Skip to content

Commit

Permalink
style: Automatic code formatting
Browse files Browse the repository at this point in the history
  • Loading branch information
actions-user committed Jun 27, 2024
1 parent d7b8bae commit 89cad8f
Show file tree
Hide file tree
Showing 2 changed files with 31 additions and 16 deletions.
41 changes: 28 additions & 13 deletions analyzer/windows/modules/hollowshunter.py
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
import os
import json
import logging
import subprocess
import os
import platform
import shlex
import subprocess

from lib.common.abstracts import Auxiliary
from lib.core.config import Config
from lib.common.exceptions import CuckooPackageError
from lib.common.results import upload_to_host
from lib.core.config import Config

log = logging.getLogger(__name__)

Expand Down Expand Up @@ -39,19 +39,18 @@ def start(self):

if not os.path.exists(hollowshunter):
raise CuckooPackageError(
"In order to use the HollowsHunter functionality, it "
"is required to have HollowsHunter setup with Cuckoo."
"In order to use the HollowsHunter functionality, it " "is required to have HollowsHunter setup with Cuckoo."
)
hollowshunter = hollowshunter.replace("\\","\\\\")
hollowshunter = hollowshunter.replace("\\", "\\\\")
hh_args = self.options.get("hh_args")
if not hh_args:
hh_args = "/loop /data 0" # Re-add /shellc
hh_args = "/loop /data 0" # Re-add /shellc

hh_cmd = f"{hollowshunter} {hh_args} /dir {self.output_dir} /mignore capemon.dll;capemon_x64.dll"
hh_cmd = shlex.split(hh_cmd)
log.debug(hh_cmd)
# Start HollowsHunter in the background
# subprocess.Popen([hollowshunter, "/loop", "/imp", "/shellc", "/dir", self.output_dir], startupinfo=self.startupinfo)
# subprocess.Popen([hollowshunter, "/loop", "/imp", "/shellc", "/dir", self.output_dir], startupinfo=self.startupinfo)
subprocess.Popen(hh_cmd, startupinfo=self.startupinfo)

def stop(self):
Expand All @@ -61,11 +60,27 @@ def stop(self):
get_all_files = True

# VirtualQuery and VirtualProtect may be FPs
strings_of_interest = [b"This program cannot be run in DOS mode.", b"VirtualFree",b"VirtualAlloc", b"LoadLibrary",
b"LocalFree", b"GetProcAddress", b"GetModuleHandle", b"AdjustTokenPrivileges",
b"CheckRemoteDebuggerPresent", b"CreateMutex", b"EnumProcesses", b"EnumProcessModules",
b"gethostname", b"IsNTAdmin", b"OpenMutex", b"RtlWriteRegistryValue", b"VirtualAllocEx",
b"VirtualProtectEx", b"WinExec"]
strings_of_interest = [
b"This program cannot be run in DOS mode.",
b"VirtualFree",
b"VirtualAlloc",
b"LoadLibrary",
b"LocalFree",
b"GetProcAddress",
b"GetModuleHandle",
b"AdjustTokenPrivileges",
b"CheckRemoteDebuggerPresent",
b"CreateMutex",
b"EnumProcesses",
b"EnumProcessModules",
b"gethostname",
b"IsNTAdmin",
b"OpenMutex",
b"RtlWriteRegistryValue",
b"VirtualAllocEx",
b"VirtualProtectEx",
b"WinExec",
]
files_to_upload = set()
max_upload = 25 if not get_all_files else 100
upload_count = 0
Expand Down
6 changes: 3 additions & 3 deletions modules/processing/hollowshunter.py
Original file line number Diff line number Diff line change
@@ -1,14 +1,15 @@
import json
import logging
import os
import re
import json

from lib.cuckoo.common.abstracts import Processing
from lib.cuckoo.common.exceptions import CuckooProcessingError

log = logging.getLogger(__name__)


class HollowsHunter(Processing):
class HollowsHunter(Processing):
def parse_report(self, data):
pid = data["pid"]
if not self.hh_response.get(pid):
Expand Down Expand Up @@ -38,4 +39,3 @@ def run(self):
raise CuckooProcessingError("Failed parsing report %s due to %s" % (report_path, str(e)))
self.parse_report(report_json)
return self.hh_response

0 comments on commit 89cad8f

Please sign in to comment.