[ { "path": ".codeclimate.yml", "content": "languages:\n Python: true\nexclude_paths:\n- \"tests/*\"\n" }, { "path": ".gitignore", "content": "# Ignore Database\ndb/cuckoo.db\n\n# Ignore logs\nlog/*.log\n\n# Ignore analyses\nstorage/*\n\n# Ignore Python byte code\n*.pyc\n\n# Ignore certificates\n*.pem\n*.cert\n\n# Ignore OS generated files\n.DS_Store*\n.AppleDouble\nehthumbs.db\nIcon?\nThumbs.db\n\n# Ignore development files\ndocs/book/src/_build/\n.idea/\n.project\n.pydevproject\n\n# Ignore Django secret_key\nweb/web/secret_key.py\n\n# Ignore yara rules\ndata/yara/index_*.yar\n\n# Ignore venv\nvenv\n\n# Ignore sample data\nsample_data/\n\n# Ignore Jupyter Notebook examples' checkpoints\nexamples/.ipynb_checkpoints\n/data/monitor/\n/modules/signatures/\n" }, { "path": ".travis.yml", "content": "branches:\n only:\n - master\nlanguage: python\npython:\n - 2.7\nbefore_install:\n - sudo apt-get update -qq\n - sudo apt-get install python-dev python-libvirt libffi-dev libssl-dev\n - wget http://downloads.sourceforge.net/project/ssdeep/ssdeep-2.12/ssdeep-2.12.tar.gz\n - tar -zxvf ssdeep-2.12.tar.gz\n - cd ssdeep-2.12\n - ./configure && make\n - sudo make install\n - cd ..\ninstall:\n - pip install -r requirements.txt\nscript:\n - python utils/community.py -wafb monitor\n - python cuckoo.py --debug --test\n #- nosetests\n" }, { "path": "LICENSE.txt", "content": "BSD 3-Clause License\n\nCopyright 2021-2024, Zhengyang Li. All Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" }, { "path": "README.md", "content": "```shell\n ____ _ _ _____ _ \n | __ ) ___ | | __| | | ___|_ _| | ___ ___ _ __ \n | _ \\ / _ \\| |/ _` |_____| |_ / _` | |/ __/ _ \\| '_ \\ \n | |_) | (_) | | (_| |_____| _| (_| | | (_| (_) | | | |\n |____/ \\___/|_|\\__,_| |_| \\__,_|_|\\___\\___/|_| |_|\n```\n\n\n\n# 毕方智能云沙箱\n\n毕方智能云沙箱(***Bold-Falcon***)是一个开源的自动化恶意软件分析系统。它用于自动运行和分析文件，并收集全面的分析结果，概述恶意软件在独立操作系统中运行时所做的工作。我们的工作是二次开发开源cuckoo沙箱，包括**更新项目结构**，**重写整个前端的用户交互**和**添加基于机器学习的检测模块**，\n使恶意软件分析系统可以**思考**。\n\n![](https://img.shields.io/badge/GitHub-Bold--Falcon-000000)\n\n**`说明文档`** https://powerlzy.github.io/Bold-Falcon/\n\n**`开发文档`** https://boldfalcon.readthedocs.io\n\n#### 下载源码\n\n```shell\n$ git clone https://github.com/PowerLZY/Bold-Falcon\n```\n\n#### 开源资料\n\n+ [cuckoo](https://github.com/cuckoosandbox/cuckoo) Cuckoo Sandbox is an automated dynamic malware analysis system\n+ [cuckoo-modified](https://github.com/spender-sandbox/cuckoo-modified) Modified edition of cuckoo\n+ [cuckooDroid](https://github.com/idanr1986/cuckoo-droid) CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.\n+ [docker-cuckoo](https://github.com/blacktop/docker-cuckoo) Cuckoo Sandbox Dockerfile\n+ [cuckooautoinstall](https://github.com/buguroo/cuckooautoinstall) Auto Installer Script for Cuckoo Sandbox\n+ [cuckooML](https://github.com/honeynet/cuckooml) CuckooML: Machine Learning for Cuckoo Sandbox\n+ [Panda-Sandbox](https://github.com/PowerLZY/Panda-Sandbox) Cuckoo python3 (Unfinished)\n+ [HaboMalHunter](https://github.com/Tencent/HaboMalHunter#readme_cn) HaboMalHunter is a sub-project of Habo Malware Analysis System\n+ [cuckoosegg](https://github.com/chrisante/cuckoosegg)\n\n#### 源码分析\n+ [cuckoo技术分析全景图](https://cloud.tencent.com/developer/article/1597020)\n+ [cuckoo沙箱源码分析上](https://bbs.pediy.com/thread-260038.htm)\n+ [cuckoo沙箱源码分析中](https://bbs.pediy.com/thread-260087.htm)\n+ [cuckoo沙箱源码分析后](https://bbs.pediy.com/thread-260252.htm)\n+ [腾讯哈勃Linux沙箱源码分析上](https://zhuanlan.zhihu.com/p/54756592)\n+ [腾讯哈勃Linux沙箱源码分析下](https://zhuanlan.zhihu.com/p/54756845)\n\n### 开源样本\n\n如果你想要获取更多的`恶意样本`请访问查询：\n\n**推荐：**\n\n- [Blue Hexagon Open Dataset for Malware AnalysiS (BODMAS)](https://whyisyoung.github.io/BODMAS/)\n- [EMBER](https://github.com/elastic/ember) - Endgame Malware BEnchmark for Research\n- [Malware Training Sets: A machine learning dataset for everyone](http://marcoramilli.blogspot.cz/2016/12/malware-training-sets-machine-learning.html) ([data](https://github.com/marcoramilli/MalwareTrainingSets))\n- [SoReL-20M](https://github.com/sophos-ai/SOREL-20M) - Sophos-ReversingLabs 20 Million dataset.\n- [Virusshare](https://virusshare.com/)\n\n**其他：**\n\n+ [Samples of Security Related Dats](http://www.secrepo.com/)\n+ [DARPA Intrusion Detection Data Sets](https://www.ll.mit.edu/ideval/data/)\n+ [Stratosphere IPS Data Sets](https://stratosphereips.org/category/dataset.html)\n+ [Open Data Sets](http://csr.lanl.gov/data/)\n+ [Data Capture from National Security Agency](http://www.westpoint.edu/crc/SitePages/DataSets.aspx)\n+ [The ADFA Intrusion Detection Data Sets](https://www.unsw.adfa.edu.au/australian-centre-for-cyber-security/cybersecurity/ADFA-IDS-Datasets)\n+ [NSL-KDD Data Sets](https://github.com/defcom17/NSL_KDD)\n+ [Malicious URLs Data Sets](https://sysnet.ucsd.edu/projects/url)\n+ [Multi-Source Cyber-Security Events](http://csr.lanl.gov/data/cyber1/)\n+ [Malware Training Sets: A machine learning dataset for everyone](http://marcoramilli.blogspot.cz/2016/12/malware-training-sets-machine-learning.html)\n\n如果你想要获取更多的`良性样本`请在如下等网络自行爬取：\n\n- [portablefreeware](http://www.portablefreeware.com/)\n- [onlyfreewares](http://www.onlyfreewares.com/)\n- [snapfiles](https://www.snapfiles.com/new/list-whatsnew.html)\n- [downloadcrew](https://downloadcrew.com/)\n- [chocolatey](https://chocolatey.org/)\n\n#### 项目结构更新\n - [x] 整理工程目录打包lib：（common，core），Modules（辅助功能、虚拟机、处理、签名、机器学习模型检测）\n - [x] 省略\\CWD目录：添加 analyzer、db、examples、Mal_sample、sample_data、storage、log等目录\n\n#### 最近更新\n\n+ 学习内容\n - [x] [预训练TF-IDF模型加载优化 100s -> 2s](https://thiagomarzagao.com/2015/12/08/saving-TfidfVectorizer-without-pickles/)\n - [ ] Linux沙箱及检测方案\n - [ ] ATT&CK Navigator layer for Cuckoo's TTPs.pyattack\n - [ ] 添加 《Dynamic Malware Analysis with Feature Engineering and Feature Learning》 动态分析检测模型\n - [ ] 添加 MaliciousMacroBot（mmbot）office宏病毒检测方案\n\n+ 设计文档\n + [x] 参考文献记录（设计依据）\n + [x] 国内沙箱深度调研\n + [x] 图标+起名\n\n+ 家族签名模块\n - [x] [cuckoo 社区签名库](https://github.com/cuckoosandbox/community)\n - [x] [cuckoo的行为签名](https://www.secpulse.com/archives/75180.html)\n - [ ] 添加挖矿+使用自定义签名\n+ 机器学习模块\n - [x] 数据集：kaggle microsoft 10000个软件、挖矿软件 6000个；\n - [x] 报告显示内容：模型检测图展示、使用特征展示、预测威胁得分；\n - [x] 静态检测引擎：string、malconv；\n - [x] 动态检测引擎：API调用序列；\n - [x] 定义基类Dectection、Instance等；\n - [x] 添加Smaple——malware，200个json report样本；\n - [ ] 添加 《Dynamic Malware Analysis with Feature Engineering and Feature Learning》 动态分析检测模型\n+ 后期需求\n + [ ] 环境打包，Docker\\shells安装\n + [ ] blog解析文档编写\n + [ ] 虚拟机管理：libvirt+高并发虚拟机\n + [ ] 沙箱内存管理：MemScrimper: Time- and Space-Efficient Storage of *Malware* Sandbox Memory Dumps （2018 DIVMA）\n + [ ] 3.3.5 REST API(Cuckoo docs) wsgi应用程序\n#### 常见问题\n+ Machine * status gurumeditation\n - 找到虚拟机安装目录下VBox.log日志文件\n - 在日志文件中找到ProcessID, ```kill - 9 ProcessID```\n+ python 2/3 joblib.dump() 和 joblib.load()\n - 不同python版本的pickle.dump()和pickle.load()是可以相互转换和支持的\n - 在python3中，您应该使用较低的协议号来编写pickle数据 ```pickle.dump(your_object, your_file, protocol=2)```\n+ Pytorch Cpu 导入 Gpu 训练的模型\n - `model.load(model_path, map_location='cpu')`\n+ Sphinx-readthedocs 开发文档自动生成\n - `sphinx-quickstart`\n - `sphinx-apidoc -o ./source ../Bold-Falcon`\n - `python -m sphinx -T -E -b html -d _build/doctrees -D language=en . _build/html`\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n" }, { "path": "__init__.py", "content": "name = \"1111ScorecardBundle\"\n" }, { "path": "_config.yml", "content": "theme: jekyll-theme-cayman\n" }, { "path": "agent/agent.py", "content": "# Copyright (C) 2010-2013 Claudio Guarnieri.\n# Copyright (C) 2014-2018 Cuckoo Foundation.\n# Copyright (C) 2020-2021 PowerLZY.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n\nimport os\nimport sys\nimport time\nimport socket\nimport string\nimport random\nimport platform\nimport subprocess\nimport ConfigParser\nfrom StringIO import StringIO\nfrom zipfile import ZipFile\nfrom SimpleXMLRPCServer import SimpleXMLRPCServer\n\nBIND_IP = \"0.0.0.0\"\nBIND_PORT = 8000\n\nSTATUS_INIT = 0x0001\nSTATUS_RUNNING = 0x0002\nSTATUS_COMPLETED = 0x0003\nSTATUS_FAILED = 0x0004\n\nclass Agent(object):\n \"\"\"\n Bold-Falcon agent, it runs inside guest.