[pull] master from kevoreilly:master

analyzer/windows/lib/api/process.py

@@ -194,7 +194,7 @@ class Process:
     # which check whether the VM has only been up for <10 minutes.
     startup_time = random.randint(1, 30) * 20 * 60 * 1000
 
-    def __init__(self, options=None, config=None, pid=0, h_process=0, thread_id=0, h_thread=0, suspended=False):
+    def __init__(self, options=None, config=None, pid=0, h_process=0, thread_id=0, h_thread=0):
         """@param pid: PID.
         @param h_process: process handle.
         @param thread_id: thread id.
@@ -208,7 +208,6 @@ def __init__(self, options=None, config=None, pid=0, h_process=0, thread_id=0, h
         self.h_process = HANDLE(h_process)
         self.thread_id = thread_id
         self.h_thread = HANDLE(h_thread)
-        self.suspended = suspended
         self.system_info = SYSTEM_INFO()
         self.critical = False
         self.path = None
@@ -627,11 +626,10 @@ def log_process_tree(self, process_name):
         except subprocess.CalledProcessError as e:
             log.error("Failed to collect %s process info: %s", process_name, e.output)
 
-    def execute(self, path, args=None, suspended=False, kernel_analysis=False):
+    def execute(self, path, args=None, kernel_analysis=False):
         """Execute sample process.
         @param path: sample path.
         @param args: process args.
-        @param suspended: is suspended.
         @return: operation status.
         """
         if not os.access(path, os.X_OK):
@@ -653,11 +651,7 @@ def execute(self, path, args=None, suspended=False, kernel_analysis=False):
             arguments += args
 
         self.path = path
-
-        creation_flags = CREATE_NEW_CONSOLE | EXTENDED_STARTUPINFO_PRESENT
-        if suspended:
-            self.suspended = True
-            creation_flags += CREATE_SUSPENDED
+        creation_flags = CREATE_NEW_CONSOLE | EXTENDED_STARTUPINFO_PRESENT | CREATE_SUSPENDED
 
         # Use the custom execution directory if provided, otherwise launch in the same location
         # where the sample resides (default %TEMP%)
@@ -697,17 +691,12 @@ def resume(self):
         """Resume a suspended thread.
         @return: operation status.
         """
-        if not self.suspended:
-            log.warning("The process with pid %d was not suspended at creation", self.pid)
-            return False
-
         if not self.h_thread:
             return False
 
         KERNEL32.Sleep(2000)
 
         if KERNEL32.ResumeThread(self.h_thread) != -1:
-            self.suspended = False
             log.info("Successfully resumed process with pid %d", self.pid)
             return True
         else:

analyzer/windows/lib/common/abstracts.py

@@ -172,23 +172,22 @@ def execute(self, path, args, interest):
         @return: process pid
         """
         free = self.options.get(OPT_FREE, False)
-        suspended = not free
 
         kernel_analysis = bool(self.options.get(OPT_KERNEL_ANALYSIS, False))
 
         p = Process(options=self.options, config=self.config)
-        if not p.execute(path=path, args=args, suspended=suspended, kernel_analysis=kernel_analysis):
+        if not p.execute(path=path, args=args, kernel_analysis=kernel_analysis):
             raise CuckooPackageError("Unable to execute the initial process, analysis aborted")
 
-        if free:
-            return None
-
-        if not kernel_analysis:
+        if not free and not kernel_analysis:
             p.inject(interest)
 
         p.resume()
         p.close()
 
+        if free:
+            return None
+
         return p.pid
 
     def package_files(self):