From d39076b2cfbbc59658d4d5aaf0e7d7653e8a6f8e Mon Sep 17 00:00:00 2001 From: Jurriaan Bremer Date: Wed, 12 Jul 2017 16:35:52 +0200 Subject: [PATCH] various minor tweaks --- cuckoo/compat/config.py | 10 ++-- cuckoo/core/guest.py | 8 ++- cuckoo/data/analyzer/linux/analyzer.py | 26 ++++++---- cuckoo/machinery/qemu.py | 19 +++++--- cuckoo/processing/platform/linux.py | 15 +++--- cuckoo/processing/static.py | 59 +++++++++++++---------- tests/test_config.py | 7 ++- tests/test_elf.py | 24 ++++----- tests/test_qemu.py | 3 +- tests/test_stap.py | 67 +++++++++++++------------- 10 files changed, 128 insertions(+), 110 deletions(-) diff --git a/cuckoo/compat/config.py b/cuckoo/compat/config.py index 0adffc51d..efb4dbc81 100644 --- a/cuckoo/compat/config.py +++ b/cuckoo/compat/config.py @@ -683,13 +683,9 @@ def _201_202(c): return c def _203_204(c): - machineries = ( - "qemu", - ) - for machinery in machineries: - for machine in c[machinery][machinery]["machines"]: - c[machinery][machine]["snapshot"] = None - c[machinery][machine]["enable_kvm"] = False + for machine in c["qemu"]["qemu"]["machines"]: + c["qemu"][machine]["snapshot"] = None + c["qemu"][machine]["enable_kvm"] = False return c migrations = { diff --git a/cuckoo/core/guest.py b/cuckoo/core/guest.py index fbe75cc7b..8fab6accf 100644 --- a/cuckoo/core/guest.py +++ b/cuckoo/core/guest.py @@ -349,10 +349,14 @@ class GuestManager(object): self.analyzer_path = r.json()["dirpath"] def determine_system_drive(self): - return "%s/" % self.environ["SYSTEMDRIVE"] if self.platform == "windows" else "/" + if self.platform == "windows": + return "%s/" % self.environ["SYSTEMDRIVE"] + return "/" def determine_temp_path(self): - return self.environ["TEMP"] if self.platform == "windows" else "/tmp" + if self.platform == "windows": + return self.environ["TEMP"] + return "/tmp" def upload_analyzer(self, monitor): """Upload the analyzer to the Virtual Machine.""" diff --git a/cuckoo/data/analyzer/linux/analyzer.py b/cuckoo/data/analyzer/linux/analyzer.py index f92c16dcb..9e92066c1 100644 --- a/cuckoo/data/analyzer/linux/analyzer.py +++ b/cuckoo/data/analyzer/linux/analyzer.py @@ -1,4 +1,4 @@ -# Copyright (C) 2014-2016 Cuckoo Foundation. +# Copyright (C) 2015-2017 Cuckoo Foundation. # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org # See the file 'docs/LICENSE' for copying permission. @@ -35,12 +35,13 @@ PPID = Process(pid=PID).get_parent_pid() def add_pids(pids): """Add PID.""" if not isinstance(pids, (tuple, list, set)): - pids = [pids,] + pids = [pids] for pid in pids: log.info("Added new process to list with pid: %s", pid) pid = int(pid) - if not pid in SEEN_LIST: PROCESS_LIST.add(pid) + if pid not in SEEN_LIST: + PROCESS_LIST.add(pid) SEEN_LIST.add(pid) def dump_files(): @@ -283,17 +284,19 @@ class Analyzer: except Exception as e: log.warning("The package \"%s\" finish function raised an " "exception: %s", package_name, e) - + try: # Upload files the package created to package_files in the results folder package_files = pack.package_files() - if package_files != None: + if package_files is not None: for package in package_files: - upload_to_host(package[0], os.path.join("package_files", package[1])); + upload_to_host( + package[0], os.path.join("package_files", package[1]) + ) except Exception as e: log.warning("The package \"%s\" package_files function raised an " "exception: %s", package_name, e) - + # Terminate the Auxiliary modules. for aux in sorted(aux_enabled, key=lambda x: x.priority): try: @@ -370,5 +373,10 @@ if __name__ == "__main__": server.complete(success, error, PATHS["root"]) except xmlrpclib.ProtocolError: # new agent - data = { "status": "complete", "description": success } - urllib2.urlopen("http://127.0.0.1:8000/status", urllib.urlencode(data)) + data = { + "status": "complete", + "description": success + } + urllib2.urlopen( + "http://127.0.0.1:8000/status", urllib.urlencode(data) + ) diff --git a/cuckoo/machinery/qemu.py b/cuckoo/machinery/qemu.py index 2ab648502..5efdb853c 100644 --- a/cuckoo/machinery/qemu.py +++ b/cuckoo/machinery/qemu.py @@ -145,20 +145,27 @@ class QEMU(Machinery): if vm_options.snapshot: snapshot_path = vm_options.image else: - snapshot_name = "snapshot_" + vm_info.name - snapshot_path = "%s/%s" % (os.path.dirname(vm_options.image), os.path.basename(snapshot_name)) + ".qcow2" + snapshot_path = os.path.join( + os.path.dirname(vm_options.image), + "snapshot_%s.qcow2" % vm_info.name + ) if os.path.exists(snapshot_path): os.remove(snapshot_path) - # make sure we use a new harddisk layer by creating a new qcow2 with backing file + # make sure we use a new harddisk layer by creating a new + # qcow2 with backing file try: - proc = subprocess.Popen([self.qemu_img, "create", "-f", "qcow2", "-b", vm_options.image, snapshot_path], - stdout=subprocess.PIPE, stderr=subprocess.PIPE) + proc = subprocess.Popen([ + self.qemu_img, "create", "-f", "qcow2", + "-b", vm_options.image, snapshot_path + ], stdout=subprocess.PIPE, stderr=subprocess.PIPE) output, err = proc.communicate() if err: raise OSError(err) except OSError as e: - raise CuckooMachineError("QEMU failed starting the machine: %s" % e) + raise CuckooMachineError( + "QEMU failed starting the machine: %s" % e + ) vm_arch = getattr(vm_options, "arch", "default") arch_config = dict(QEMU_ARGS[vm_arch]) diff --git a/cuckoo/processing/platform/linux.py b/cuckoo/processing/platform/linux.py index 8662aba46..0d1da8f46 100644 --- a/cuckoo/processing/platform/linux.py +++ b/cuckoo/processing/platform/linux.py @@ -1,15 +1,13 @@ -# Copyright (C) 2010-2013 Claudio Guarnieri. -# Copyright (C) 2014-2016 Cuckoo Foundation. +# Copyright (C) 2015-2017 Cuckoo Foundation. # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org # See the file 'docs/LICENSE' for copying permission. +import datetime +import dateutil.parser import os import logging -import datetime import re -import dateutil.parser - from cuckoo.common.abstracts import BehaviorHandler log = logging.getLogger(__name__) @@ -32,7 +30,8 @@ class FilteredProcessLog(list): return True class LinuxSystemTap(BehaviorHandler): - """Parses systemtap generated plaintext logs (see stuff/systemtap/strace.stp).""" + """Parses systemtap generated plaintext logs (see + stuff/systemtap/strace.stp).""" key = "processes" @@ -112,7 +111,7 @@ class StapParser(object): dtms = datetime.timedelta(0, 0, int(datetimepart.split(".", 1)[1])) dt = dateutil.parser.parse(datetimepart.split(".", 1)[0]) + dtms - parts = list() + parts = [] for delim in ("@", "[", "]", "(", ")", "= ", " (", ")"): part, _, r = r.strip().partition(delim) parts.append(part) @@ -162,4 +161,4 @@ class StapParser(object): return arg.startswith("[") and not arg.startswith("[/*") def is_string(self, arg): - return arg.startswith("\"") and arg.endswith("\"") \ No newline at end of file + return arg.startswith("\"") and arg.endswith("\"") diff --git a/cuckoo/processing/static.py b/cuckoo/processing/static.py index 7e2efd5d5..bd3f12d11 100644 --- a/cuckoo/processing/static.py +++ b/cuckoo/processing/static.py @@ -37,13 +37,7 @@ from cuckoo.common.utils import convert_to_printable, to_unicode, jsbeautify from cuckoo.compat import magic from cuckoo.misc import cwd, dispatch, Structure -from elftools.elf.elffile import ELFFile from elftools.elf.constants import E_FLAGS -from elftools.elf.enums import ENUM_D_TAG -from