\n\n :param system: platform\n :param analyzer_path: analyzer path\n :param int analyzer_pid: analyzer pid\n :param error_message: None\n :param current_status: STATUS_INIT = 0x0001,STATUS_RUNNING = 0x0002,STATUS_COMPLETED = 0x0003,STATUS_FAILED = 0x0004\n :param analyzer_folder: upload analyzer folder\n :param results_folder: results folder\n \"\"\"\n\n def __init__(self):\n\n self.system = platform.system().lower()\n self.analyzer_path = \"\"\n self.analyzer_pid = 0\n\n self.error_message = None\n self.current_status = STATUS_INIT\n self.analyzer_folder = \"\"\n self.results_folder = \"\"\n\n def _initialize(self):\n '''\n initialize agent.py\n '''\n if not self.analyzer_folder:\n random.seed(time.time())\n container = \"\".join(random.choice(string.ascii_lowercase) for x in range(random.randint(5, 10)))\n\n if self.system == \"windows\":\n system_drive = os.environ[\"SYSTEMDRIVE\"] + os.sep\n self.analyzer_folder = os.path.join(system_drive, container)\n elif self.system == \"linux\" or self.system == \"darwin\":\n self.analyzer_folder = \\\n os.path.join(os.environ.get(\"HOME\", os.environ.get(\"PWD\", \"/tmp\")), container)\n else:\n self.error_message = \"Unable to identify operating system\"\n return False\n\n try:\n os.makedirs(self.analyzer_folder)\n except OSError as e:\n self.error_message = e\n return False\n\n return True\n\n def get_status(self):\n \"\"\"\n Get current status.\n\n :return: status.\n \"\"\"\n return self.current_status\n\n def get_error(self):\n \"\"\"\n Get error message\n\n :return: error message.\n \"\"\"\n return str(self.error_message)\n\n def add_malware(self, data, name):\n \"\"\"\n Get analysis data.\n\n :param data: analysis data.\n :param name: file name.\n :return: operation status.\n \"\"\"\n data = data.data\n\n if self.system == \"windows\":\n root = os.environ[\"TEMP\"]\n elif self.system == \"linux\" or self.system == \"darwin\":\n root = \"/tmp\"\n else:\n self.error_message = \\\n \"Unable to write malware to disk because the operating \" \\\n \"system could not be identified.\"\n return False\n\n file_path = os.path.join(root, name)\n\n try:\n with open(file_path, \"wb\") as sample:\n sample.write(data)\n except IOError as e:\n self.error_message = \\\n \"Unable to write sample to disk: {0}\".format(e)\n return False\n\n return True\n\n def add_config(self, options):\n \"\"\"\n Creates analysis.conf file from current analysis options.\n\n :param options: current configuration options, dict format.\n :return: operation status.\n \"\"\"\n if not isinstance(options, dict):\n return False\n\n config = ConfigParser.RawConfigParser()\n config.add_section(\"analysis\")\n\n try:\n for key, value in options.items():\n # Options can be UTF encoded.\n if isinstance(value, basestring):\n try:\n value = value.encode(\"utf-8\")\n except UnicodeEncodeError:\n pass\n\n config.set(\"analysis\", key, value)\n\n config_path = os.path.join(self.analyzer_folder, \"analysis.conf\")\n\n with open(config_path, \"wb\") as config_file:\n config.write(config_file)\n except Exception as e:\n self.error_message = e\n return False\n\n return True\n\n def add_analyzer(self, data):\n \"\"\"Add analyzer.\n\n :param data: analyzer data.\n :return: operation status.\n \"\"\"\n data = data.data\n\n if not self._initialize():\n return False\n\n try:\n zip_data = StringIO()\n zip_data.write(data)\n\n with ZipFile(zip_data, \"r\") as archive:\n archive.extractall(self.analyzer_folder)\n finally:\n zip_data.close()\n\n self.analyzer_path = os.path.join(self.analyzer_folder, \"analyzer.py\")\n return True\n\n def execute(self):\n \"\"\"\n Execute analysis.\n\n :return: analyzer PID.\n \"\"\"\n if not self.analyzer_path or not os.path.exists(self.analyzer_path):\n return False\n\n try:\n proc = subprocess.Popen([sys.executable, self.analyzer_path],\n cwd=os.path.dirname(self.analyzer_path))\n self.analyzer_pid = proc.pid\n except OSError as e:\n self.error_message = e\n return False\n\n self.current_status = STATUS_RUNNING\n return self.analyzer_pid\n\n def complete(self, success=True, error=\"\", results=\"\"):\n \"\"\"\n Complete analysis.\n\n :param success: success status.\n :param error: error status.\n \"\"\"\n if success:\n self.current_status = STATUS_COMPLETED\n else:\n self.current_status = STATUS_FAILED\n\n if error:\n self.error_message = error\n\n self.results_folder = results\n return True\n\nif __name__ == \"__main__\":\n try:\n if not BIND_IP:\n BIND_IP = socket.gethostbyname(socket.gethostname())\n\n print(\"[+] Starting agent on %s:%s ...\" % (BIND_IP, BIND_PORT))\n\n # Disable DNS lookup, by Scott D.\n def FakeGetFQDN(name=\"\"):\n return name\n\n socket.getfqdn = FakeGetFQDN\n\n server = SimpleXMLRPCServer((BIND_IP, BIND_PORT), allow_none=True)\n server.register_instance(Agent())\n server.serve_forever()\n except KeyboardInterrupt:\n server.shutdown()\n" }, { "path": "agent/agent.sh", "content": "#!/bin/bash\n# Copyright (C) 2010-2013 Claudio Guarnieri.\n# Copyright (C) 2014-2016 Cuckoo Foundation.\n# Copyright (C) 2020-2021 PowerLZY.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n\nFILEPATH=$(readlink -f ${0%})\nFILEPATHDIR=$(dirname $FILEPATH)\n\ncd /tmp/\npython $FILEPATHDIR/agent.py >$FILEPATHDIR/agent.stdout 2>$FILEPATHDIR/agent.stderr &\n\n" }, { "path": "analyzer/android/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n" }, { "path": "analyzer/android/analyzer.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport os\nimport logging\nimport pkgutil\nimport shutil\nimport sys\nimport xmlrpclib\nimport time\n\nfrom lib.core.packages import choose_package\nfrom lib.common.exceptions import CuckooError, CuckooPackageError\nfrom lib.common.abstracts import Package, Auxiliary\nfrom lib.common.constants import PATHS\nfrom lib.core.config import Config\nfrom lib.core.startup import init_logging\nfrom modules import auxiliary\n\nlogging.disable(level=logging.DEBUG)\nlog = logging.getLogger()\n\nclass Analyzer(object):\n def __init__(self):\n self.config = None\n self.target = None\n\n def complete(self):\n \"\"\"End analysis.\"\"\"\n log.info(\"Analysis completed\")\n\n def get_options(self):\n \"\"\"Get analysis options.\n @return: options dict.\n \"\"\"\n # The analysis package can be provided with some options in the\n # following format:\n # option1=value1,option2=value2,option3=value3\n #\n # Here we parse such options and provide a dictionary that will be made\n # accessible to the analysis package.\n options = {}\n if self.config.options:\n try:\n # Split the options by comma.\n fields = self.config.options.strip().split(\",\")\n except ValueError as e:\n log.warning(\"Failed parsing the options: %s\", e)\n else:\n for field in fields:\n # Split the name and the value of the option.\n try:\n key, value = field.strip().split(\"=\")\n except ValueError as e:\n log.warning(\"Failed parsing option (%s): %s\", field, e)\n else:\n # If the parsing went good, we add the option to the\n # dictionary.\n options[key.strip()] = value.strip()\n\n return options\n\n def prepare(self):\n # Initialize logging.\n init_logging()\n\n # Parse the analysis configuration file generated by the agent.\n self.config = Config(cfg=\"analysis.conf\")\n\n # We update the target according to its category. If it's a file, then\n # we store the path.\n if self.config.category == \"file\":\n self.target = os.path.join(\"/data/local/tmp\", str(self.config.file_name))\n shutil.copyfile(\"config/hooks.json\", \"/data/local/tmp/hooks.json\")\n # If it's a URL, well.. we store the URL.\n else:\n self.target = self.config.target\n\n def run(self):\n self.prepare()\n\n log.info(\"Starting analyzer from: {0}\".format(os.getcwd()))\n log.info(\"Storing results at: {0}\".format(PATHS[\"root\"]))\n log.info(\"Target is: {0}\".format(self.target))\n\n # If no analysis package was specified at submission, we try to select\n # one automatically.