Skip to content

Commit

Permalink
various minor tweaks
Browse files Browse the repository at this point in the history
  • Loading branch information
jbremer committed Jul 12, 2017
1 parent ecfb4db commit d39076b
Show file tree
Hide file tree
Showing 10 changed files with 128 additions and 110 deletions.
10 changes: 3 additions & 7 deletions cuckoo/compat/config.py
Original file line number Diff line number Diff line change
Expand Up @@ -683,13 +683,9 @@ def _201_202(c):
return c

def _203_204(c):
machineries = (
"qemu",
)
for machinery in machineries:
for machine in c[machinery][machinery]["machines"]:
c[machinery][machine]["snapshot"] = None
c[machinery][machine]["enable_kvm"] = False
for machine in c["qemu"]["qemu"]["machines"]:
c["qemu"][machine]["snapshot"] = None
c["qemu"][machine]["enable_kvm"] = False
return c

migrations = {
Expand Down
8 changes: 6 additions & 2 deletions cuckoo/core/guest.py
Original file line number Diff line number Diff line change
Expand Up @@ -349,10 +349,14 @@ def determine_analyzer_path(self):
self.analyzer_path = r.json()["dirpath"]

def determine_system_drive(self):
return "%s/" % self.environ["SYSTEMDRIVE"] if self.platform == "windows" else "/"
if self.platform == "windows":
return "%s/" % self.environ["SYSTEMDRIVE"]
return "/"

def determine_temp_path(self):
return self.environ["TEMP"] if self.platform == "windows" else "/tmp"
if self.platform == "windows":
return self.environ["TEMP"]
return "/tmp"

def upload_analyzer(self, monitor):
"""Upload the analyzer to the Virtual Machine."""
Expand Down
26 changes: 17 additions & 9 deletions cuckoo/data/analyzer/linux/analyzer.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Copyright (C) 2014-2016 Cuckoo Foundation.
# Copyright (C) 2015-2017 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.

Expand Down Expand Up @@ -35,12 +35,13 @@
def add_pids(pids):
"""Add PID."""
if not isinstance(pids, (tuple, list, set)):
pids = [pids,]
pids = [pids]

for pid in pids:
log.info("Added new process to list with pid: %s", pid)
pid = int(pid)
if not pid in SEEN_LIST: PROCESS_LIST.add(pid)
if pid not in SEEN_LIST:
PROCESS_LIST.add(pid)
SEEN_LIST.add(pid)

def dump_files():
Expand Down Expand Up @@ -283,17 +284,19 @@ def run(self):
except Exception as e:
log.warning("The package \"%s\" finish function raised an "
"exception: %s", package_name, e)

try:
# Upload files the package created to package_files in the results folder
package_files = pack.package_files()
if package_files != None:
if package_files is not None:
for package in package_files:
upload_to_host(package[0], os.path.join("package_files", package[1]));
upload_to_host(
package[0], os.path.join("package_files", package[1])
)
except Exception as e:
log.warning("The package \"%s\" package_files function raised an "
"exception: %s", package_name, e)

# Terminate the Auxiliary modules.
for aux in sorted(aux_enabled, key=lambda x: x.priority):
try:
Expand Down Expand Up @@ -370,5 +373,10 @@ def run(self):
server.complete(success, error, PATHS["root"])
except xmlrpclib.ProtocolError:
# new agent
data = { "status": "complete", "description": success }
urllib2.urlopen("http://127.0.0.1:8000/status", urllib.urlencode(data))
data = {
"status": "complete",
"description": success
}
urllib2.urlopen(
"http://127.0.0.1:8000/status", urllib.urlencode(data)
)
19 changes: 13 additions & 6 deletions cuckoo/machinery/qemu.py
Original file line number Diff line number Diff line change
Expand Up @@ -145,20 +145,27 @@ def start(self, label, task):
if vm_options.snapshot:
snapshot_path = vm_options.image
else:
snapshot_name = "snapshot_" + vm_info.name
snapshot_path = "%s/%s" % (os.path.dirname(vm_options.image), os.path.basename(snapshot_name)) + ".qcow2"
snapshot_path = os.path.join(
os.path.dirname(vm_options.image),
"snapshot_%s.qcow2" % vm_info.name
)
if os.path.exists(snapshot_path):
os.remove(snapshot_path)

