# Path: lib/cuckoo/common/abstracts.py
# class Processing(object):
#     """Base abstract class for processing module."""
#     order = 1
#     enabled = True
# 
#     def __init__(self):
#         self.analysis_path = ""
#         self.logs_path = ""
#         self.task = None
#         self.options = None
# 
#     def set_options(self, options):
#         """Set report options.
#         @param options: report options dict.
#         """
#         self.options = options
# 
#     def set_task(self, task):
#         """Add task information.
#         @param task: task dictionary.
#         """
#         self.task = task
# 
#     def set_path(self, analysis_path):
#         """Set paths.
#         @param analysis_path: analysis folder path.
#         """
#         self.analysis_path = analysis_path
#         self.log_path = os.path.join(self.analysis_path, "analysis.log")
#         self.file_path = os.path.realpath(os.path.join(self.analysis_path,
#                                                        "binary"))
#         self.dropped_path = os.path.join(self.analysis_path, "files")
#         self.logs_path = os.path.join(self.analysis_path, "logs")
#         self.shots_path = os.path.join(self.analysis_path, "shots")
#         self.pcap_path = os.path.join(self.analysis_path, "dump.pcap")
#         self.pmemory_path = os.path.join(self.analysis_path, "memory")
#         self.memory_path = os.path.join(self.analysis_path, "memory.dmp")
# 
#     def run(self):
#         """Start processing.
#         @raise NotImplementedError: this method is abstract.
#         """
#         raise NotImplementedError
# 
# Path: lib/cuckoo/common/config.py
# class Config:
#     """Configuration file parser."""
# 
#     def __init__(self, file_name="cuckoo", cfg=None):
#         """
#         @param file_name: file name without extension.
#         @param cfg: configuration file path.
#         """
#         config = ConfigParser.ConfigParser()
# 
#         if cfg:
#             config.read(cfg)
#         else:
#             config.read(os.path.join(CUCKOO_ROOT, "conf", "%s.conf" % file_name))
# 
#         for section in config.sections():
#             setattr(self, section, Dictionary())
#             for name, raw_value in config.items(section):
#                 try:
#                     # Ugly fix to avoid '0' and '1' to be parsed as a
#                     # boolean value.
#                     # We raise an exception to goto fail^w parse it
#                     # as integer.
#                     if config.get(section, name) in ["0", "1"]:
#                         raise ValueError
# 
#                     value = config.getboolean(section, name)
#                 except ValueError:
#                     try:
#                         value = config.getint(section, name)
#                     except ValueError:
#                         value = config.get(section, name)
# 
#                 setattr(getattr(self, section), name, value)
# 
#     def get(self, section):
#         """Get option.
#         @param section: section to fetch.
#         @raise CuckooOperationalError: if section not found.
#         @return: option value.
#         """
#         try:
#             return getattr(self, section)
#         except AttributeError as e:
#             raise CuckooOperationalError("Option %s is not found in "
#                                          "configuration, error: %s" %
#                                          (section, e))
# 
# Path: lib/cuckoo/common/utils.py
# def convert_to_printable(s):
#     """Convert char to printable.
#     @param s: string.
#     @return: sanitized string.
#     """
#     if is_printable(s):
#         return s
#     return "".join(convert_char(c) for c in s)
# 
# def logtime(dt):
#     """Formats time like a logger does, for the csv output
#        (e.g. "2013-01-25 13:21:44,590")
#     @param dt: datetime object
#     @return: time string
#     """
#     t = time.strftime("%Y-%m-%d %H:%M:%S", dt.timetuple())
#     s = "%s,%03d" % (t, dt.microsecond/1000)
#     return s
# 
# Path: lib/cuckoo/common/utils.py
# def cleanup_value(v):
#     """Cleanup utility function, strips some unwanted parts from values."""
#     v = str(v)
#     if v.startswith("\\??\\"):
#         v = v[4:]
#     return v


import os
import logging
import datetime
from lib.cuckoo.common.abstracts import Processing
from lib.cuckoo.common.config import Config
from lib.cuckoo.common.netlog import NetlogParser, BsonParser
from lib.cuckoo.common.utils import convert_to_printable, logtime
from lib.cuckoo.common.utils import cleanup_value

        nextcall, self.lastcall = self.lastcall, None

        self.wait_for_lastcall()
        while self.lastcall and self.compare_calls(nextcall, self.lastcall):
            nextcall["repeated"] += 1
            self.lastcall = None
            self.wait_for_lastcall()

        nextcall["id"] = self.call_id
        self.call_id += 1

        return nextcall

    def log_process(self, context, timestring, pid, ppid, modulepath, procname):
        self.process_id, self.parent_id, self.process_name = pid, ppid, procname
        self.first_seen = timestring

    def log_thread(self, context, pid):
        pass

    def log_anomaly(self, subcategory, tid, funcname, msg):
        self.lastcall = dict(thread_id=tid, category="anomaly", api="",
                             subcategory=subcategory, funcname=funcname,
                             msg=msg)

    def log_call(self, context, apiname, category, arguments):
        apiindex, status, returnval, tid, timediff = context

        current_time = self.first_seen + datetime.timedelta(0, 0, timediff*1000)

