def from_obj(win_process_obj, win_process_cls = None):
if not win_process_obj:
return None
if win_process_cls == None:
winprocess_ = Process.from_obj(win_process_obj, WinProcess())
else:
winprocess_ = Process.from_obj(win_process_obj, win_process_cls)
winprocess_.aslr_enabled = win_process_obj.get_aslr_enabled()
winprocess_.dep_enabled = win_process_obj.get_dep_enabled()
winprocess_.handle_list = WinHandleList.from_obj(win_process_obj.get_Handle_List())
winprocess_.priority = String.from_obj(win_process_obj.get_Priority())
if win_process_obj.get_Section_List() is not None:
winprocess_.section_list = [Memory.from_obj(x) for x in win_process_obj.get_Section_List().get_Memory_Section()]
winprocess_.security_id = String.from_obj(win_process_obj.get_Security_ID())
winprocess_.startup_info = StartupInfo.from_obj(win_process_obj.get_Startup_Info())
winprocess_.security_type = String.from_obj(win_process_obj.get_Security_Type())
winprocess_.window_title = String.from_obj(win_process_obj.get_Window_Title())
return winprocess_
def from_obj(process_tree_node_obj):
if not process_tree_node_obj:
return None
process_tree_node_ = Process.from_obj(process_tree_node_obj, ProcessTreeNode())
process_tree_node_.id = process_tree_node_obj.get_id()
process_tree_node_.parent_action_idref = process_tree_node_obj.get_parent_action_idref()
if process_tree_node_obj.get_Initiated_Actions() is not None:
process_tree_node_.initiated_actions = ActionReferenceList.from_obj(process_tree_node_obj.get_Initiated_Actions())
process_tree_node_.spawned_processes = [ProcessTreeNode.from_obj(x) for x in process_tree_node_obj.get_Spawned_Process()]
process_tree_node_.injected_processes = [ProcessTreeNode.from_obj(x) for x in process_tree_node_obj.get_Injected_Process()]
return process_tree_node_
def _set_search_items_from_process_object(patterns, prop):
u'''
extract and set search key/value items from Cybox binding Process Object
'''
if prop is None or type(prop) != ProcessObjectType:
return
# translate cybox.bindings object to cybox.objects object
obj = Process.from_obj(prop)
# Process
if obj.name is not None:
process = unicode(obj.name)
if process[0] == '[' and process[len(process) - 1] == ']':
_add_search_item(patterns, u"ProcessName",
process[1:len(process) - 2].split(','))
else:
_add_search_item(patterns, u"ProcessName", process)