# make sure we use a new harddisk layer by creating a new qcow2 with backing file
# make sure we use a new harddisk layer by creating a new
# qcow2 with backing file
try:
proc = subprocess.Popen([self.qemu_img, "create", "-f", "qcow2", "-b", vm_options.image, snapshot_path],
stdout=subprocess.PIPE, stderr=subprocess.PIPE)
proc = subprocess.Popen([
self.qemu_img, "create", "-f", "qcow2",
"-b", vm_options.image, snapshot_path
], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
output, err = proc.communicate()
if err:
raise OSError(err)
except OSError as e:
raise CuckooMachineError("QEMU failed starting the machine: %s" % e)
raise CuckooMachineError(
"QEMU failed starting the machine: %s" % e
)

vm_arch = getattr(vm_options, "arch", "default")
arch_config = dict(QEMU_ARGS[vm_arch])
Expand Down
15 changes: 7 additions & 8 deletions cuckoo/processing/platform/linux.py
Original file line number Diff line number Diff line change
@@ -1,15 +1,13 @@
# Copyright (C) 2010-2013 Claudio Guarnieri.
# Copyright (C) 2014-2016 Cuckoo Foundation.
# Copyright (C) 2015-2017 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.

import datetime
import dateutil.parser
import os
import logging
import datetime
import re

import dateutil.parser

from cuckoo.common.abstracts import BehaviorHandler

log = logging.getLogger(__name__)
Expand All @@ -32,7 +30,8 @@ def __nonzero__(self):
return True

class LinuxSystemTap(BehaviorHandler):
"""Parses systemtap generated plaintext logs (see stuff/systemtap/strace.stp)."""
"""Parses systemtap generated plaintext logs (see
stuff/systemtap/strace.stp)."""

key = "processes"

Expand Down Expand Up @@ -112,7 +111,7 @@ def __iter__(self):
dtms = datetime.timedelta(0, 0, int(datetimepart.split(".", 1)[1]))
dt = dateutil.parser.parse(datetimepart.split(".", 1)[0]) + dtms

parts = list()
parts = []
for delim in ("@", "[", "]", "(", ")", "= ", " (", ")"):
part, _, r = r.strip().partition(delim)
parts.append(part)
Expand Down Expand Up @@ -162,4 +161,4 @@ def is_array(self, arg):
return arg.startswith("[") and not arg.startswith("[/*")

def is_string(self, arg):
return arg.startswith("\"") and arg.endswith("\"")
return arg.startswith("\"") and arg.endswith("\"")
59 changes: 34 additions & 25 deletions cuckoo/processing/static.py
Original file line number Diff line number Diff line change
Expand Up @@ -37,20 +37,20 @@
from cuckoo.compat import magic
from cuckoo.misc import cwd, dispatch, Structure

from elftools.elf.elffile import ELFFile
from elftools.elf.constants import E_FLAGS
from elftools.elf.enums import ENUM_D_TAG
from elftools.elf.dynamic import DynamicSection
from elftools.elf.relocation import RelocationSection
from elftools.elf.sections import SymbolTableSection
from elftools.elf.segments import NoteSegment
from elftools.elf.descriptions import (
describe_ei_class, describe_ei_data, describe_ei_version,
describe_ei_osabi, describe_e_type, describe_e_machine,
describe_e_version_numeric, describe_p_type, describe_p_flags,
describe_sh_type, describe_dyn_tag, describe_symbol_type,
describe_symbol_bind, describe_note, describe_reloc_type
)
from elftools.elf.dynamic import DynamicSection
from elftools.elf.elffile import ELFFile
from elftools.elf.enums import ENUM_D_TAG
from elftools.elf.relocation import RelocationSection
from elftools.elf.sections import SymbolTableSection
from elftools.elf.segments import NoteSegment

log = logging.getLogger(__name__)

Expand Down Expand Up @@ -752,10 +752,6 @@ def run(self):
extra, ret["icon"] = self.read_string16(extra)
return ret

def _pdf_worker(filepath):
return PdfDocument(filepath).run()


class ELF(object):
def __init__(self, file_path):
self.file_path = file_path
Expand All @@ -772,8 +768,7 @@ def run(self):
self.result["symbol_tables"] = self._get_symbol_tables()
self.result["relocations"] = self._get_relocations()
self.result["notes"] = self._get_notes()
# TODO: add library name per import
# https://github.com/cuckoosandbox/cuckoo/pull/807/files#diff-033aeda7c00b458591305630264df6d3R604
# TODO: add library name per import (see #807)
except Exception as e:
log.exception(e)

