#NEWLINE# def create_hook_obj( search_string , content_string , condition ) : #NEWLINE# #INDENT# from cybox.objects.win_kernel_hook_object import WinKernelHook #NEWLINE# from cybox.common.digitalsignature import DigitalSignature #NEWLINE# hook = WinKernelHook ( ) #NEWLINE# ds = DigitalSignature ( ) #NEWLINE# hook_attrmap = { #NEWLINE# #INDENT# 'HookItem/HookDescription' : 'hook_description' , #NEWLINE# 'HookItem/HookedFunction' : 'hooked_function' , #NEWLINE# 'HookItem/HookedModule' : 'hooked_module' , #NEWLINE# 'HookItem/HookingAddress' : 'hooking_address' , #NEWLINE# 'HookItem/HookingModule' : 'hooking_module' , #NEWLINE# #UNINDENT# } #NEWLINE# ds_attrmap = { #NEWLINE# #INDENT# 'HookItem/DigitalSignatureHooking/CertificateIssuer' : 'certificate_issuer' , #NEWLINE# 'HookItem/DigitalSignatureHooking/CertificateSubject' : 'certificate_subject' , #NEWLINE# 'HookItem/DigitalSignatureHooking/Description' : 'signature_description' , #NEWLINE# 'HookItem/DigitalSignatureHooking/SignatureExists' : 'signature_exists' , #NEWLINE# 'HookItem/DigitalSignatureHooking/SignatureVerified' : 'signature_verified' , #NEWLINE# 'HookItem/DigitalSignatureHooked/CertificateIssuer' : 'certificate_issuer' , #NEWLINE# 'HookItem/DigitalSignatureHooked/CertificateSubject' : 'certificate_subject' , #NEWLINE# 'HookItem/DigitalSignatureHooked/Description' : 'signature_description' , #NEWLINE# 'HookItem/DigitalSignatureHooked/SignatureExists' : 'signature_exists' , #NEWLINE# 'HookItem/DigitalSignatureHooked/SignatureVerified' : 'signature_verified' , #NEWLINE# #UNINDENT# } #NEWLINE# if ( search_string in ds_attrmap ) : #NEWLINE# #INDENT# set_field ( ds , ds_attrmap [ search_string ] , content_string , condition ) #NEWLINE# if ( 'DigitalSignatureHooking' in search_string ) : #NEWLINE# #INDENT# hook . digital_signature_hooking = ds #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# hook . digital_signature_hooked = ds #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if ( search_string in hook_attrmap ) : #NEWLINE# #INDENT# set_field ( hook , hook_attrmap [ search_string ] , content_string , condition ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# #UNINDENT# return Object ( hook )