elftools.elf.dynamic import DynamicSection -from elftools.elf.relocation import RelocationSection -from elftools.elf.sections import SymbolTableSection -from elftools.elf.segments import NoteSegment from elftools.elf.descriptions import ( describe_ei_class, describe_ei_data, describe_ei_version, describe_ei_osabi, describe_e_type, describe_e_machine, @@ -51,6 +45,12 @@ from elftools.elf.descriptions import ( describe_sh_type, describe_dyn_tag, describe_symbol_type, describe_symbol_bind, describe_note, describe_reloc_type ) +from elftools.elf.dynamic import DynamicSection +from elftools.elf.elffile import ELFFile +from elftools.elf.enums import ENUM_D_TAG +from elftools.elf.relocation import RelocationSection +from elftools.elf.sections import SymbolTableSection +from elftools.elf.segments import NoteSegment log = logging.getLogger(__name__) @@ -752,10 +752,6 @@ class LnkShortcut(object): extra, ret["icon"] = self.read_string16(extra) return ret -def _pdf_worker(filepath): - return PdfDocument(filepath).run() - - class ELF(object): def __init__(self, file_path): self.file_path = file_path @@ -772,8 +768,7 @@ class ELF(object): self.result["symbol_tables"] = self._get_symbol_tables() self.result["relocations"] = self._get_relocations() self.result["notes"] = self._get_notes() - # TODO: add library name per import - # https://github.com/cuckoosandbox/cuckoo/pull/807/files#diff-033aeda7c00b458591305630264df6d3R604 + # TODO: add library name per import (see #807) except Exception as e: log.exception(e) @@ -802,7 +797,7 @@ class ELF(object): "number_of_program_headers": self.elf.header["e_phnum"], "size_of_section_headers": self.elf.header["e_shentsize"], "number_of_section_headers": self.elf.header["e_shnum"], - "section_header_string_table_index": self.elf.header["e_shstrndx"] + "section_header_string_table_index": self.elf.header["e_shstrndx"], } def _get_section_headers(self): @@ -812,7 +807,7 @@ class ELF(object): "name": section.name, "type": describe_sh_type(section["sh_type"]), "addr": self._print_addr(section["sh_addr"]), - "size": section["sh_size"] + "size": section["sh_size"], }) return section_headers @@ -823,36 +818,44 @@ class ELF(object): "type": describe_p_type(segment["p_type"]), "addr": self._print_addr(segment["p_vaddr"]), "flags": describe_p_flags(segment["p_flags"]).strip(), - "size": segment["p_memsz"] + "size": segment["p_memsz"], }) return program_headers def _get_dynamic_tags(self): dynamic_tags = [] - for section in [section for section in self.elf.iter_sections() if isinstance(section, DynamicSection)]: + for section in self.elf.iter_sections(): + if not isinstance(section, DynamicSection): + continue for tag in section.iter_tags(): dynamic_tags.append({ - "tag": self._print_addr(ENUM_D_TAG.get(tag.entry.d_tag, tag.entry.d_tag)), + "tag": self._print_addr( + ENUM_D_TAG.get(tag.entry.d_tag, tag.entry.d_tag) + ), "type": tag.entry.d_tag[3:], - "value": self._parse_tag(tag) + "value": self._parse_tag(tag), }) return dynamic_tags def _get_symbol_tables(self): symbol_tables = [] - for section in [section for section in self.elf.iter_sections() if isinstance(section, SymbolTableSection)]: + for section in self.elf.iter_sections(): + if not isinstance(section, SymbolTableSection): + continue for nsym, symbol in enumerate(section.iter_symbols()): symbol_tables.append({ "value": self._print_addr(symbol["st_value"]), "type": describe_symbol_type(symbol["st_info"]["type"]), "bind": describe_symbol_bind(symbol["st_info"]["bind"]), - "ndx_name": symbol.name + "ndx_name": symbol.name, }) return symbol_tables def _get_relocations(self): relocations = [] - for section in [section for section in self.elf.iter_sections() if