FeatureHooklog3.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "%run Hooklog3.ipynb"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "import os"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "APIParRet = {\n",
    "    # LIB\n",
    "    \"LoadLibrary\": [[\"lpFileName\"], [\"Return\",\"result\"]],\n",
    "    # PROC\n",
    "    #\"CreateProcess\": [[], [\"Return\",\"result\"]], # MIKE: this one has been removed by someone\n",
    "    \"CreateProcessInternal\": [[\"lpApplicationName\"], [\"Return\",\"result\"]],\n",
    "    \"OpenProcess\": [[], [\"Return\",\"result\"]], # it has procName, but might be empty\n",
    "    \"ExitProcess\": [[], [\"Return\",\"result\"]],\n",
    "    \"WinExec\": [[\"CmdLine\"], [\"Return\",\"result\"]],\n",
    "    \"CloseHandle\": [[], [\"Return\",\"result\"]],\n",
    "    \"CreateRemoteThread\": [[], [\"Return\",\"result\"]], # it has procName, but might be empty\n",
    "    \"TerminateProcess\": [[], [\"Return\",\"result\"]],\n",
    "    \"TerminateThread\": [[\"hThread\"], [\"Return\",\"result\"]],\n",
    "    \"CreateThread\": [[\"dwThreadId\"], [\"Return\",\"result\"]],\n",
    "    \"OpenThread\": [[\"dwThreadId\"], [\"Return\",\"result\"]],\n",
    "    # FILE\n",
    "    \"CopyFile\": [[\"lpExistingFileName\"], [\"Return\",\"result\"]], # include lpNewFileName?\n",
    "    \"CreateFile\": [[\"hName\", \"desiredAccess\"], [\"Return\",\"result\"]], #MIKE: actually it is 'lpFileName' in spec.\n",
    "    \"WriteFile\": [[], [\"Return\",\"result\"]],\n",
    "    \"ReadFile\": [[], [\"Return\",\"result\"]],\n",
    "    \"DeleteFile\": [[\"fileName\"], [\"Return\",\"result\"]], #MIKE: actually it is 'lpFileName' in spec.\n",
    "    # REG\n",
    "    \"RegOpenCurrentUser\": [[], [\"Return\",\"result\"]],\n",
    "    \"RegQueryValue\": [[\"hKey\"], [\"Return\",\"result\"]],\n",
    "    \"RegEnumValue\": [[\"hKey\"], [\"Return\",\"result\"]],\n",
    "    \"RegOpenKey\": [[\"hKey\"], [\"Return\",\"result\"]],\n",
    "    \"RegCloseKey\": [[\"hKey\"], [\"Return\",\"result\"]],\n",
    "    \"RegSetValue\": [[\"hKey\"], [\"Return\",\"result\"]],\n",
    "    \"RegCreateKey\": [[\"hKey\"], [\"Return\",\"result\"]],\n",
    "    \"=RegDeleteKey\": [[\"hKey\"], [\"Return\",\"result\"]], # MIKE: misprint the '=' #============\n",
    "    \"RegDeleteKey\": [[\"hKey\"], [\"Return\",\"result\"]], # MIKE: misprint the '='\n",
    "    \"RegDeleteValue\": [[\"hKey\"], [\"Return\",\"result\"]],\n",
    "    # NET winhttp.dll\n",
    "    \"WinHttpConnect\": [[\"pswzServerName\"], [\"Return\",\"result\"]],\n",
    "    \"WinHttpCreateUrl\": [[\"wszUrl\"], [\"Return\",\"result\"]],\n",
    "    \"WinHttpOpen\": [[\"pwszUserAgent\"], [\"Return\",\"result\"]],\n",
    "    \"WinHttpOpenRequest\": [[\"pwszObjectName\"], [\"Return\",\"result\"]],\n",
    "    \"WinHttpReadData\": [[\"lpBuffer\"], [\"Return\",\"result\"]],\n",
    "    \"WinHttpSendRequest\": [[\"pwszHeaders\"], [\"Return\",\"result\"]],\n",
    "    \"WinHttpWriteData\": [[\"lpBuffer\"], [\"Return\",\"result\"]],\n",
    "    \"WinHttpGetProxyForUrl\": [[\"lpcwszUrl\"], [\"Return\",\"result\"]],\n",
    "    # NET winnet32.dll\n",
    "    \"InternetOpen\": [[\"lpszAgent\"], [\"Return\",\"result\"]],\n",
    "    \"InternetConnect\": [[\"lpszServerName\"], [\"Return\",\"result\"]],\n",
    "    \"HttpSendRequest\": [[\"lpszHeaders\"], [\"Return\",\"result\"]],\n",
    "    \"GetUrlCacheEntryInfo\": [[\"lpszUrlName\"], [\"Return\",\"result\"]],\n",
    "}\n",
    "\n",
    "API_list = APIParRet.keys()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# -1:keep, 0:*, 1:1stLayer,10:negative, 20:postivite, 30:include\n",
    "subPathDict = {\n",