\n if not self.config.package:\n log.info(\"No analysis package specified, trying to detect it automagically\")\n # If the analysis target is a file, we choose the package according\n # to the file format.\n if self.config.category == \"file\":\n package = choose_package(self.config.file_type, self.config.file_name)\n # If it's an URL, we'll just use the default Internet Explorer\n # package.\n else:\n package = \"default_browser\"\n\n # If we weren't able to automatically determine the proper package,\n # we need to abort the analysis.\n if not package:\n raise CuckooError(\"No valid package available for file type: {0}\".format(self.config.file_type))\n\n log.info(\"Automatically selected analysis package \\\"%s\\\"\", package)\n # Otherwise just select the specified package.\n else:\n package = self.config.package\n\n # Generate the package path.\n package_name = \"modules.packages.%s\" % package\n\n # Try to import the analysis package.\n try:\n __import__(package_name, globals(), locals(), [\"dummy\"], -1)\n # If it fails, we need to abort the analysis.\n except ImportError:\n raise CuckooError(\"Unable to import package \\\"{0}\\\", does not exist.\".format(package_name))\n\n # Initialize the package parent abstract.\n Package()\n\n # Enumerate the abstract's subclasses.\n try:\n package_class = Package.__subclasses__()[0]\n except IndexError as e:\n raise CuckooError(\"Unable to select package class (package={0}): {1}\".format(package_name, e))\n\n # Initialize the analysis package.\n pack = package_class(self.get_options())\n\n # Initialize Auxiliary modules\n Auxiliary()\n prefix = auxiliary.__name__ + \".\"\n for loader, name, ispkg in pkgutil.iter_modules(auxiliary.__path__, prefix):\n if ispkg:\n continue\n\n # Import the auxiliary module.\n try:\n __import__(name, globals(), locals(), [\"dummy\"], -1)\n except ImportError as e:\n log.warning(\"Unable to import the auxiliary module \"\n \"\\\"%s\\\": %s\", name, e)\n\n # Walk through the available auxiliary modules.\n aux_enabled = []\n for module in Auxiliary.__subclasses__():\n # Try to start the auxiliary module.\n try:\n aux = module()\n aux.start()\n except (NotImplementedError, AttributeError):\n log.warning(\"Auxiliary module %s was not implemented\",\n aux.__class__.__name__)\n continue\n except Exception as e:\n log.warning(\"Cannot execute auxiliary module %s: %s\",\n aux.__class__.__name__, e)\n continue\n finally:\n log.info(\"Started auxiliary module %s\",\n aux.__class__.__name__)\n aux_enabled.append(aux)\n\n # Start analysis package. If for any reason, the execution of the\n # analysis package fails, we have to abort the analysis.\n try:\n pack.start(self.target)\n except NotImplementedError:\n raise CuckooError(\"The package \\\"{0}\\\" doesn't contain a run \"\n \"function.\".format(package_name))\n except CuckooPackageError as e:\n raise CuckooError(\"The package \\\"{0}\\\" start function raised an \"\n \"error: {1}\".format(package_name, e))\n except Exception as e:\n raise CuckooError(\"The package \\\"{0}\\\" start function encountered \"\n \"an unhandled exception: \"\n \"{1}\".format(package_name, e))\n\n time_counter = 0\n while True:\n time_counter += 1\n if time_counter == int(self.config.timeout):\n log.info(\"Analysis timeout hit, terminating analysis\")\n break\n\n try:\n # The analysis packages are provided with a function that\n # is executed at every loop's iteration. If such function\n # returns False, it means that it requested the analysis\n # to be terminate.\n if not pack.check():\n log.info(\"The analysis package requested the \"\n \"termination of the analysis...\")\n break\n\n # If the check() function of the package raised some exception\n # we don't care, we can still proceed with the analysis but we\n # throw a warning.\n except Exception as e:\n log.warning(\"The package \\\"%s\\\" check function raised \"\n \"an exception: %s\", package_name, e)\n finally:\n # Zzz.\n time.sleep(1)\n\n try:\n # Before shutting down the analysis, the package can perform some\n # final operations through the finish() function.\n pack.finish()\n except Exception as e:\n log.warning(\"The package \\\"%s\\\" finish function raised an \"\n \"exception: %s\", package_name, e)\n\n # Terminate the Auxiliary modules.\n for aux in aux_enabled:\n try:\n aux.stop()\n except (NotImplementedError, AttributeError):\n continue\n except Exception as e:\n log.warning(\"Cannot terminate auxiliary module %s: %s\",\n aux.__class__.__name__, e)\n\n # Let's invoke the completion procedure.\n self.complete()\n return True\n\nif __name__ == \"__main__\":\n success = False\n error = \"\"\n\n try:\n # Initialize the main analyzer class.\n analyzer = Analyzer()\n # Run it and wait for the response.\n success = analyzer.run()\n # This is not likely to happen.\n except KeyboardInterrupt:\n error = \"Keyboard Interrupt\"\n # If the analysis process encountered a critical error, it will raise a\n # CuckooError exception, which will force the termination of the analysis\n # weill notify the agent of the failure. Also catched unexpected\n # exceptions.\n except Exception as e:\n # Store the error.\n error = str(e)\n\n # Just to be paranoid.\n if len(log.handlers) > 0:\n log.critical(error)\n else:\n sys.stderr.write(\"{0}\\n\".format(e))\n # Once the analysis is completed or terminated for any reason, we report\n # back to the agent, notifying that it can report back to the host.\n finally:\n # Establish connection with the agent XMLRPC server.\n server = xmlrpclib.Server(\"http://127.0.0.1:8000\")\n server.complete(success, error, PATHS[\"root\"])\n" }, { "path": "analyzer/android/config/hooks.json", "content": "{\n \"hookConfigs\": [\n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getDeviceId\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getSubscriberId\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getLine1Number\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getNetworkOperator\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getNetworkOperatorName\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getSimOperatorName\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.net.wifi.WifiInfo\", \n \"method\": \"getMacAddress\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getSimCountryIso\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getSimSerialNumber\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getNetworkCountryIso\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"getDeviceSoftwareVersion\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.os.Debug\", \n \"method\": \"isDebuggerConnected\", \n \"thisObject\": false, \n \"type\": \"fingerprint\"\n }, \n {\n \"class_name\": \"android.app.SharedPreferencesImpl$EditorImpl\", \n \"method\": \"putString\", \n \"thisObject\": false, \n \"type\": \"globals\"\n }, \n {\n \"class_name\": \"android.app.SharedPreferencesImpl$EditorImpl\", \n \"method\": \"putBoolean\", \n \"thisObject\": false, \n \"type\": \"globals\"\n }, \n {\n \"class_name\": \"android.app.SharedPreferencesImpl$EditorImpl\", \n \"method\": \"putInt\", \n \"thisObject\": false, \n \"type\": \"globals\"\n }, \n {\n \"class_name\": \"android.app.SharedPreferencesImpl$EditorImpl\", \n \"method\": \"putLong\", \n \"thisObject\": false, \n \"type\": \"globals\"\n }, \n {\n \"class_name\": \"android.app.SharedPreferencesImpl$EditorImpl\", \n \"method\": \"putFloat\", \n \"thisObject\": false, \n \"type\": \"globals\"\n }, \n {\n \"class_name\": \"android.content.ContentValues\", \n \"method\": \"put\", \n \"thisObject\": false, \n \"type\": \"globals\"\n }, \n {\n \"class_name\": \"java.net.URL\", \n \"method\": \"openConnection\", \n \"thisObject\": true, \n \"type\": \"network\"\n }, \n {\n \"class_name\": \"org.apache.http.impl.client.AbstractHttpClient\", \n \"method\": \"execute\", \n \"thisObject\": false, \n \"type\": \"network\"\n }, \n {\n \"class_name\": \"android.app.ContextImpl\", \n \"method\": \"registerReceiver\", \n \"thisObject\": false, \n \"type\": \"binder\"\n }, \n {\n \"class_name\": \"android.app.ActivityThread\", \n \"method\": \"handleReceiver\", \n \"thisObject\": false, \n \"type\": \"binder\"\n }, \n {\n \"class_name\": \"android.app.Activity\", \n \"method\": \"startActivity\", \n \"thisObject\": false, \n \"type\": \"binder\"\n }, \n {\n \"class_name\": \"dalvik.system.BaseDexClassLoader\", \n \"method\": \"findResource\", \n \"thisObject\": false, \n \"type\": \"dex\"\n }, \n {\n \"class_name\": \"dalvik.system.BaseDexClassLoader\", \n \"method\": \"findLibrary\", \n \"thisObject\": false, \n \"type\": \"dex\"\n }, \n {\n \"class_name\": \"dalvik.system.DexFile\", \n \"method\": \"loadDex\", \n \"thisObject\": false, \n \"type\": \"dex\"\n }, \n {\n \"class_name\": \"dalvik.system.DexClassLoader\", \n \"method\": null, \n \"thisObject\": false, \n \"type\": \"dex\"\n }, \n {\n \"class_name\": \"dalvik.system.BaseDexClassLoader\", \n \"method\": \"findResources\", \n \"thisObject\": false, \n \"type\": \"dex\"\n }, \n {\n \"class_name\": \"dalvik.system.DexFile\", \n \"method\": \"loadClass\", \n \"thisObject\": false, \n \"type\": \"dex\"\n }, \n {\n \"class_name\": \"dalvik.system.DexFile\", \n \"method\": null, \n \"thisObject\": false, \n \"type\": \"dex\"\n }, \n {\n \"class_name\": \"dalvik.system.PathClassLoader\", \n \"method\": null, \n \"thisObject\": false, \n \"type\": \"dex\"\n }, \n {\n \"class_name\": \"java.lang.reflect.Method\", \n \"method\": \"invoke\", \n \"thisObject\": false, \n \"type\": \"reflection\"\n }, \n {\n \"class_name\": \"javax.crypto.spec.SecretKeySpec\", \n \"method\": null, \n \"thisObject\": false, \n \"type\": \"crypto\"\n }, \n {\n \"class_name\": \"javax.crypto.Cipher\", \n \"method\": \"doFinal\", \n \"thisObject\": true, \n \"type\": \"crypto\"\n }, \n {\n \"class_name\": \"javax.crypto.Mac\", \n \"method\": \"doFinal\", \n \"thisObject\": false, \n \"type\": \"crypto\"\n }, \n {\n \"class_name\": \"android.app.ApplicationPackageManager\", \n \"method\": \"setComponentEnabledSetting\", \n \"thisObject\": false, \n \"type\": \"generic\"\n }, \n {\n \"class_name\": \"android.app.NotificationManager\", \n \"method\": \"notify\", \n \"thisObject\": false, \n \"type\": \"generic\"\n }, \n {\n \"class_name\": \"android.util.Base64\", \n \"method\": \"decode\", \n \"thisObject\": false, \n \"type\": \"generic\"\n }, \n {\n \"class_name\": \"android.telephony.TelephonyManager\", \n \"method\": \"listen\", \n \"thisObject\": false, \n \"type\": \"generic\"\n }, \n {\n \"class_name\": \"android.util.Base64\", \n \"method\": \"encode\", \n \"thisObject\": false, \n \"type\": \"generic\"\n }, \n {\n \"class_name\": \"android.util.Base64\", \n \"method\": \"encodeToString\", \n \"thisObject\": false, \n \"type\": \"generic\"\n }, \n {\n \"class_name\": \"android.net.ConnectivityManager\", \n \"method\": \"setMobileDataEnabled\", \n \"thisObject\": false, \n \"type\": \"generic\"\n }, \n {\n \"class_name\": \"android.content.BroadcastReceiver\", \n \"method\": \"abortBroadcast\", \n \"thisObject\": false, \n \"type\": \"generic\"\n }, \n {\n \"class_name\": \"android.telephony.SmsManager\", \n \"method\": \"sendTextMessage\", \n \"thisObject\": false, \n \"type\": \"sms\"\n }, \n {\n \"class_name\": \"android.telephony.SmsManager\", \n \"method\": \"sendMultipartTextMessage\", \n \"thisObject\": false, \n \"type\": \"sms\"\n }, \n {\n \"class_name\": \"java.lang.Runtime\", \n \"method\": \"exec\", \n \"thisObject\": false, \n \"type\": \"runtime\"\n }, \n {\n \"class_name\": \"java.lang.ProcessBuilder\", \n \"method\": \"start\", \n \"thisObject\": true, \n \"type\": \"runtime\"\n }, \n {\n \"class_name\": \"java.io.FileOutputStream\", \n \"method\": \"write\", \n \"thisObject\": false, \n \"type\": \"runtime\"\n }, \n {\n \"class_name\": \"java.io.FileInputStream\", \n \"method\": \"read\", \n \"thisObject\": false, \n \"type\": \"runtime\"\n }, \n {\n \"class_name\": \"android.app.ActivityManager\", \n \"method\": \"killBackgroundProcesses\", \n \"thisObject\": false, \n \"type\": \"runtime\"\n }, \n {\n \"class_name\": \"android.os.Process\", \n \"method\": \"killProcess\", \n \"thisObject\": false, \n \"type\": \"runtime\"\n }, \n {\n \"class_name\": \"android.content.ContentResolver\", \n \"method\": \"query\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.content.ContentResolver\", \n \"method\": \"registerContentObserver\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.content.ContentResolver\", \n \"method\": \"insert\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.accounts.AccountManager\", \n \"method\": \"getAccountsByType\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.accounts.AccountManager\", \n \"method\": \"getAccounts\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.location.Location\", \n \"method\": \"getLatitude\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.location.Location\", \n \"method\": \"getLongitude\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.content.ContentResolver\", \n \"method\": \"delete\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.media.AudioRecord\", \n \"method\": \"startRecording\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.media.MediaRecorder\", \n \"method\": \"start\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.os.SystemProperties\", \n \"method\": \"get\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"android.app.ApplicationPackageManager\", \n \"method\": \"getInstalledPackages\", \n \"thisObject\": false, \n \"type\": \"content\"\n }, \n {\n \"class_name\": \"libcore.io.IoBridge\", \n \"method\": \"open\", \n \"thisObject\": false, \n \"type\": \"file\"\n }\n ], \n \"trace\": false\n}" }, { "path": "analyzer/android/lib/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n" }, { "path": "analyzer/android/lib/api/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n" }, { "path": "analyzer/android/lib/api/adb.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport logging\nimport os\nimport subprocess\n\nfrom lib.common.utils import send_file\n\nlog = logging.getLogger(__name__)\n\ndef install_sample(path):\n \"\"\"Install the sample on the emulator via adb\"\"\"\n log.info(\"Installing sample in the device: %s\", path)\n try:\n args = [\"/system/bin/sh\", \"/system/bin/pm\", \"install\", path]\n output = subprocess.check_output(args)\n except subprocess.CalledProcessError as e:\n log.error(\"Error installing sample: %r\", e)\n return\n\n log.info(\"Installed sample: %r\", output)\n\ndef execute_sample(package, activity):\n \"\"\"Execute the sample on the emulator via adb\"\"\"\n try:\n package_activity = \"%s/%s\" % (package, activity)\n args = [\n \"/system/bin/sh\", \"/system/bin/am\", \"start\",\n \"-n\", package_activity,\n ]\n output = subprocess.check_output(args)\n except subprocess.CalledProcessError as e:\n log.error(\"Error executing package activity: %r\", e)\n return\n\n log.info(\"Executed package activity: %r\", output)\n\ndef dump_droidmon_logs(package):\n xposed_logs = \"/data/data/de.robv.android.xposed.installer/log/error.log\"\n if not os.path.exists(xposed_logs):\n log.info(\"Could not find any Xposed logs, skipping droidmon logs.\")\n return\n\n tag = \"Droidmon-apimonitor-%s\" % package\n tag_error = \"Droidmon-shell-%s\" % package\n\n log_xposed, log_success, log_error = [], [], []\n\n for line in open(xposed_logs, \"rb\"):\n if tag in line:\n log_success.append(line.split(\":\", 1)[1])\n\n if tag_error in line:\n log_error.append(line.split(\":\", 1)[1])\n\n log_xposed.append(line)\n\n send_file(\"logs/xposed.log\", \"\\n\".join(log_xposed))\n send_file(\"logs/droidmon.log\", \"\\n\".join(log_success))\n send_file(\"logs/droidmon_error.log\", \"\\n\".join(log_error))\n\ndef execute_browser(url):\n \"\"\"Start URL intent on the emulator.