# Path: lib/cuckoo/common/abstracts.py
# class Processing(object):
#     """Base abstract class for processing module."""
#     order = 1
#     enabled = True
# 
#     def __init__(self):
#         self.analysis_path = ""
#         self.logs_path = ""
#         self.task = None
#         self.options = None
# 
#     def set_options(self, options):
#         """Set report options.
#         @param options: report options dict.
#         """
#         self.options = options
# 
#     def set_task(self, task):
#         """Add task information.
#         @param task: task dictionary.
#         """
#         self.task = task
# 
#     def set_path(self, analysis_path):
#         """Set paths.
#         @param analysis_path: analysis folder path.
#         """
#         self.analysis_path = analysis_path
#         self.log_path = os.path.join(self.analysis_path, "analysis.log")
#         self.file_path = os.path.realpath(os.path.join(self.analysis_path,
#                                                        "binary"))
#         self.dropped_path = os.path.join(self.analysis_path, "files")
#         self.logs_path = os.path.join(self.analysis_path, "logs")
#         self.shots_path = os.path.join(self.analysis_path, "shots")
#         self.pcap_path = os.path.join(self.analysis_path, "dump.pcap")
#         self.pmemory_path = os.path.join(self.analysis_path, "memory")
#         self.memory_path = os.path.join(self.analysis_path, "memory.dmp")
# 
#     def run(self):
#         """Start processing.
#         @raise NotImplementedError: this method is abstract.
#         """
#         raise NotImplementedError
# 
# Path: lib/cuckoo/common/config.py
# class Config:
#     """Configuration file parser."""
# 
#     def __init__(self, file_name="cuckoo", cfg=None):
#         """
#         @param file_name: file name without extension.
#         @param cfg: configuration file path.
#         """
#         config = ConfigParser.ConfigParser()
# 
#         if cfg:
#             config.read(cfg)
#         else:
#             config.read(os.path.join(CUCKOO_ROOT, "conf", "%s.conf" % file_name))
# 
#         for section in config.sections():
#             setattr(self, section, Dictionary())
#             for name, raw_value in config.items(section):
#                 try:
#                     # Ugly fix to avoid '0' and '1' to be parsed as a
#                     # boolean value.
#                     # We raise an exception to goto fail^w parse it
#                     # as integer.
#                     if config.get(section, name) in ["0", "1"]:
#                         raise ValueError
# 
#                     value = config.getboolean(section, name)
#                 except ValueError:
#                     try:
#                         value = config.getint(section, name)
#                     except ValueError:
#                         value = config.get(section, name)
# 
#                 setattr(getattr(self, section), name, value)
# 
#     def get(self, section):
#         """Get option.
#         @param section: section to fetch.
#         @raise CuckooOperationalError: if section not found.
#         @return: option value.
#         """
#         try:
#             return getattr(self, section)
#         except AttributeError as e:
#             raise CuckooOperationalError("Option %s is not found in "
#                                          "configuration, error: %s" %
#                                          (section, e))
# 
# Path: lib/cuckoo/common/utils.py
# def convert_to_printable(s):
#     """Convert char to printable.
#     @param s: string.
#     @return: sanitized string.
#     """
#     if is_printable(s):
#         return s
#     return "".join(convert_char(c) for c in s)
# 
# def logtime(dt):
#     """Formats time like a logger does, for the csv output
#        (e.g. "2013-01-25 13:21:44,590")
#     @param dt: datetime object
#     @return: time string
#     """
#     t = time.strftime("%Y-%m-%d %H:%M:%S", dt.timetuple())
#     s = "%s,%03d" % (t, dt.microsecond/1000)
#     return s
# 
# Path: lib/cuckoo/common/utils.py
# def cleanup_value(v):
#     """Cleanup utility function, strips some unwanted parts from values."""
#     v = str(v)
#     if v.startswith("\\??\\"):
#         v = v[4:]
#     return v


# Path: modules/processing/behavior.py
import os
import logging
import datetime
from lib.cuckoo.common.abstracts import Processing
from lib.cuckoo.common.config import Config
from lib.cuckoo.common.netlog import NetlogParser, BsonParser
from lib.cuckoo.common.utils import convert_to_printable, logtime
from lib.cuckoo.common.utils import cleanup_value


        nextcall, self.lastcall = self.lastcall, None

        self.wait_for_lastcall()
        while self.lastcall and self.compare_calls(nextcall, self.lastcall):
            nextcall["repeated"] += 1
            self.lastcall = None
            self.wait_for_lastcall()

        nextcall["id"] = self.call_id
        self.call_id += 1

        return nextcall

    def log_process(self, context, timestring, pid, ppid, modulepath, procname):
        self.process_id, self.parent_id, self.process_name = pid, ppid, procname
        self.first_seen = timestring

    def log_thread(self, context, pid):
        pass

    def log_anomaly(self, subcategory, tid, funcname, msg):
        self.lastcall = dict(thread_id=tid, category="anomaly", api="",
                             subcategory=subcategory, funcname=funcname,
                             msg=msg)

    def log_call(self, context, apiname, category, arguments):
        apiindex, status, returnval, tid, timediff = context

        current_time = self.first_seen + datetime.timedelta(0, 0, timediff*1000)

        timestring = logtime(current_time)