    "    \"control panel\": {'desktop': (-1,'desktop')},\n",
    "    \"system\": {\n",
    "        'setup': (-1,'sys_setup'),\n",
    "        'controlset001':{'control':{'class': (0,'sys_ctlSet001_ctl_class\\\\*')}},\n",
    "        'currentcontrolset':{\n",
    "            'control':{\n",
    "                'session manager': (0,'sys_curCtlSet_ctl_sessionManager\\\\*'),\n",
    "                'mediaproperties': (0,'sys_curCtlSet_ctl_mediaProperties\\\\*'),\n",
    "                'productoptions': (0,'sys_curCtlSet_ctl_productoptions\\\\*')},\n",
    "            'services':{\n",
    "                'netbt': (0,'sys_curCtlSet_svc_netbt\\\\*'),\n",
    "                'tcpip': (10,'sys_curCtlSet_svc_tcpip', ['max','min','timeout']),\n",
    "                'dnscache': (10,'sys_curCtlSet_svc_dnscache', ['max','min','timeout']),\n",
    "                'ldap': (10,'sys_curCtlSet_svc_ldap', ['max','min','timeout']),\n",
    "                'winsock': (10,'sys_curCtlSet_winsock', ['max','min','timeout']),\n",
    "                'winsock2':{\n",
    "                    'parameters':{\n",
    "                        'protocol_catalog9': (0,'sys_curCtlSet_svc_winsock2_catalog9\\\\*'),\n",
    "                        'namespace_catalog5': (0,'sys_curCtlSet_svc_winsock2_catalog5\\\\*'),\n",
    "                        'ELSE' : (10,'sys_curCtlSet_svc_winsock2', ['max','min','timeout'])}, #\n",
    "                    'ELSE' : (10,'sys_curCtlSet_svc_winsock2', ['max','min','timeout'])}, #\n",
    "                'windows test 5.0': (1,'sys_curCtlSet_svc_winTest5.0')}},\n",
    "        'ELSE':(-1,'sys')\n",
    "    },\n",
    "    'software':{\n",
    "        'microsoft':{\n",
    "            'commandprocessor': (0,'soft_ms_commandprocessor\\\\*'),\n",
    "            'audiocompressionmanager': (0,'soft_ms_audiocompressionmanager\\\\*'),\n",
    "            'multimedia':{\n",
    "                'audio compression manager': (0,'soft_ms_mulitimedia_audiocompressionmanager\\\\*'),\n",
    "                'ELSE' :(20,'soft_ms_multimedia',['audio'])},\n",
    "            'ole': (0,'soft_ms_ole\\\\*'),\n",
    "            'ctf': (0,'soft_ms_ctf\\\\*'),\n",
    "            'com3': (0,'soft_ms_com3\\\\*'),\n",
    "            'tracing': (1,'soft_ms_tracing'),\n",
    "            'internet explorer':{'main':{'featurecontrol':(-1,'soft_ms_IE_featureCtl')}},\n",
    "            'rpc': (10,'soft_ms_rpc', ['max','min','timeout']),\n",
    "            'wbem':{\n",
    "                'cimom': (20,'soft_ms_wbem_cimom', ['log']),\n",
    "                'wmic': (0,'soft_ms_wbem_wmic\\\\*')},\n",
    "            'windows nt':{'currentversion':{\n",
    "                    'languagepack':(0,'soft_ms_winNT_languagepack\\\\*'),\n",
    "                    'winlogon':(0,'soft_ms_winNT_winlogon\\\\*'),\n",
    "                    'fontlink':(0,'soft_ms_winNT_fontlink\\\\*'),\n",
    "                    'fontsubstitutes':(0,'soft_ms_winNT_fontsubstitutes\\\\*'),\n",
    "                    'imm':(0,'soft_ms_winNT_imm\\\\*'),\n",
    "                    'csdversion':(0,'soft_ms_winNT_csdversion\\\\*')}},\n",
    "            'windows':{\n",
    "                'currentversion':{\n",
    "                    'thememanager':(0,'soft_ms_win_thememanager\\\\*'),\n",
    "                    'telephony':(0,'soft_ms_win_telephony\\\\*'),\n",
    "                    'profilelist':(0,'soft_ms_win_profilelist\\\\*'),\n",
    "                    'programfilesdir':(0,'soft_ms_win_programfilesdir\\\\*'),\n",
    "                    'commonfilesdir':(0,'soft_ms_win_commonfilesdir\\\\*'),\n",
    "                    'explorer':{\n",
