["human.click_buttons"])
    138
    139          while self.do_run:
    140              if self.do_click_mouse:
    141                  click_mouse()
    142
    143              if self.do_move_mouse:
    144                  move_mouse()
    145
    146              if self.do_click_buttons:
    147                  USER32.EnumWindows(EnumWindowsProc(foreach_window), 0)
    148
    149              KERNEL32.Sleep(1000)
    150