\"\"\"\n try:\n args = [\n \"/system/bin/sh\", \"/system/bin/am\", \"start\",\n \"-a\", \"android.intent.action.VIEW\",\n \"-d\", url,\n ]\n output = subprocess.check_output(args)\n except subprocess.CalledProcessError as e:\n log.error(\"Error starting browser intent: %r\", e)\n return\n\n log.info(\"Intent returned: %r\", output)\n\ndef take_screenshot(filename):\n try:\n subprocess.check_output([\"/system/bin/screencap\", \"-p\",\n \"/sdcard/%s\" % filename])\n except subprocess.CalledProcessError as e:\n log.error(\"Error creating screenshot: %r\", e)\n return\n\n return \"/sdcard/%s\" % filename\n" }, { "path": "analyzer/android/lib/api/screenshot.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport math\nimport filecmp\n\ntry:\n import ImageChops\n from PIL import Image\n HAVE_PIL = True\nexcept:\n try:\n from PIL import ImageChops\n from PIL import Image\n HAVE_PIL = True\n except:\n HAVE_PIL = False\n\nclass Screenshot:\n \"\"\"Get screenshots.\"\"\"\n\n def have_pil(self):\n \"\"\"Is Python Image Library installed?\n @return: installed status.\n \"\"\"\n return HAVE_PIL\n\n def equal_old(self, img1, img2):\n \"\"\"Compares two screenshots using Root-Mean-Square Difference (RMS).\n @param img1: screenshot to compare.\n @param img2: screenshot to compare.\n @return: equal status.\n \"\"\"\n if not HAVE_PIL:\n return None\n image1 = Image.open(img1)\n image2 = Image.open(img2)\n # To get a measure of how similar two images are, we use\n # root-mean-square (RMS). If the images are exactly identical,\n # this value is zero.\n diff = ImageChops.difference(image1, image2)\n h = diff.histogram()\n sq = (value*((idx % 256)**2) for idx, value in enumerate(h))\n sum_of_squares = sum(sq)\n rms = math.sqrt(sum_of_squares/float(image1.size[0] * image2.size[1]))\n\n # Might need to tweak the threshold.\n return rms < 8\n\n def equal(self, img1, img2):\n return filecmp.cmp(img1, img2)\n" }, { "path": "analyzer/android/lib/common/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n" }, { "path": "analyzer/android/lib/common/abstracts.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nclass Package(object):\n \"\"\"Base abstact analysis package.\"\"\"\n\n def __init__(self, options={}):\n \"\"\"@param options: options dict.\"\"\"\n self.options = options\n self.pids = []\n\n def set_pids(self, pids):\n \"\"\"Update list of monitored PIDs in the package context.\n @param pids: list of pids.\n \"\"\"\n self.pids = pids\n\n def start(self):\n \"\"\"Run analysis packege.\n @param path: sample path.\n @raise NotImplementedError: this method is abstract.\n \"\"\"\n raise NotImplementedError\n\n def check(self):\n \"\"\"Check.\n @raise NotImplementedError: this method is abstract.\n \"\"\"\n raise NotImplementedError\n\n def finish(self):\n \"\"\"Finish run.\n @raise NotImplementedError: this method is abstract.\n \"\"\"\n raise NotImplementedError\n\nclass Auxiliary(object):\n pass\n" }, { "path": "analyzer/android/lib/common/constants.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport os\nimport string\nimport random\n\ndef _rand_string(a, b):\n return \"\".join(random.choice(string.ascii_lowercase) for x in xrange(random.randint(a, b)))\n\nROOT = os.path.join(\"/data/local/tmp\", _rand_string(6, 10))\n\nPATHS = {\n \"root\" : ROOT,\n \"logs\" : os.path.join(ROOT, \"logs\"),\n \"files\" : os.path.join(ROOT, \"files\"),\n \"shots\" : os.path.join(ROOT, \"shots\"),\n \"memory\" : os.path.join(ROOT, \"memory\"),\n \"drop\" : os.path.join(ROOT, \"drop\")\n}\n" }, { "path": "analyzer/android/lib/common/exceptions.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nclass CuckooError(Exception):\n pass\n\nclass CuckooPackageError(Exception):\n pass\n" }, { "path": "analyzer/android/lib/common/results.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport logging\nimport socket\nimport time\n\nfrom lib.core.config import Config\n\nlog = logging.getLogger(__name__)\n\nBUFSIZE = 1024*1024\n\ndef upload_to_host(file_path, dump_path):\n nc = infd = None\n try:\n nc = NetlogFile(dump_path)\n\n infd = open(file_path, \"rb\")\n buf = infd.read(BUFSIZE)\n while buf:\n nc.send(buf, retry=False)\n buf = infd.read(BUFSIZE)\n except Exception as e:\n log.error(\"Exception uploading file %s to host: %s\", file_path, e)\n finally:\n if infd:\n infd.close()\n if nc:\n nc.close()\n\nclass NetlogConnection(object):\n def __init__(self, proto=\"\"):\n config = Config(cfg=\"analysis.conf\")\n self.hostip, self.hostport = config.ip, config.port\n self.sock = None\n self.proto = proto\n\n def connect(self):\n # Try to connect as quickly as possible. Just sort of force it to\n # connect with a short timeout.\n while not self.sock:\n try:\n s = socket.create_connection((self.hostip, self.hostport), 0.1)\n s.sendall(self.proto)\n except socket.error:\n time.sleep(0.1)\n continue\n\n self.sock = s\n\n def send(self, data, retry=True):\n if not self.sock:\n self.connect()\n\n try:\n self.sock.sendall(data)\n except socket.error as e:\n if retry:\n self.connect()\n self.send(data, retry=False)\n else:\n raise\n except Exception as e:\n log.error(\"Unhandled exception in NetlogConnection: %s\", str(e))\n # We really have nowhere to log this, if the netlog connection\n # does not work, we can assume that any logging won't work either.\n # So we just fail silently.\n self.close()\n\n def close(self):\n try:\n self.sock.close()\n except Exception:\n pass\n\nclass NetlogFile(NetlogConnection):\n def __init__(self, filepath):\n self.filepath = filepath\n NetlogConnection.__init__(self, proto=\"FILE\\n{0}\\n\".format(self.filepath))\n self.connect()\n\nclass NetlogHandler(logging.Handler, NetlogConnection):\n def __init__(self):\n logging.Handler.__init__(self)\n NetlogConnection.__init__(self, proto=\"LOG\\n\")\n self.connect()\n\n def emit(self, record):\n msg = self.format(record)\n self.send(\"{0}\\n\".format(msg))\n" }, { "path": "analyzer/android/lib/common/utils.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nfrom lib.common.results import NetlogFile\n\ndef send_file(name, data):\n \"\"\"Send file to result server\"\"\"\n nf = NetlogFile(name)\n nf.sock.sendall(data)\n nf.close()\n" }, { "path": "analyzer/android/lib/core/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n" }, { "path": "analyzer/android/lib/core/config.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport ConfigParser\n\nclass Config:\n def __init__(self, cfg):\n \"\"\"@param cfg: configuration file.\"\"\"\n config = ConfigParser.ConfigParser(allow_no_value=True)\n config.read(cfg)\n\n for section in config.sections():\n for name, raw_value in config.items(section):\n try:\n value = config.getboolean(section, name)\n except ValueError:\n try:\n value = config.getint(section, name)\n except ValueError:\n value = config.get(section, name)\n\n setattr(self, name, value)\n" }, { "path": "analyzer/android/lib/core/packages.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\ndef choose_package(file_type, file_name):\n \"\"\"Choose analysis package due to file type and file extension.\n @param file_type: file type.\n @return: package or None.\n \"\"\"\n if not file_type:\n return None\n\n file_type = file_type.lower()\n file_name = file_name.lower()\n\n if \"apk\" in file_name:\n return \"apk\"\n elif \"zip\" in file_type:\n return \"apk\"\n # elif \"DEX\" in file_type:\n # return \"dex\"\n else:\n return \"apk\"\n" }, { "path": "analyzer/android/lib/core/startup.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport os\nimport logging\n\nfrom lib.common.constants import PATHS\nfrom lib.common.results import NetlogHandler\n\nlog = logging.getLogger()\n\ndef create_folders():\n \"\"\"Create folders in PATHS.\"\"\"\n for name, folder in PATHS.items():\n if os.path.exists(folder):\n continue\n\n try:\n os.makedirs(folder)\n except OSError:\n pass\n\ndef init_logging():\n \"\"\"Initialize logger.