    "                        'user shell folders': (0,'soft_ms_win_explorer_userShellFolder\\\\*'),\n",
    "                        'shell folders': (0,'soft_ms_win_explorer_shellFolders\\\\*'),\n",
    "                        'ELSE' : (-1,'soft_ms_win_explorer')},\n",
    "                    'internet settings':{\n",
    "                        'zones':(0,'soft_ms_win_internetSettings_zones\\\\*'),\n",
    "                        'cache':{'paths':(0,'soft_ms_win_internetSettings_cache_paths\\\\*')},\n",
    "                        'ELSE':(10,'soft_ms_win_internetSettings', ['max','min','timeout','length','bound','limit','timesecs','range'])},\n",
    "                    'ELSE':(-1,'soft_ms_win_currentversion')\n",
    "                }}\n",
    "        }\n",
    "    },\n",
    "    'clsid':{'{REG}':{\n",
    "            'inprocserver32':(0,'clsid_{REG}_inprocserver32\\\\*'),\n",
    "            'appid':(0,'clsid_{REG}_appid\\\\*')\n",
    "        }},\n",
    "    'appid':{'{REG}':(0,'appid_{REG}\\\\*')},\n",
    "    'interface':{'{REG}':{'proxystubclsid32':(0,'interface_{REG}_proxystubclsid32\\\\*')}},\n",
    "    '{REG}':{\n",
    "        'environment':(-1,'{REG}_envr'),\n",
    "        'volatile environment':(-1,'{REG}_volatileEnvr')\n",
    "    }\n",
    "}\n",
    "\n",
    "# -1:keep, 0:*, 1:1stLayer,10:negative, 20:postivite,\n",
    "def subPathstrim(subpath): # -1, 0, 10, 20\n",
    "    subFlag = False\n",
    "    startIndex = 0\n",
    "    startToken = ''\n",
    "    returnVal = ''\n",
    "    \n",
    "    tokens = subpath.split('\\\\')\n",
    "    for i, token in enumerate(tokens):\n",
    "        if token in subPathDict:\n",
    "            startIndex = i\n",
    "            startToken = token\n",
    "            break\n",
    "        else:\n",
    "            return ('\\\\').join(tokens)\n",
    "\n",
    "    endIndex = startIndex\n",
    "    endToken = startToken\n",
    "    tmpDict = subPathDict\n",
    "    endFlag = True if type(tmpDict[endToken])==tuple else False\n",
    "    \n",
    "    while( not endFlag ): # not to the end \n",
    "        tmpDict = tmpDict[endToken]\n",
    "        endIndex += 1\n",
    "        endToken = tokens[endIndex]\n",
    "        if endToken in tmpDict:\n",
    "            endFlag = True if type(tmpDict[endToken])==tuple else False\n",
    "        else:\n",
    "            endToken = 'ELSE'\n",
    "            endIndex -= 1\n",
    "            break\n",
    "    \n",
    "    #print subPath ####\n",
    "    subType = tmpDict[endToken][0]\n",
    "    subString = tmpDict[endToken][1]\n",
    "    keepFrontString = ('\\\\').join(tokens[:startIndex])\n",
    "    \n",
    "    if subType == 0:\n",
    "        returnVal = keepFrontString + subString\n",
    "    elif subType == -1:\n",
    "        keepEndtString = ('\\\\').join(tokens[endIndex+1:])\n",
    "        returnVal = keepFrontString + subString + '\\\\' + keepEndtString\n",
    "    elif subType == 1:\n",
    "        keepEndtString = ('\\\\').join(tokens[endIndex+1:endIndex+2])\n",
    "        returnVal = keepFrontString + subString + '\\\\' + keepEndtString\n",
    "    elif subType == 10:\n",
    "        ignoreli = tmpDict[endToken][2]\n",
    "        keepEndtString = ('\\\\').join(tokens[endIndex+1:])\n",
    "        keepFlag = True\n",
    "        for k in ignoreli:\n",
    "            if k in keepEndtString:\n",
    "                returnVal = keepFrontString + subString + '\\\\*'\n",
    "                keepFlag = False\n",
    "                break\n",
    "        if keepFlag:\n",
    "            returnVal = keepFrontString + subString + '\\\\' + keepEndtString\n",
    "    elif subType == 20:\n",
