modules.processing.dropped

Package modules :: Package processing :: Module dropped |
[hide private]
[frames] | no frames]

# Source Code for Module modules.processing.dropped

     1  # Copyright (C) 2010-2013 Claudio Guarnieri.
     2  # Copyright (C) 2014-2016 Cuckoo Foundation.
     3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
     4  # See the file 'docs/LICENSE' for copying permission.
     5
     6  import json
     7  import os
     8
     9  from lib.cuckoo.common.abstracts import Processing
    10  from lib.cuckoo.common.objects import File
    11
    12 -class Dropped(Processing):
    13      """Dropped files analysis."""
    14
    15 -    def run(self):
    16          """Run analysis.
    17          @return: list of dropped files with related information.
    18          """
    19          self.key = "dropped"
    20          dropped_files, meta = [], {}
    21
    22          if os.path.exists(self.dropped_meta_path):
    23              for line in open(self.dropped_meta_path, "rb"):
    24                  entry = json.loads(line)
    25                  filepath = os.path.join(self.analysis_path, entry["path"])
    26                  meta[filepath] = {
    27                      "pids": entry["pids"],
    28                      "filepath": entry["filepath"],
    29                  }
    30
    31          for dir_name, dir_names, file_names in os.walk(self.dropped_path):
    32              for file_name in file_names:
    33                  file_path = os.path.join(dir_name, file_name)
    34                  file_info = File(file_path=file_path).get_all()
    35                  file_info.update(meta.get(file_info["path"], {}))
    36                  dropped_files.append(file_info)
    37
    38          for dir_name, dir_names, file_names in os.walk(self.package_files):
    39              for file_name in file_names:
    40                  file_path = os.path.join(dir_name, file_name)
    41                  file_info = File(file_path=file_path).get_all()
    42                  dropped_files.append(file_info)
    43
    44          return dropped_files
    45