modules.auxiliary.procmon

Package modules :: Package auxiliary :: Module procmon |
[hide private]
[frames] | no frames]

# Source Code for Module modules.auxiliary.procmon

     1  # Copyright (C) 2016 Cuckoo Foundation.
     2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
     3  # See the file 'docs/LICENSE' for copying permission.
     4
     5  import os.path
     6  import subprocess
     7  import time
     8
     9  from lib.common.abstracts import Auxiliary
    10  from lib.common.exceptions import CuckooDisableModule, CuckooPackageError
    11  from lib.common.results import upload_to_host
    12
    13 -class Procmon(Auxiliary):
    14      """Allow procmon to be run on the side."""
    15 -    def start(self):
    16          if not self.options.get("procmon"):
    17              raise CuckooDisableModule
    18
    19          bin_path = os.path.join(self.analyzer.path, "bin")
    20
    21          self.procmon_exe = os.path.join(bin_path, "procmon.exe")
    22          self.procmon_pmc = os.path.join(bin_path, "procmon.pmc")
    23          self.procmon_pml = os.path.join(bin_path, "procmon.pml")
    24          self.procmon_xml = os.path.join(bin_path, "procmon.xml")
    25
    26          if not os.path.exists(self.procmon_exe) or \
    27                  not os.path.exists(self.procmon_pmc):
    28              raise CuckooPackageError(
    29                  "In order to use the Process Monitor functionality it is "
    30                  "required to have Procmon setup with Cuckoo. Please run the "
    31                  "Cuckoo Community script which will automatically fetch all "
    32                  "related files to get you up-and-running."
    33              )
    34
    35          # Start process monitor in the background.
    36          subprocess.Popen([
    37              self.procmon_exe,
    38              "/AcceptEula",
    39              "/Quiet",
    40              "/Minimized",
    41              "/BackingFile", self.procmon_pml,
    42          ])
    43
    44          # Try to avoid race conditions by waiting until at least something
    45          # has been written to the log file.
    46          while not os.path.exists(self.procmon_pml) or \
    47                  not os.path.getsize(self.procmon_pml):
    48              time.sleep(0.1)
    49
    50 -    def stop(self):
    51          # Terminate process monitor.
    52          subprocess.check_call([
    53              self.procmon_exe,
    54              "/Terminate",
    55          ])
    56
    57          # Convert the process monitor log into a readable XML file.
    58          subprocess.check_call([
    59              self.procmon_exe,
    60              "/OpenLog", self.procmon_pml,
    61              "/LoadConfig", self.procmon_pmc,
    62              "/SaveAs", self.procmon_xml,
    63              "/SaveApplyFilter",
    64          ])
    65
    66          # Upload the XML file to the host.
    67          upload_to_host(self.procmon_xml, os.path.join("logs", "procmon.xml"))
    68