    "        keepli = tmpDict[endToken][2]\n",
    "        keepEndtString = ('\\\\').join(tokens[endIndex+1:])\n",
    "        ignoreFlag = True\n",
    "        for k in keepli:\n",
    "            if k in keepEndtString:\n",
    "                returnVal = keepFrontString + subString + '\\\\'+ k\n",
    "                ignoreFlag = False\n",
    "                break\n",
    "        if ignoreFlag:\n",
    "            returnVal = keepFrontString + subString + '\\\\*' \n",
    "    \n",
    "    return returnVal"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "#MIKE: 20170713\n",
    "def inKey(this_dict, myKey):\n",
    "    return next((key for key in this_dict if key in myKey), False) # MIKE: key in mykey is correct!!\n",
    "\n",
    "\n",
    "### MIKE: 20170714 new\n",
    "def replace_strings(key):\n",
    "    tokens = key.split('\\\\')\n",
    "\n",
    "    rvalue = \"\"\n",
    "    for token in tokens:\n",
    "        \n",
    "        # SID like token\n",
    "        if token.count('-') > 3:\n",
    "            rvalue += \"\\\\{REG}\"\n",
    "        # file like token\n",
    "        elif len(token.split('.')) >= 2 and token.split('.')[-1] in [\"exe\", \"txt\", \"bat\", \"clb\", \"dll\"] : #MIKE: 20170714, hack\n",
    "            rvalue += \"\\\\{FIL}.\" + token.split('.')[-1]\n",
    "        # mist\n",
    "        elif \"mshist\" in token:\n",
    "            rvalue += \"\\\\{MSHISTDATE}\"\n",
    "        else:\n",
    "            rvalue += ('\\\\' + token)\n",
    "            \n",
    "    # MIKE: 20170714, there was a bug in old __remove_fileName(), it removes the first \\\\ accidentally\n",
    "    # so I remove the first \\\\ here (so that subPathstrim() could work correctly).\n",
    "    if rvalue.startswith('\\\\'): rvalue = rvalue[1:]\n",
    "    if rvalue.startswith('\\\\'): rvalue = rvalue[1:]\n",
    "            \n",
    "    # sessionID\n",
    "    if \"software\\\\microsoft\\\\windows\\\\currentversion\\\\explorer\\\\sessioninfo\" in rvalue:\n",
    "        rvalue = rvalue[:rvalue.rindex('\\\\')] + \"SESSIONID\"\n",
    "\n",
    "    return rvalue\n",
    "###\n",
    "\n",
    "\n",
    "def libTrans(value):\n",
    "    global dir_dict\n",
    "    if value == \"\": return \"NON@NON@NON\" # DIR@LIB@EXT\n",
    "    \n",
    "    DIR = LIB = EXT = \"NON\" # MIKE: 20170713, use capital\n",
    "    \n",
    "    lvalue = value.lower().replace('/', '\\\\')\n",
    "    tokens = lvalue.split('\\\\')\n",
    "    \n",
    "    # DIR, MIKE: 20170714 change logic\n",
    "    #if lvalue[1] != ':': DIR = \"SYS\"\n",
    "    #elif lvalue[0] == '\\\\': DIR = \"LOC\" # MIKE: 20170713, really? != ??\n",
    "    if len(tokens) == 1:\n",
    "        DIR = \"SYS\"\n",
    "    else:\n",
    "        key = inKey(dir_dict, lvalue)\n",
    "        DIR = dir_dict[key] if key else \"ARB\"\n",
    "    \n",
    "    # LIB\n",
    "    LIB = tokens[-1].split('.')[0]\n",
    "    \n",
    "    # EXT\n",
    "    t = tokens[-1].split('.')\n",
    "    ext = t[-1]\n",
    "    if ext == \"\" or len(t) == 1: # extension is . or no extension\n",
    "        EXT = \"DLL\"\n",
    "    else:\n",
    "        EXT = ext.upper()\n",
    "    \n",
    "    return DIR+\"@\"+LIB+\"@\"+EXT\n",
    "\n",
    "\n",
    "def execTrans(value):\n",
    "    return fileTrans(value)\n",
    "\n",
    "def cmdTrans(value):\n",
    "    return value\n",
    "\n",
    "def thdTrans(value):\n",
    "    return \"NON\"\n",
    "\n",
    "def fileTrans(value):\n",
    "    global dir_dict\n",
    "    if value == \"\": return \"NON@NON\"\n",
    "    \n",
    "    DIR = EXT = \"NON\" # MIKE: 20170713, use capital\n",
