modules.processing.platform.windows.MonitorProcessLog

Package modules :: Package processing :: Package platform :: Module windows :: Class MonitorProcessLog |
[hide private]
[frames] | no frames]

# Class MonitorProcessLog

source code

    object --+
             |
          list --+
                 |
                MonitorProcessLog

Yields each API call event to the parent handler. Optionally it may beautify certain API calls.

Instance Methods | [hide private]
new empty list |
__init__(self, eventstream, modules) x.__init__(...) initializes x; see help(type(x)) for signature | source code
init(self) | source code
_api_COleScript_Compile(self, event) | source code
_api_CWindow_AddTimeoutCode(self, event) | source code
_api_CElement_put_innerHTML(self, event) | source code
_api_CDocument_write(self, event) | source code
_api_CIFrameElement_CreateElement(self, event) Lowercases the attribute keys. | source code
_remember_service_name(self, event) Keep track of the name of this service. | source code
_api_OpenServiceA(self, event) Keep track of the name of this service. | source code
_api_OpenServiceW(self, event) Keep track of the name of this service. | source code
_api_CreateServiceA(self, event) Keep track of the name of this service. | source code
_api_CreateServiceW(self, event) Keep track of the name of this service. | source code
_add_service_name(self, event) | source code
_api_StartServiceA(self, event) | source code
_api_StartServiceW(self, event) | source code
_api_ControlService(self, event) | source code
_api_DeleteService(self, event) | source code
_vbe6_newobject(self, event) Keep track which instance pointers belong to which classes. | source code
_api_vbe6_CreateObject(self, event) Keep track which instance pointers belong to which classes. | source code
_api_vbe6_GetObject(self, event) Keep track which instance pointers belong to which classes. | source code
_api_vbe6_StringConcat(self, event) | source code
_api_vbe6_Import(self, event) | source code
_api_vbe6_GetIDFromName(self, event) Keep track which function has which function index. | source code
_api_vbe6_CallByName(self, event) Only used by the monitor for administrative uses. | source code
_api_vbe6_Invoke(self, event) | source code
_api_pdf_eval(self, event) | source code
_api_pdf_unescape(self, event) | source code
_api___exception__(self, event) | source code
_api_modifier(self, event) Adds flags field to CLSID and IID instances. | source code
__iter__(self) iter(x) | source code
__nonzero__(self) Required for the JSON reporting module as otherwise the on-demand generated list of API calls would be seen as empty. | source code
Inherited from `list`: `__add__`, `__contains__`, `__delitem__`, `__delslice__`, `__eq__`, `__ge__`, `__getattribute__`, `__getitem__`, `__getslice__`, `__gt__`, `__iadd__`, `__imul__`, `__le__`, `__len__`, `__lt__`, `__mul__`, `__ne__`, `__new__`, `__repr__`, `__reversed__`, `__rmul__`, `__setitem__`, `__setslice__`, `__sizeof__`, `append`, `count`, `extend`, `index`, `insert`, `pop`, `remove`, `reverse`, `sort` Inherited from `object`: `__delattr__`, `__format__`, `__reduce__`, `__reduce_ex__`, `__setattr__`, `__str__`, `__subclasshook__`

Class Variables | [hide private]
Inherited from `list`: `__hash__`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, eventstream, modules) (Constructor) | source code
x.__init__(...) initializes x; see help(type(x)) for signature Returns: new empty list Overrides: object.__init__ (inherited documentation)

### _api_vbe6_GetIDFromName(self, event) | source code
Keep track which function has which function index. This informational call is omitted from the actual logs.

### __iter__(self) | source code
iter(x) Overrides: list.__iter__ (inherited documentation)

### __nonzero__(self) (Boolean test operator) | source code
Required for the JSON reporting module as otherwise the on-demand generated list of API calls would be seen as empty. Note that the result structure is kept between processing and reporting time which means that at reporting time, where this functionality is actually needed, the has_apicalls will already have been set while iterating through the BSON logs iterator in the parse() function of the WindowsMonitor class. We use this knowledge to pass along whether or not this log actually has API call events and thus whether it's "nonzero" or not. (The correctness of this field is required as otherwise the json.dump() function will fail - probably due to buffering issues).