\"\"\"\n formatter = logging.Formatter(\"%(asctime)s [%(name)s] %(levelname)s: %(message)s\")\n sh = logging.StreamHandler()\n sh.setFormatter(formatter)\n log.addHandler(sh)\n\n nh = NetlogHandler()\n nh.setFormatter(formatter)\n log.addHandler(nh)\n\n log.setLevel(logging.DEBUG)\n" }, { "path": "analyzer/android/modules/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n" }, { "path": "analyzer/android/modules/auxiliary/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n" }, { "path": "analyzer/android/modules/auxiliary/screenshots.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport time\nimport logging\nimport StringIO\nfrom threading import Thread\nfrom lib.common.abstracts import Auxiliary\nfrom lib.common.results import NetlogFile\nfrom lib.api.adb import take_screenshot\nfrom lib.api.screenshot import Screenshot\n\nlog = logging.getLogger(__name__)\nSHOT_DELAY = 2\n\nclass Screenshots(Auxiliary, Thread):\n \"\"\"Take screenshots.\"\"\"\n\n def __init__(self):\n Thread.__init__(self)\n self.do_run = True\n\n def stop(self):\n \"\"\"Stop screenshotting.\"\"\"\n self.do_run = False\n\n def run(self):\n \"\"\"Run screenshotting.\n @return: operation status.\n \"\"\"\n img_counter = 0\n img_last = None\n\n while self.do_run:\n time.sleep(SHOT_DELAY)\n\n try:\n filename = \"screenshot%s.jpg\" % str(img_counter)\n img_current = take_screenshot(filename)\n if img_last:\n if Screenshot().equal(img_last, img_current):\n continue\n\n file = open(img_current, 'r')\n tmpio = StringIO.StringIO(file.read())\n # now upload to host from the StringIO\n nf = NetlogFile(\"shots/%s.jpg\" % str(img_counter).rjust(4, \"0\"))\n\n for chunk in tmpio:\n nf.sock.sendall(chunk)\n\n nf.close()\n file.close()\n img_counter += 1\n img_last = img_current\n\n except IOError as e:\n log.error(\"Cannot take screenshot: %s\", e)\n continue\n\n return True\n" }, { "path": "analyzer/android/modules/packages/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n" }, { "path": "analyzer/android/modules/packages/apk.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nimport logging\n\nfrom lib.api.adb import dump_droidmon_logs, execute_sample, install_sample\nfrom lib.common.abstracts import Package\n\nlog = logging.getLogger(__name__)\n\nclass Apk(Package):\n \"\"\"Apk analysis package.\"\"\"\n def __init__(self, options={}):\n super(Apk, self).__init__(options)\n\n self.package, self.activity = options.get(\"apk_entry\", \":\").split(\":\")\n\n def start(self, path):\n install_sample(path)\n execute_sample(self.package, self.activity)\n\n def check(self):\n return True\n\n def finish(self):\n dump_droidmon_logs(self.package)\n return True\n" }, { "path": "analyzer/android/modules/packages/default_browser.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n# Originally contributed by Check Point Software Technologies, Ltd.\n\nfrom lib.common.abstracts import Package\nfrom lib.api.adb import execute_browser\n\nclass default_browser(Package):\n \"\"\"Default Browser analysis package.\"\"\"\n def __init__(self, options={}):\n super(default_browser, self).__init__(options)\n\n def start(self, target):\n execute_browser(target)\n\n def check(self):\n return True\n\n def finish(self):\n return True\n" }, { "path": "analyzer/darwin/__init__.py", "content": "" }, { "path": "analyzer/darwin/analyzer.py", "content": "#!/usr/bin/env python\n# Copyright (C) 2015 Dmitry Rodionov\n# This software may be modified and distributed under the terms\n# of the MIT license. See the LICENSE file for details.\n\nimport logging\nfrom sys import stderr\nfrom hashlib import sha256\nfrom xmlrpclib import Server\nfrom traceback import format_exc\nfrom os import path, getcwd, makedirs\n\nfrom lib.common.config import Config\nfrom lib.common.hashing import hash_file\nfrom lib.common.results import NetlogHandler, upload_to_host\nfrom lib.core.constants import PATHS\nfrom lib.core.packages import choose_package_class\nfrom lib.core.osx import set_wallclock\nfrom lib.core.host import CuckooHost\n\nclass Macalyzer(object):\n \"\"\"Cuckoo OS X analyser.\n \"\"\"\n\n log = logging.getLogger()\n target = None\n\n files_to_upload = []\n uploaded_hashes = []\n\n def __init__(self, host, configuration=None):\n self.config = configuration\n self.host = host\n\n def bootstrap(self):\n _create_result_folders()\n _setup_logging()\n self._detect_target()\n\n def run(self):\n \"\"\"Run analysis.\n \"\"\"\n self.bootstrap()\n\n self.log.debug(\"Starting analyzer from %s\", getcwd())\n self.log.debug(\"Storing results at: %s\", PATHS[\"root\"])\n\n package = self._setup_analysis_package()\n\n if self.config.clock:\n set_wallclock(self.config.clock)\n self._analysis(package)\n\n return self._complete()\n\n def _complete(self):\n for f in self.files_to_upload:\n self._upload_file(f)\n return True\n\n #\n # Implementation details\n #\n\n def _detect_target(self):\n if self.config.category == \"file\":\n self.target = path.join(\"/tmp/\", str(self.config.file_name))\n else: # It's not a file, but a URL\n self.target = self.config.target\n\n def _setup_analysis_package(self):\n # Do we have a suggestion about an analysis package?\n if self.config.package:\n suggestion = self.config.package\n elif self.config.category != \"file\":\n suggestion = \"url\"\n else:\n suggestion = None\n # Try to figure out what analysis package to use with this target\n kwargs = {\"suggestion\" : suggestion}\n package_class = choose_package_class(self.config.file_type,\n self.config.file_name, **kwargs)\n if not package_class:\n raise Exception(\"Could not find an appropriate analysis package\")\n # Package initialization\n kwargs = {\n \"options\" : self.config.get_options(),\n \"timeout\" : self.config.timeout\n }\n return package_class(self.target, self.host, **kwargs)\n\n def _analysis(self, package):\n package.start()\n self.files_to_upload = package.touched_files\n\n def _upload_file(self, filepath):\n if not path.isfile(filepath):\n return\n # Check whether we've already dumped this file - in that case skip it\n try:\n hashsum = hash_file(sha256, filepath)\n if sha256 in self.uploaded_hashes:\n return\n except IOError as e:\n self.log.info(\"Error dumping file from path \\\"%s\\\": %s\", filepath, e)\n return\n filename = \"%s_%s\" % (hashsum[:16], path.basename(filepath))\n upload_path = path.join(\"files\", filename)\n\n try:\n upload_to_host(filepath, upload_path)\n self.uploaded_hashes.append(hashsum)\n except IOError as e:\n self.log.error(\"Unable to upload dropped file at path \\\"%s\\\": %s\", filepath, e)\n\ndef _create_result_folders():\n for _, folder in PATHS.items():\n if path.exists(folder):\n continue\n try:\n makedirs(folder)\n except OSError:\n pass\n\n\ndef _setup_logging():\n \"\"\" Initialize logger. \"\"\"\n logger = logging.getLogger()\n formatter = logging.Formatter(\"%(asctime)s [%(name)s] %(levelname)s: %(message)s\")\n\n stream = logging.StreamHandler()\n stream.setFormatter(formatter)\n logger.addHandler(stream)\n\n netlog = NetlogHandler()\n netlog.setFormatter(formatter)\n logger.addHandler(netlog)\n logger.setLevel(logging.DEBUG)\n\n\n\nif __name__ == \"__main__\":\n success = False\n error = \"\"\n\n try:\n config = Config(cfg=\"analysis.conf\")\n cuckoo = CuckooHost(config.ip, config.port)\n analyzer = Macalyzer(cuckoo, config)\n success = analyzer.run()\n\n except KeyboardInterrupt:\n error = \"Keyboard Interrupt\"\n\n except Exception as err:\n error_exc = format_exc()\n error = str(err)\n if len(analyzer.log.handlers):\n analyzer.log.exception(error_exc)\n else:\n stderr.write(\"{0}\\n\".format(error_exc))\n # Once the analysis is completed or terminated for any reason, we report\n # back to the agent, notifying that it can report back to the host.\n finally:\n # Establish connection with the agent XMLRPC server.