isinstance(section, RelocationSection)]: + for section in self.elf.iter_sections(): + if not isinstance(section, RelocationSection): + continue section_relocations = [] for rel in section.iter_relocations(): relocation = { @@ -880,19 +883,23 @@ class ELF(object): if relocation not in section_relocations: section_relocations.append(relocation) - relocations.append({"name": section.name, "entries": section_relocations}) - + relocations.append({ + "name": section.name, + "entries": section_relocations, + }) return relocations def _get_notes(self): notes = [] - for segment in [segment for segment in self.elf.iter_segments() if isinstance(segment, NoteSegment)]: + for segment in self.elf.iter_segments(): + if not isinstance(segment, NoteSegment): + continue for note in segment.iter_notes(): notes.append({ "owner": note["n_name"], "size": self._print_addr(note["n_descsz"]), "note": describe_note(note), - "name": note["n_name"] + "name": note["n_name"], }) return notes @@ -944,6 +951,8 @@ class ELF(object): return parsed +def _pdf_worker(filepath): + return PdfDocument(filepath).run() class Static(Processing): """Static analysis.""" diff --git a/tests/test_config.py b/tests/test_config.py index 2507a4c3d..ded6b0f6c 100644 --- a/tests/test_config.py +++ b/tests/test_config.py @@ -1104,13 +1104,12 @@ arch = x64 ) for machinery in machineries: Files.create( - cwd("conf"), "%s.conf" % machinery, - "[%s]\nmachines =" % machinery + cwd("conf"), "%s.conf" % machinery, "[%s]\nmachines =" % machinery ) cfg = Config.from_confdir(cwd("conf"), loose=True) cfg = migrate(cfg, "2.0.3", "2.0.4") - assert cfg['qemu']['ubuntu32']['enable_kvm'] is False - assert cfg['qemu']['ubuntu32']['snapshot'] is None + assert cfg["qemu"]["ubuntu32"]["enable_kvm"] is False + assert cfg["qemu"]["ubuntu32"]["snapshot"] is None class FullMigration(object): DIRPATH = None diff --git a/tests/test_elf.py b/tests/test_elf.py index 110fcd1ee..d81fb7a5a 100644 --- a/tests/test_elf.py +++ b/tests/test_elf.py @@ -4,7 +4,6 @@ from cuckoo.processing.static import ELF - def test_elf_static_info(): assert ELF("tests/files/busybox-i686.elf").run() == { "file_header": { @@ -26,12 +25,12 @@ def test_elf_static_info(): "start_of_program_headers": 52, "start_of_section_headers": 898052, "type": "EXEC (Executable file)", - "version": "0x1" + "version": "0x1", }, "program_headers": [ {"addr": "0x08048000", "flags": "R E", "size": 896994, "type": "LOAD"}, {"addr": "0x08123000", "flags": "RW", "size": 19012, "type": "LOAD"}, - {"addr": "0x00000000", "flags": "RW", "size": 0, "type": "GNU_STACK"} + {"addr": "0x00000000", "flags": "RW", "size": 0, "type": "GNU_STACK"}, ], "section_headers": [ {"addr": "0x00000000", "name": "", "size": 0, "type": "NULL"}, @@ -46,15 +45,14 @@ def test_elf_static_info(): {"addr": "0x08123018", "name": ".got.plt", "size": 12, "type": "PROGBITS"}, {"addr": "0x08123024", "name": ".data", "size": 904, "type": "PROGBITS"}, {"addr": "0x081233b0", "name": ".bss", "size": 18068, "type": "NOBITS"}, - {"addr": "0x00000000", "name": ".shstrtab", "size": 86, "type": "STRTAB"} + {"addr": "0x00000000", "name": ".shstrtab", "size": 86, "type": "STRTAB"}, ], "dynamic_tags": [], "notes": [], "relocations": [], - "symbol_tables": [] + "symbol_tables": [], } - def test_elf_static_info_tags(): assert ELF("tests/files/ls-x86_64.elf").run()["dynamic_tags"] == [ {"tag": "0x0000000000000001", "type": "NEEDED", "value": "Shared library: [libselinux.so.1]"}, @@ -81,10 +79,9 @@ def