Added support for classes and windows (#113)

avast · Jul 24, 2020 · 6e01107 · 6e01107
1 parent e6dbb22
commit 6e01107
Show file tree

Hide file tree

Showing 2 changed files with 92 additions and 0 deletions.
diff --git a/src/types/modules/cuckoo_module.cpp b/src/types/modules/cuckoo_module.cpp
@@ -96,6 +96,10 @@ bool CuckooModule::initialize(ImportFeatures features)
 			processStruct->addAttribute(std::make_shared<FunctionSymbol>("api_call", Type::Int, Type::Regexp));
 			processStruct->addAttribute(std::make_shared<FunctionSymbol>("modified_clipboard", Type::Int, Type::Regexp));
 			processStruct->addAttribute(std::make_shared<FunctionSymbol>("scheduled_task", Type::Int, Type::Regexp));
+			processStruct->addAttribute(std::make_shared<FunctionSymbol>("class_created", Type::Int, Type::Regexp));
+			processStruct->addAttribute(std::make_shared<FunctionSymbol>("class_searched", Type::Int, Type::Regexp));
+			processStruct->addAttribute(std::make_shared<FunctionSymbol>("window_created", Type::Int, Type::Regexp));
+			processStruct->addAttribute(std::make_shared<FunctionSymbol>("window_searched", Type::Int, Type::Regexp));
 			cuckooStruct->addAttribute(processStruct);
 
 			auto summaryStruct = std::make_shared<StructureSymbol>("summary");

diff --git a/tests/cpp/parser_tests.cpp b/tests/cpp/parser_tests.cpp
@@ -6479,6 +6479,94 @@ rule cuckoo_desktop
 	EXPECT_EQ(input_text, driver.getParsedFile().getTextFormatted());
 }
 
+TEST_F(ParserTests,
+CuckooClassCreatedModuleFunction) {
+	prepareInput(
+R"(
+import "cuckoo"
+
+rule cuckoo_class_created
+{
+	condition:
+		cuckoo.process.class_created(/SomeEvilClass/)
+}
+)");
+
+	EXPECT_TRUE(driver.parse(input));
+	ASSERT_EQ(1u, driver.getParsedFile().getRules().size());
+
+	const auto& rule = driver.getParsedFile().getRules()[0];
+	EXPECT_EQ(R"(cuckoo.process.class_created(/SomeEvilClass/))", rule->getCondition()->getText());
+
+	EXPECT_EQ(input_text, driver.getParsedFile().getTextFormatted());
+}
+
+TEST_F(ParserTests,
+CuckooClassSearchedModuleFunction) {
+	prepareInput(
+R"(
+import "cuckoo"
+
+rule cuckoo_class_searched
+{
+	condition:
+		cuckoo.process.class_searched(/SomeEvilClass/)
+}
+)");
+
+	EXPECT_TRUE(driver.parse(input));
+	ASSERT_EQ(1u, driver.getParsedFile().getRules().size());
+
+	const auto& rule = driver.getParsedFile().getRules()[0];
+	EXPECT_EQ(R"(cuckoo.process.class_searched(/SomeEvilClass/))", rule->getCondition()->getText());
+
+	EXPECT_EQ(input_text, driver.getParsedFile().getTextFormatted());
+}
+
+TEST_F(ParserTests,
+CuckooWindowCreatedModuleFunction) {
+	prepareInput(
+R"(
+import "cuckoo"
+
+rule cuckoo_window_created
+{
+	condition:
+		cuckoo.process.window_created(/SomeEvilWindow/)
+}
+)");
+
+	EXPECT_TRUE(driver.parse(input));
+	ASSERT_EQ(1u, driver.getParsedFile().getRules().size());
+
+	const auto& rule = driver.getParsedFile().getRules()[0];
+	EXPECT_EQ(R"(cuckoo.process.window_created(/SomeEvilWindow/))", rule->getCondition()->getText());
+
+	EXPECT_EQ(input_text, driver.getParsedFile().getTextFormatted());
+}
+
+TEST_F(ParserTests,
+CuckooWindowSearchedModuleFunction) {
+	prepareInput(
+R"(
+import "cuckoo"
+
+rule cuckoo_window_searched
+{
+	condition:
+		cuckoo.process.window_searched(/SomeEvilWindow/)
+}
+)");
+
+	EXPECT_TRUE(driver.parse(input));
+	ASSERT_EQ(1u, driver.getParsedFile().getRules().size());
+
+	const auto& rule = driver.getParsedFile().getRules()[0];
+	EXPECT_EQ(R"(cuckoo.process.window_searched(/SomeEvilWindow/))", rule->getCondition()->getText());
+
+	EXPECT_EQ(input_text, driver.getParsedFile().getTextFormatted());
+}
+
 TEST_F(ParserTests,
 StringXorModifierWithArguments) {
 	prepareInput(