Taday, We continue from the previous article （https://steemit.com/just/@bzd/cuckoo-sandbox-source-code-analysis-chapter-2），But before that, let's review the previous article. Just let's go on!!!

Review

In the previous article, we mainly described the preparation work before cuckoo executes the analysis module.
1、Set up the working directory (CWD): The working directory stores important contents including sample information, analysis results, yara rules, configuration files, etc.
2、set up cuckoo server: create tcp server on host, but also can be used as http server. Later we will mention the http service to transfer the main agent code and the samples to be analyzed into the virtual machine.
3、Initial configuration: e.g.: virtual machine, client ip, port, database, yara rules.

Start

cuckoo's main analysis module AnalysisManger
AnalysisManager inherits from the threading.Thread class, the start function was executed at the end of the previous article, so you should see the corresponding run function in the AnalysisManager class.

__init__

run

launch_analysis

Later, we will go inside the virtual machine and analyze the module GuestManager

To be continued。。。