test_elf_static_info_tags(): {"tag": "0x000000006ffffffe", "type": "VERNEED", "value": "0x0000000000401720"}, {"tag": "0x000000006fffffff", "type": "VERNEEDNUM", "value": "1"}, {"tag": "0x000000006ffffff0", "type": "VERSYM", "value": "0x000000000040160c"}, - {"tag": "0x0000000000000000", "type": "NULL", "value": "0x0000000000000000"} + {"tag": "0x0000000000000000", "type": "NULL", "value": "0x0000000000000000"}, ] - def test_elf_static_info_symbols(): assert ELF("tests/files/ls-x86_64.elf").run()["symbol_tables"] == [ {"bind": "LOCAL", "ndx_name": "", "type": "NOTYPE", "value": "0x0000000000000000"}, @@ -223,10 +220,9 @@ def test_elf_static_info_symbols(): {"bind": "GLOBAL", "ndx_name": "_obstack_begin_1", "type": "FUNC", "value": "0x00000000004127a0"}, {"bind": "GLOBAL", "ndx_name": "_obstack_newchunk", "type": "FUNC", "value": "0x00000000004127c0"}, {"bind": "GLOBAL", "ndx_name": "malloc", "type": "FUNC", "value": "0x0000000000402790"}, - {"bind": "GLOBAL", "ndx_name": "stdout", "type": "OBJECT", "value": "0x000000000061e608"} + {"bind": "GLOBAL", "ndx_name": "stdout", "type": "OBJECT", "value": "0x000000000061e608"}, ] - def test_elf_static_info_notes(): assert ELF("tests/files/ls-x86_64.elf").run()["notes"] == [ { @@ -241,10 +237,10 @@ def test_elf_static_info_notes(): "note": "NT_GNU_BUILD_ID (unique build ID bitstring)\n" + " Build ID: eca98eeadafddff44caf37ae3d4b227132861218", "owner": "GNU", - "size": "0x0000000000000014"} + "size": "0x0000000000000014", + }, ] - def test_elf_static_info_relocations(): assert ELF("tests/files/ls-x86_64.elf").run()["relocations"] == [ { @@ -1087,7 +1083,7 @@ def test_elf_static_info_relocations(): "offset": "0x000000000061e390", "type": "R_X86_64_JUMP_SLOT", "value": "0x0000000000000000" - } + }, ], - } + }, ] diff --git a/tests/test_qemu.py b/tests/test_qemu.py index 1ad2b6d18..5e2d766ea 100644 --- a/tests/test_qemu.py +++ b/tests/test_qemu.py @@ -1,4 +1,4 @@ -# Copyright (C) 2016-2017 Cuckoo Foundation. +# Copyright (C) 2017 Cuckoo Foundation. # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org # See the file 'docs/LICENSE' for copying permission. @@ -13,7 +13,6 @@ from cuckoo.core.init import write_cuckoo_conf from cuckoo.machinery.qemu import QEMU from cuckoo.misc import set_cwd, cwd - class TestQemu(object): def setup(self): set_cwd(tempfile.mkdtemp()) diff --git a/tests/test_stap.py b/tests/test_stap.py index d776b3be9..c1c51f6bb 100644 --- a/tests/test_stap.py +++ b/tests/test_stap.py @@ -2,9 +2,9 @@ # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org # See the file "docs/LICENSE" for copying permission. -from cuckoo.processing.platform.linux import StapParser import datetime +from cuckoo.processing.platform.linux import StapParser def test_staplog(): with open("tests/files/stap.log") as fd: @@ -22,7 +22,7 @@ def test_staplog(): "LANG=en_US.UTF-8", "SHELL=/bin/sh", "PWD=/root" - ] + ], }, "instruction_pointer": "b774dcf9", "pid": 680, @@ -31,7 +31,7 @@ def test_staplog(): "return_value": "-2", "status": "ENOENT", "time": datetime.datetime(2017, 6, 19, 16, 58, 31, 445170), - "type": "apicall" + "type": "apicall", }, { "api": "brk", @@ -45,7 +45,7 @@ def test_staplog(): "return_value": "-2118402048", "status": "", "time": datetime.datetime(2017, 6, 19, 16, 58, 31, 517266), - "type": "apicall" + "type": "apicall", }, { "api": "access", @@ -60,7 +60,8 @@ def test_staplog(): "return_value": "-2", "status": "ENOENT", "time": datetime.datetime(2017, 6, 19, 16, 58, 31, 521264), - "type": "apicall"}, + "type": "apicall", + }, { "api": "mmap2", "arguments": { @@ -69,7 +70,7 @@ def test_staplog(): "p2": "PROT_READ|PROT_WRITE", "p3": "MAP_PRIVATE|MAP_ANONYMOUS", "p4": "-1", - "p5": "0" + "p5": "0", }, "instruction_pointer": "b7783970", "pid": 680, @@ -78,14 +79,14 @@ def test_staplog(): "return_value": "0xb7764000", "status": "", "time": datetime.datetime(2017, 6, 19, 16, 58, 31, 550890), - "type": "apicall" + "type": "apicall", }, { "api": "write", "arguments": { "p0": "1", "p1": "h3ll0 w0rld!