    "    \n",
    "    lvalue = value.lower().replace('/', '\\\\')\n",
    "    tokens = lvalue.split('\\\\')\n",
    "    \n",
    "    # DIR, MIKE: 20170714 change logic\n",
    "    if lvalue[:4] == (\"\\\\\\\\.\\\\\"):\n",
    "        DIR = lvalue\n",
    "    elif lvalue == 'conin$' or lvalue == 'conout$':\n",
    "        DIR = 'CONSOLE'\n",
    "    elif len(tokens) == 1:\n",
    "        DIR = \"LOC\"\n",
    "    else:\n",
    "        key = inKey(dir_dict, lvalue)\n",
    "        DIR = dir_dict[key] if key != False else \"ARB\"\n",
    "    \n",
    "    # EXT\n",
    "    t = tokens[-1].split('.')\n",
    "    ext = t[-1]\n",
    "    if ext == \"\" or len(t) == 1: # extension is . or no extension\n",
    "        EXT = \"NON\"\n",
    "    else:\n",
    "        EXT = ext.upper()\n",
    "    \n",
    "    return DIR+\"@\"+EXT\n",
    "\n",
    "def fileDesiredAcc(value):\n",
    "    return '&&dA:'+ value.replace(' ', ';')\n",
    "\n",
    "def keySupPathTrans(value):\n",
    "    keyBasic = keyTrans(value)\n",
    "    HK = keyBasic[:keyBasic.index(\"@\")]\n",
    "    KEY = keyBasic[keyBasic.index(\"@\")+1:]\n",
    "    \n",
    "    try:\n",
    "        KEY = subPathstrim(KEY)\n",
    "    except:\n",
    "        KEY = KEY \n",
    "    return HK+\"@\"+KEY\n",
    "\n",
    "def keyTrans(value):\n",
    "    global hkey_dict\n",
    "    if value == \"\": return \"NON@NON\"\n",
    "    \n",
    "    HK = KEY = \"NON\"\n",
    "    \n",
    "    lvalue = value.lower()\n",
    "    tokens = lvalue.split('\\\\')\n",
    "    \n",
    "    # HK\n",
    "    hkey = inKey(hkey_dict, tokens[0])\n",
    "    HK = hkey_dict[hkey] if hkey else \"SUBK\"\n",
    "\n",
    "    # KEY\n",
    "    KEY = lvalue[lvalue.find('\\\\'):]\n",
    "    KEY = replace_strings(KEY) # MIKE: 20170714, combine all rules\n",
    "\n",
    "    return HK+\"@\"+KEY\n",
    "\n",
    "funcDict = {\n",
    "    \"LoadLibrarylpFileName\": libTrans,\n",
    "    \"CreateProcessInternallpApplicationName\": execTrans,\n",
    "    \"WinExecCmdLine\": cmdTrans,\n",
    "    \"CreateThreaddwThreadId\": thdTrans, \n",
    "    \"CreateFilehName\": fileTrans,\n",
    "    \"CreateFiledesiredAccess\": fileDesiredAcc, # NEW \n",
    "    \"CopyFilelpExistingFileName\": fileTrans,\n",
    "    \"DeleteFilefileName\": fileTrans,\n",
    "    \"RegQueryValuehKey\": keySupPathTrans,\n",
    "    \"RegEnumValuehKey\": keySupPathTrans,\n",
    "    \"RegOpenKeyhKey\": keySupPathTrans,\n",
    "    \"RegCloseKeyhKey\": keySupPathTrans,\n",
    "    \"RegSetValuehKey\": keySupPathTrans,\n",
    "    \"RegCreateKeyhKey\": keyTrans,\n",
    "    \"=RegDeleteKeyhKey\": keyTrans, #####\n",
    "    \"RegDeleteKeyhKey\": keyTrans,\n",
    "    \"RegDeleteValuehKey\": keyTrans\n",
    "}\n",
    "\n",
    "dir_dict = {\n",
    "    \"\\\\windows\\\\system32\\\\\": \"SYS\",\n",
    "    \"\\\\windows\\\\system\\\\\": \"SYS\",\n",
    "    \"\\\\program files\\\\\": \"PRO\",\n",
    "    #\"\\\\windows\\\\\": \"WIN\",\n",
    "    #\"\\\\documents and settings\\\\all users\\\\\": \"USR\",\n",
    "    \"\\\\documents and settings\\\\\": \"USR\",\n",
    "    \"\\\\docume~1\\\\\": \"USR\",\n",
    "    \"\\\\windows\\\\temp\\\\\": \"TMP\",\n",
    "    \":\\\\temp\\\\\": \"TMP\"\n",
    "}\n",
    "\n",
    "hkey_dict = {\n",
    "    \"hkey_classes_root\": \"HKCR\",\n",
    "    \"hkey_current_user\": \"HKCU\",\n",
    "    \"hkey_local_machine\": \"HKLM\",\n",
    "    \"hkey_users\": \"HKUS\",\n",
    "    \"hkey_current_config\": \"HKCC\"\n",
    "}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "class FeatureHooklog3(Hooklog3):\n",
    "    \n",
    "    # MIKE: by default: par = 1\n",