\n server = Server(\"http://127.0.0.1:8000\")\n server.complete(success, error, PATHS[\"root\"])\n" }, { "path": "analyzer/darwin/lib/__init__.py", "content": "" }, { "path": "analyzer/darwin/lib/common/__init__.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n" }, { "path": "analyzer/darwin/lib/common/config.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n\nimport ConfigParser\n\nclass Config:\n def __init__(self, cfg):\n \"\"\"@param cfg: configuration file.\"\"\"\n config = ConfigParser.ConfigParser(allow_no_value=True)\n config.read(cfg)\n\n for section in config.sections():\n for name, raw_value in config.items(section):\n if name == \"file_name\":\n value = config.get(section, name)\n else:\n try:\n value = config.getboolean(section, name)\n except ValueError:\n try:\n value = config.getint(section, name)\n except ValueError:\n value = config.get(section, name)\n setattr(self, name, value)\n\n def get_options(self):\n \"\"\"Get analysis options.\n @return: options dict.\n \"\"\"\n # The analysis package can be provided with some options in the\n # following format:\n # option1=value1,option2=value2,option3=value3\n #\n # Here we parse such options and provide a dictionary that will be made\n # accessible to the analysis package.\n options = {}\n if hasattr(self, \"options\") and len(self.options) > 0:\n try:\n # Split the options by comma.\n fields = self.options.split(\",\")\n except ValueError:\n pass\n else:\n for field in fields:\n # Split the name and the value of the option.\n try:\n # Sometimes, we have a key without a value (i.e. it's a\n # command line argument), so we can't use the\n # `key, value = field.split(\"=\", 1)` style here\n parts = field.split(\"=\", 1)\n except ValueError:\n pass\n else:\n key = parts[0].strip()\n arg_prefix = \"arg-\"\n if not key.startswith(arg_prefix):\n # If the parsing went good, we add the option to the\n # dictionary.\n value = parts[1].strip()\n options[key] = value\n elif len(key) > len(arg_prefix):\n # Remove \"arg-\" prefix from the key\n key = key[4:]; parts[0] = key\n # Add this key (with a value maybe) to the args\n if \"args\" not in options: options[\"args\"] = []\n options[\"args\"] += parts\n return options\n" }, { "path": "analyzer/darwin/lib/common/hashing.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n\nBUFSIZE = 1024*1024\n\n\ndef hash_file(method, path):\n \"\"\"Calculates an hash on a file by path.\n @param method: callable hashing method\n @param path: file path\n @return: computed hash string\n \"\"\"\n f = open(path, \"rb\")\n h = method()\n while True:\n buf = f.read(BUFSIZE)\n if not buf:\n break\n h.update(buf)\n return h.hexdigest()\n" }, { "path": "analyzer/darwin/lib/common/rand.py", "content": "import random\nimport string\n\ndef random_string(minimum, maximum=None):\n if maximum is None:\n maximum = minimum\n\n count = random.randint(minimum, maximum)\n return \"\".join(random.choice(string.ascii_letters) for x in xrange(count))\n\ndef random_integer(digits):\n start = 10 ** (digits - 1)\n end = (10 ** digits) - 1\n return random.randint(start, end)\n" }, { "path": "analyzer/darwin/lib/common/results.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n\nimport time\nimport socket\nimport logging\nfrom config import Config\n\nlog = logging.getLogger(__name__)\n\nBUFSIZE = 1024*1024\n\ndef upload_to_host(file_path, dump_path):\n nc = infd = None\n try:\n nc = NetlogFile(dump_path)\n\n infd = open(file_path, \"rb\")\n buf = infd.read(BUFSIZE)\n while buf:\n nc.send(buf, retry=False)\n buf = infd.read(BUFSIZE)\n except Exception as e:\n log.error(\"Exception uploading file %s to host: %s\", file_path, e)\n finally:\n if infd:\n infd.close()\n if nc:\n nc.close()\n\nclass NetlogConnection(object):\n def __init__(self, proto=\"\"):\n config = Config(cfg=\"analysis.conf\")\n self.hostip, self.hostport = config.ip, config.port\n self.sock, self.file = None, None\n self.proto = proto\n\n def connect(self):\n i = 1\n # this can loop forever, if we can't connect the whole analysis is useless anyways\n while True:\n s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n try:\n s.connect((self.hostip, self.hostport))\n s.sendall(self.proto)\n except:\n time.sleep(i)\n i = min(i + 1, 60)\n else:\n self.sock = s\n self.file = s.makefile()\n break\n\n def send(self, data, retry=True):\n if not self.sock: self.connect()\n\n try:\n self.sock.sendall(data)\n except socket.error as e:\n if retry:\n self.connect()\n self.send(data, retry=False)\n else:\n raise\n except Exception as e:\n log.error(\"Unhandled exception in NetlogConnection: %s\", str(e))\n # We really have nowhere to log this, if the netlog connection\n # does not work, we can assume that any logging won't work either.\n # So we just fail silently.\n self.close()\n\n def close(self):\n try:\n self.file.close()\n self.sock.close()\n except Exception:\n pass\n\nclass NetlogFile(NetlogConnection):\n def __init__(self, filepath):\n self.filepath = filepath\n NetlogConnection.__init__(self, proto=\"FILE\\n{0}\\n\".format(self.filepath))\n self.connect()\n\nclass NetlogHandler(logging.Handler, NetlogConnection):\n def __init__(self):\n logging.Handler.__init__(self)\n NetlogConnection.__init__(self, proto=\"LOG\\n\")\n self.connect()\n\n def emit(self, record):\n msg = self.format(record)\n self.send(\"{0}\\n\".format(msg))\n" }, { "path": "analyzer/darwin/lib/core/__init__.py", "content": "" }, { "path": "analyzer/darwin/lib/core/constants.py", "content": "# Copyright (C) 2014-2016 Cuckoo Foundation.\n# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org\n# See the file 'docs/LICENSE' for copying permission.\n\nimport os\nfrom tempfile import gettempdir\nfrom ..common.rand import random_string\n\nROOT = os.path.join(gettempdir() + os.sep, random_string(6, 10))\n\nPATHS = {\n \"root\" : ROOT,\n \"logs\" : os.path.join(ROOT, \"logs\"),\n \"files\" : os.path.join(ROOT, \"files\"),\n \"shots\" : os.path.join(ROOT, \"shots\"),\n \"memory\" : os.path.join(ROOT, \"memory\"),\n \"drop\" : os.path.join(ROOT, \"drop\")\n}\n" }, { "path": "analyzer/darwin/lib/core/data/signatures.yml", "content": "system:\n is_success_condition: \"retval == 0\"\n args:\n - {name: \"command\", type: \"char *\"}\n retval_type: \"int\"\n category: \"foobar\"\n\nprintf:\n is_success_condition: \"retval > 0\"\n args:\n - {name: \"format\", type: \"char *\"}\n retval_type: \"int\"\n category: \"foobar\"\n\ndlopen:\n is_success_condition: \"retval > 0\"\n args:\n - {name: \"path\", type: \"char *\"}\n - {name: \"mode\", type: \"int\"}\n retval_type: \"void *\"\n category: \"foobar\"\n library: \"libdyld\"\n\ndlsym:\n is_success_condition: \"retval > 0\"\n args:\n - {name: \"handle\", type: \"void *\"}\n - {name: \"symbol\", type: \"char *\"}\n retval_type: \"void *\"\n category: \"foobar\"\n library: \"libdyld\"\n\nfprintf:\n is_success_condition: \"retval > 0\"\n args:\n - {name: \"stream\", type: \"void *\"}\n - {name: \"format\", type: \"char *\"}\n retval_type: \"int\"\n category: \"foobar\"\n\nopen:\n is_success_condition: \"retval > 0\"\n args:\n - {name: \"path\", type: \"char *\"}\n - {name: \"oflag\", type: \"int\"}\n retval_type: \"int\"\n category: \"file\"\n\nfopen:\n is_success_condition: \"retval > 0\"\n args:\n - {name: \"filename\", type: \"char *\"}\n - {name: \"mode\", type: \"char *\"}\n retval_type: \"void *\"\n category: \"file\"\n\nfreopen:\n is_success_condition: \"retval > 0\"\n args:\n - {name: \"filename\", type: \"char *\"}\n - {name: \"mode\", type: \"char *\"}\n - {name: \"stream\", type: \"void *\"}\n retval_type: \"void *\"\n category: \"file\"\n\nrename:\n is_success_condition: \"retval == 0\"\n args:\n - {name: \"old\", type: \"char *\"}\n - {name: \"new\", type: \"char *\"}\n - {name: \"state\", type: \"void *\"}\n - {name: \"flags\", type: \"uint64_t\"}\n retval_type: \"int\"\n category: \"file\"\n\ncopyfile:\n is_success_condition: \"retval == 0\"\n args:\n - {name: \"from\", type: \"char *\"}\n - {name: \"to\", type: \"char *\"}\n - {name: \"state\", type: \"void *\"}\n - {name: \"flags\", type: \"uint32_t\"}\n retval_type: \"int\"\n category: \"file\"\n\nremove:\n is_success_condition: \"retval == 0\"\n args:\n - {name: \"path\", type: \"char *\"}\n retval_type: \"int\"\n category: \"file\"\n\nunlink:\n is_success_condition: \"retval == 0\"\n args:\n - {name: \"path\", type: \"char *\"}\n retval_type: \"int\"\n category: \"file\"\n\nexecve:\n is_success_condition: \"retval != -1\"\n args:\n - {name: \"path\", type: \"char *\"}\n - {name: \"argv\", type: \"void *\"}\n - {name: \"envp\", type: \"void *\"}\n retval_type: \"int\"\n category: \"process\"\n __ignore__: true\n\nfork:\n is_success_condition: \"retval >= 0\"\n args: []\n retval_type: \"int\"\n category: \"process\"\n\nsocket:\n is_success_condition: \"retval > 0\"\n args:\n - {name: \"domain\", type: \"int\"}\n - {name: \"type\", type: \"int\"}\n - {name: \"protocol\", type: \"int\"}\n retval_type: \"int\"\n category: \"network\"\n\n# Signatures for tests.