\n", - "p2": "13" + "p2": "13", }, "instruction_pointer": "b7768cf9", "pid": 681, @@ -94,14 +95,14 @@ def test_staplog(): "return_value": "13", "status": "", "time": datetime.datetime(2017, 6, 19, 16, 58, 32, 36988), - "type": "apicall" + "type": "apicall", }, { "api": "read", "arguments": { "p0": "10", "p1": "0x800665c0", - "p2": "8192" + "p2": "8192", }, "instruction_pointer": "b7768cf9", "pid": 681, @@ -110,7 +111,7 @@ def test_staplog(): "return_value": "0", "status": "", "time": datetime.datetime(2017, 6, 19, 16, 58, 32, 37596), - "type": "apicall" + "type": "apicall", }, { "api": "exit_group", @@ -124,7 +125,7 @@ def test_staplog(): "return_value": "", "status": "", "time": datetime.datetime(2017, 6, 19, 16, 58, 32, 37898), - "type": "apicall" + "type": "apicall", }, { "api": "wait4", @@ -132,7 +133,7 @@ def test_staplog(): "p0": "-1", "p1": "0xbfd4a134", "p2": "0x0", - "p3": "0x0" + "p3": "0x0", }, "instruction_pointer": "b7769cf9", "pid": 680, @@ -141,19 +142,19 @@ def test_staplog(): "return_value": "681", "status": "", "time": datetime.datetime(2017, 6, 19, 16, 58, 31, 850098), - "type": "apicall" + "type": "apicall", }, { "api": "sigreturn", - "arguments": { }, - "instruction_pointer": "b7769cf9", - "pid": 680, - "process_name": "sh", - "raw": "Mon Jun 19 16:58:32 2017.051317 sh@b7769cf9[680] sigreturn() = 681\n", - "return_value": "681", - "status": "", - "time": datetime.datetime(2017, 6, 19, 16, 58, 32, 51317), - "type": "apicall" + "arguments": {}, + "instruction_pointer": "b7769cf9", + "pid": 680, + "process_name": "sh", + "raw": "Mon Jun 19 16:58:32 2017.051317 sh@b7769cf9[680] sigreturn() = 681\n", + "return_value": "681", + "status": "", + "time": datetime.datetime(2017, 6, 19, 16, 58, 32, 51317), + "type": "apicall", }, { "api": "exit_group", @@ -167,14 +168,14 @@ def test_staplog(): "return_value": "", "status": "", "time": datetime.datetime(2017, 6, 19, 16, 58, 32, 51973), - "type": "apicall" + "type": "apicall", }, { "api": "write", "arguments": { "p0": "2", "p1": "BusyBox v1.16.0 (2010-02-06 04:51:36 CST)", - "p2": "41" + "p2": "41", }, "instruction_pointer": "80dbdde", "pid": 704, @@ -183,14 +184,14 @@ def test_staplog(): "return_value": "41", "status": "", "time": datetime.datetime(2017, 6, 20, 15, 39, 30, 141870), - "type": "apicall" + "type": "apicall", }, { "api": "write", "arguments": { "p0": "2", "p1": "Copyright (C) 1998-2009 Erik Andersen, Rob La", - "p2": "480" + "p2": "480", }, "instruction_pointer": "80dbdde", "pid": 668, @@ -199,14 +200,14 @@ def test_staplog(): "return_value": "480", "status": "", "time": datetime.datetime(2017, 6, 22, 10, 22, 6, 766807), - "type": "apicall" + "type": "apicall", }, { "api": "execve", "arguments": { "p0": "/usr/bin/sh", "p1": ["sh", "-c", "/tmp/comma,sh"], - "p2": ["COMMA_IN_ARRAY=it,works", "HOME=/root"] + "p2": ["COMMA_IN_ARRAY=it,works", "HOME=/root"], }, "instruction_pointer": "b774dcf9", "pid": 680, @@ -215,14 +216,14 @@ def test_staplog(): "return_value": "-2", "status": "ENOENT", "time": datetime.datetime(2017, 6, 19, 16, 58, 31, 445170), - "type": "apicall" + "type": "apicall", }, { "api": "execve", "arguments": { "p0": "/usr/bin/sh", "p1": ["sh", "-c", "/tmp/bracket]sh"], - "p2": ["LANGUAGE=en_US:en", "HOME=/root"] + "p2": ["LANGUAGE=en_US:en", "HOME=/root"], }, "instruction_pointer": "b774dcf9", "pid": 680, @@ -231,6 +232,6 @@ def test_staplog(): "return_value": "-2", "status": "ENOENT", "time": datetime.datetime(2017, 6, 19, 16, 58, 31, 445170), - "type": "apicall" - } + "type": "apicall", + }, ]