    "    def __init__(self, path, in_parseFirstPar = 1):\n",
    "        self.path = path\n",
    "        self.par = True # overwrite it\n",
    "        self.li = list()\n",
    "        self.length = 0\n",
    "        \n",
    "        self._parseDigitname()\n",
    "        self._parseHooklog() # use Hooklog3's _parseHooklog\n",
    "    \n",
    "    def __str__(self):\n",
    "        return \"class FeatureHooklog3, %s, len = %d, digit name = %s\" % (self.path, self.length, self.digitname)\n",
    "    \n",
    "    def _skipAPI(self, api): # MIKE: 20170708, skip some apis\n",
    "        # FeatureHooklog3 does skip API\n",
    "        return True if api not in API_list else False\n",
    "    \n",
    "    # private functions\n",
    "    def __parTrans(self, api, key, value, trans):\n",
    "        if not trans: return value\n",
    "        global funcDict\n",
    "        return funcDict[api+key](value) if api+key in funcDict else value\n",
    "\n",
    "    # protected functions\n",
    "    # MIKE: 20160307, in FeatureHooklog\n",
    "    def _getParValue(self, api, handle):\n",
    "        parword = \"\"\n",
    "        retword = \"\"\n",
    "        \n",
    "        while 1:\n",
    "            pos = handle.tell()\n",
    "            line = handle.readline().decode(\"windows-1252\").strip() # MIKE: 20170616, for python 3\n",
    "            if not line: # reach to the end of file\n",
    "                break\n",
    "            if line[0] == '#': # reach to next call\n",
    "                handle.seek(pos)\n",
    "                break\n",
    "        \n",
    "            delimiter = line[1:].find('=') +1 # MIKE: for =Reg\n",
    "            p = line[:delimiter]\n",
    "            v = line[delimiter+1:].strip() #===value\n",
    "        \n",
    "            if p in APIParRet[api][0]: # parameter\n",
    "                parword += self.__parTrans(api, p, v, 1) # note: v could be empty!\n",
    "            elif p in APIParRet[api][1]: # return\n",
    "                #retword += v\\n\",\n",
    "                # MIKE: 20170811/14, winnowing the ret globally and be compatible with old hooklog\\n\",\n",
    "                if v[0] == \"S\":\n",
    "                    retword += \"P\" # positive\n",
    "                elif v[0] == \"F\":\n",
    "                    retword += \"N\" # negative\n",
    "                elif v == \"0\":\n",
    "                    retword += \"0\" # zero\n",
    "                else:\n",
    "                    value = int(v, 16)\n",
    "                    if value > 0:\n",
    "                        retword += \"P\"\n",
    "                    elif value < 0:\n",
    "                        retword += \"N\"\n",
    "                    else:\n",
    "                        retword += \"0\"\n",
    "            else: # fail safe, should not happen if APIParRet is correct!\n",
    "                #if p in ['Return', 'result']:\n",
    "                #    retword += v\n",
    "                #else:\n",
    "                #    parword += (line + '?')\n",
    "                pass\n",
    "                    \n",
    "        return api + \"#PR#\" + parword + \"#PR#\" + retword\n",
    "    \n",
    "    def getHkli_containTS(self): # return with Timestamp\n",
    "        return self.li\n",
    "    \n",
    "    def getHkli_noContainTS(self): # return without Timestamp\n",
    "        hookli_noTS = list()\n",
    "        for (timestamp, api) in self.li:\n",
    "            hookli_noTS.append(api)\n",
    "        \n",
    "        return hookli_noTS"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.4.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}