Expand Down Expand Up @@ -802,7 +797,7 @@ def _get_file_header(self):
"number_of_program_headers": self.elf.header["e_phnum"],
"size_of_section_headers": self.elf.header["e_shentsize"],
"number_of_section_headers": self.elf.header["e_shnum"],
"section_header_string_table_index": self.elf.header["e_shstrndx"]
"section_header_string_table_index": self.elf.header["e_shstrndx"],
}

def _get_section_headers(self):
Expand All @@ -812,7 +807,7 @@ def _get_section_headers(self):
"name": section.name,
"type": describe_sh_type(section["sh_type"]),
"addr": self._print_addr(section["sh_addr"]),
"size": section["sh_size"]
"size": section["sh_size"],
})
return section_headers

Expand All @@ -823,36 +818,44 @@ def _get_program_headers(self):
"type": describe_p_type(segment["p_type"]),
"addr": self._print_addr(segment["p_vaddr"]),
"flags": describe_p_flags(segment["p_flags"]).strip(),
"size": segment["p_memsz"]
"size": segment["p_memsz"],
})
return program_headers

def _get_dynamic_tags(self):
dynamic_tags = []
for section in [section for section in self.elf.iter_sections() if isinstance(section, DynamicSection)]:
for section in self.elf.iter_sections():
if not isinstance(section, DynamicSection):
continue
for tag in section.iter_tags():
dynamic_tags.append({
"tag": self._print_addr(ENUM_D_TAG.get(tag.entry.d_tag, tag.entry.d_tag)),
"tag": self._print_addr(
ENUM_D_TAG.get(tag.entry.d_tag, tag.entry.d_tag)
),
"type": tag.entry.d_tag[3:],
"value": self._parse_tag(tag)
"value": self._parse_tag(tag),
})
return dynamic_tags

def _get_symbol_tables(self):
symbol_tables = []
for section in [section for section in self.elf.iter_sections() if isinstance(section, SymbolTableSection)]:
for section in self.elf.iter_sections():
if not isinstance(section, SymbolTableSection):
continue
for nsym, symbol in enumerate(section.iter_symbols()):
symbol_tables.append({
"value": self._print_addr(symbol["st_value"]),
"type": describe_symbol_type(symbol["st_info"]["type"]),
"bind": describe_symbol_bind(symbol["st_info"]["bind"]),
"ndx_name": symbol.name
"ndx_name": symbol.name,
})
return symbol_tables

def _get_relocations(self):
relocations = []
for section in [section for section in self.elf.iter_sections() if isinstance(section, RelocationSection)]:
for section in self.elf.iter_sections():
if not isinstance(section, RelocationSection):
continue
section_relocations = []
for rel in section.iter_relocations():
relocation = {
Expand Down Expand Up @@ -880,19 +883,23 @@ def _get_relocations(self):
if relocation not in section_relocations:
section_relocations.append(relocation)

relocations.append({"name": section.name, "entries": section_relocations})

relocations.append({
"name": section.name,
"entries": section_relocations,
})
return relocations

def _get_notes(self):
notes = []
for segment in [segment for segment in self.elf.iter_segments() if isinstance(segment, NoteSegment)]:
for segment in self.elf.iter_segments():
if not isinstance(segment, NoteSegment):
continue
for note in segment.iter_notes():
notes.append({
"owner": note["n_name"],
"size": self._print_addr(note["n_descsz"]),
"note": describe_note(note),
"name": note["n_name"]
"name": note["n_name"],
})
return notes

Expand Down Expand Up @@ -944,6 +951,8 @@ def _parse_tag(self, tag):

return parsed

def _pdf_worker(filepath):
return PdfDocument(filepath).run()

class Static(Processing):
"""Static analysis."""
Expand Down
7 changes: 3 additions & 4 deletions tests/test_config.py
Original file line number Diff line number Diff line change
Expand Up @@ -1104,13 +1104,12 @@ def test_migration_203_204():
)
for machinery in machineries:
Files.create(
cwd("conf"), "%s.conf" % machinery,
"[%s]\nmachines =" % machinery
cwd("conf"), "%s.conf" % machinery, "[%s]\nmachines =" % machinery
)
cfg = Config.from_confdir(cwd("conf"), loose=True)
cfg = migrate(cfg, "2.0.3", "2.0.4")
assert cfg['qemu']['ubuntu32']['enable_kvm'] is False
assert cfg['qemu']['ubuntu32']['snapshot'] is None
assert cfg["qemu"]["ubuntu32"]["enable_kvm"] is False
assert cfg["qemu"]["ubuntu32"]["snapshot"] is None

class FullMigration(object):
DIRPATH = None
Expand Down

0 comments on commit d39076b

Please sign in to comment.