\n# Please don't remove them. Thanks!\n\nrb_isalpha:\n is_success_condition: \"retval != 0\"\n args:\n - {name: \"character\", type: \"char\"}\n retval_type: \"int\"\n category: \"foobar\"\n\natoi:\n is_success_condition: \"1==1\"\n args:\n - {name: \"str\", type: \"char *\"}\n retval_type: \"int\"\n category: \"foobar\"\n library: \"libsystem_c\"\n" }, { "path": "analyzer/darwin/lib/core/data/types.yml", "content": "# ===============================================\n# Basic types\n#\nint: &int\n # We will print it with something like printf(\"%d\", value)\n printf_specifier: \"%d\"\n # Is it a native C type (on OS X)?\n native: Yes\n# Alternative name for backward compatibility\ninteger: *int\n\nunsigned int: &unsigned-int\n printf_specifier: \"%ld\"\n native: Yes\n\nlong: &long\n printf_specifier: \"%l\"\n native: Yes\n\nunsigned long: &unsigned-long\n printf_specifier: \"%lu\"\n native: Yes\n\nunsigned long long: &unsigned-long-long\n printf_specifier: \"%llu\"\n native: Yes\n\nsize_t: *unsigned-long\n\nchar: &char\n printf_specifier: '\"%c\"'\n native: Yes\n\nfloat: &float\n printf_specifier: \"%f\"\n native: Yes\n\ndouble: &double\n printf_specifier: \"%f\"\n native: Yes\n#\n# Raw pointers: just dump their values (in *decimal* since dtrace will output\n# JSON that doesn't accept hex values)\n#\n\"void *\":\n <<: *unsigned-long-long\n cast: \"unsigned long long\"\n#\n# Strings\n#\n\"char *\": &char-pointer\n printf_specifier: '\"%S\"'\n native: No\n template: |-\n !!(${ARG}) ? copyinstr((uint64_t)${ARG}) : \"\"\n#\n# Arbitrary buffers\n#\n#buffer: &buffer\n# printf_specifier: '\"%S\"'\n# native: No\n# template: |-\n# ${ARG} != (int64_t)NULL ? stringof(copyin(${ARG}, ${SIZE_ARG})) : \"\"\n#\n# Fixed length C types\n#\nint8_t: &int8_t\n printf_specifier: \"%d\"\n native: Yes\n\nuint8_t: &uint8_t\n printf_specifier: \"%u\"\n native: Yes\n\nint16_t: &int16_t\n printf_specifier: \"%d\"\n native: Yes\n\nuint16_t: &uint16_t\n printf_specifier: \"%u\"\n native: Yes\n\nint32_t: &int32_t\n printf_specifier: \"%d\"\n native: Yes\n\nuint32_t: &uint32_t\n printf_specifier: \"%u\"\n native: Yes\n\nint64_t: &int64_t\n printf_specifier: \"%lld\"\n native: Yes\n\nuint64_t: &uint64_t\n printf_specifier: \"%llu\"\n native: Yes\n\n#\n# Structures for tests.\n# Please don't remove them. Thanks!\n#\n\ntest_t:\n native: No\n struct:\n hash: \"int\"\n base: \"test_internal_t *\"\n description: \"char *\"\n\ntest_internal_t:\n native: No\n struct:\n abc: \"double *\"\n hfa: \"size_t\"\n sss: \"char *\"\n\ntest_extra_t:\n native: No\n struct:\n foo: int\n bar: uint64_t\n\n#\n# Your custom data types\n#\n" }, { "path": "analyzer/darwin/lib/core/filetimes.py", "content": "# Copyright (c) 2009, David Buxton \n# All rights reserved.\n#\n# Redistribution and use in source and binary forms, with or without\n# modification, are permitted provided that the following conditions are\n# met:\n#\n# * Redistributions of source code must retain the above copyright\n# notice, this list of conditions and the following disclaimer.\n# * Redistributions in binary form must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer in the\n# documentation and/or other materials provided with the distribution.\n#\n# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS\n# IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED\n# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\n# PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED\n# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR\n# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF\n# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING\n# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\"\"\"Tools to convert between Python datetime instances and Microsoft times.\n\"\"\"\nfrom calendar import timegm\n\n\n# http://support.microsoft.com/kb/167296\n# How To Convert a UNIX time_t to a Win32 FILETIME or SYSTEMTIME\nEPOCH_AS_FILETIME = 116444736000000000 # January 1, 1970 as MS file time\nHUNDREDS_OF_NANOSECONDS = 10000000\n\n\ndef dt_to_filetime(dt, delta_from_utc):\n \"\"\"Converts a datetime to Microsoft filetime format.\n\n >>> \"%.0f\" % dt_to_filetime(datetime(2009, 7, 25, 23, 0))\n '128930364000000000'\n\n >>> \"%.0f\" % dt_to_filetime(datetime(1970, 1, 1, 0, 0, tzinfo=utc))\n '116444736000000000'\n\n >>> \"%.0f\" % dt_to_filetime(datetime(1970, 1, 1, 0, 0))\n '116444736000000000'\n\n >>> dt_to_filetime(datetime(2009, 7, 25, 23, 0, 0, 100))\n 128930364000001000\n \"\"\"\n dt += delta_from_utc\n ft = EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)\n return ft + (dt.microsecond * 10)\n" }, { "path": "analyzer/darwin/lib/core/host.py", "content": "#!/usr/bin/env python\n# Copyright (C) 2015 Dmitry Rodionov\n# This software may be modified and distributed under the terms\n# of the MIT license. See the LICENSE file for details.\n\nimport yaml\nimport socket\nimport logging\nimport bson\nfrom os import path\nfrom datetime import datetime\nfrom subprocess import check_output, CalledProcessError\nfrom filetimes import dt_to_filetime\n\nlog = logging.getLogger(__name__)\n\nclass CuckooHost(object):\n \"\"\" Sending analysis results back to the Cuckoo Host.\n\n Currently it only supports sending results about API calls via send_api(),\n see `apicalls` module.\n \"\"\"\n sockets = {\n # Each target process has its own results server on the host, so\n # we setup as many sockets as we have targets to analyse.\n }\n descriptions = {\n # We don't want to explain APIs every single time they're about to be\n # send to the host, so we explain them once and then just refer to them\n # via an unique ID.\n }\n launch_times = {\n # Since Cuckoo host expects us to send relative times, we remember when\n # every target was launched.\n }\n human_readable_info = {\n # Here goes all the additional information about APIs like category,\n # arguments names and so on. See date/apis.json for more details.\n }\n\n def __init__(self, host_ip, host_port):\n self.ip = host_ip\n self.port = host_port\n self._load_human_readable_info()\n\n def send_api(self, thing):\n \"\"\" Sends a new API notification to the Cuckoo host \"\"\"\n pid = thing.pid\n api = thing.api\n\n # We're required to report results of tracing a target process to\n # *its own* result server. So create a communication socket...\n if pid not in self.sockets:\n self.sockets[pid] = self._create_socket()\n if not self.sockets[pid]:\n raise Exception(\"CuckooHost error: could not create socket.\")\n # ... and don't forget to explain every single API call again\n self.descriptions.setdefault(pid, [\"__process__\", \"__thread__\"])\n self._send_new_process(thing)\n try:\n lookup_idx = self.descriptions[pid].index(api)\n except ValueError:\n self.descriptions[pid].append(api)\n lookup_idx = len(self.descriptions[pid]) - 1\n self._send_api_description(lookup_idx, thing)\n\n # Here's an api object:\n # {\n # \"I\" : (int),\n # \"T\" : (int),\n # \"t\" : (int)