By defining the get_parent_pid() method to use a 64-bit compatible
structure definition, it's now able to get the parent process identifier
under 64-bit environments. This resolves the issue of self.ppid being
None and therefore crashing the zer0m0n.hidepid() method.
Thanks to shafaqat1, johnc2k, tosto92, and jhopz for reporting this.
This commit introduces Unicode support to Python 2.7's process handling,
especially to the spawning of new processes which is handled by the
_subprocess module and uses CreateProcessA internally. Note that this
has already been resolved on Python 3's branch.
During our Windows unit tests on AppVeyor the lib/api/process.py is
imported during all unit tests, due to which all invocations of
_subprocess.CreateProcess go through our code. Therefore we handle some
edge cases that we'll never be needing in the Cuckoo Analyzer but are
nonetheless useful as reference implementation and/or for completeness.
Furthermore it should be noted that this changes the "trigger" attribute
in the configuration for Cuckoo Monitor from ASCII to UTF-8 which
requires [1] on the Cuckoo Monitor side to be used correctly. Due to
UTF-8 being ASCII compatible, this should be backwards compatible.
Finally it removes monitor/latest from hashes.txt and introduces a
cmd.exe-based Unicode command-line unit test as Python 2.7's python.exe
doesn't support Unicode command-line arguments either (apparently).
[1]: https://github.com/cuckoosandbox/monitor/commit/e071e63a66e831163a40abc45109fdf71fee829e
In the past we've attempted to use Capcom to disable Driver Signature
Enforcement. With a more permanent solution upcoming, it is safe to
remove this functionality.
This commit modifies some parts of the Cuckoo Analyzer logic to ensure a
more smooth usage in situations where there would in the past be errors.
* Uses the error message from is32bit.exe in the CuckooError exception.
Now that is32bit.exe will no longer throw "access denied" message
boxes, but instead print a simple message, this will help propagate
and handle the exact errors.
* Make the dump TLS master secrets module aware of this change and have
it properly handle access denied issues. That is, rather than throwing
a hard crash, it will now provide a simple warning to the end user. In
the future this should be shown prominently in the Web Interface.
* A couple of unit tests are introduced to test the above as well as
various stability improvements in the is32bit.exe utility when it
looks at potential MZ-DOS/PE files.
Conflicts:
cuckoo/data-private/cwd/hashes.txt
tests/utils.py
tests/windows/test_process.py
In the past year people have been confused by the random files appearing
on the Desktop. With this change we modify this default path from the
Desktop to the "Documents" or "My Documents" directory (or a localized
version of that directory). This way it's less obvious (i.e., not to be
seen in the screenshots) and hopefully make less people confused.
The PR identified the issue, but resolved it incorrectly. Instead,
properly log unicode strings in the Cuckoo Guest already. We should
still feature something to avoid hard crashes on the Host, though.
This could be a temporary patch as surely there is a better approach,
but this has been tested as working. We have yet to write CWD migration
code, though. Fixes problems reported in #1486#1484#1430#1419.
Provided that the Python installation directory has a directory called
Lib, mock apparently doesn't properly import our "lib" directory. We
therefore have to slightly modify our unittests accordingly.
* Make hard errors out of incorrect requests to the new Cuckoo Agent as
otherwise things fail silently which makes it harder to debug.
* Pass along a dummy filename when storing the sample, rather than its
real name. The actual filepath where it will be stored is passed along
in a separate variable anyway. This prevents unicode parsing issues on
the new Cuckoo Agent side.
* Bump the default Agent to 0.7 as it contains unicode parsing tweaks.
* Remove superfluous exception handling which only made debugging worse.
By catching the errors and then throwing only the error message we're
missing out on the most crucial part of the errors, their stacktraces.
Can't unittest it currently, but it has been tested to provide much
better feedback to the Host in the case an exception occurs.
* Fix unicode vs ascii issue when the file to-be-analyzed is missing,
which happened due to the other unicode issues mentioned above, in
some (non-realistic) situations resulting in a completely unrelated
(but fatal) error message.
We'll be working on reducing the amount of warnings, errors, and
exceptions thrown around in the Cuckoo Analyzer in order to confuse our
users less and let our unittests work properly (which trigger a failure
upon such events). Introduces unit tests for the Cuckoo Analyzer.
Jurriaan Bremer