Skip to content

Commit 5b41f55

Browse files
rabbitstackrabbitstack
committed
add param reader test, fix tests, polishing
1 parent 6a088b3 commit 5b41f55

File tree

6 files changed

+79
-24
lines changed

6 files changed

+79
-24
lines changed

‎pkg/kevent/kparams/readers.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ package kparams
2323

2424
import (
2525
"syscall"
26+
"unicode/utf16"
2627
"unsafe"
2728
)
2829

@@ -88,7 +89,7 @@ func ConsumeUTF16String(buf uintptr, offset, length uint16) string {
8889
return ""
8990
}
9091
s := (*[1<<30 - 1]uint16)(unsafe.Pointer(buf + uintptr(offset)))[: length-offset : length-offset]
91-
return syscall.UTF16ToString(s)
92+
return string(utf16.Decode(s[:len(s)/2-1]))
9293
}
9394

9495
// ReadSID reads the security identifier from the provided buffer.

‎pkg/kevent/kparams/readers_test.go‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/*
2+
* Copyright 2021-2022 by Nedim Sabic Sabic
3+
* https://www.fibratus.io
4+
* All Rights Reserved.
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
package kparams
20+
21+
import (
22+
"github.com/stretchr/testify/assert"
23+
"testing"
24+
"unsafe"
25+
)
26+
27+
func TestReadBuffer(t *testing.T) {
28+
b := []byte{
29+
0x70, 0x3B, 0xD1, 0x24, 0x8E, 0xD6, 0xFF, 0xFF, 0x9C, 0x02, 0x00, 0x00, 0x2C, 0x00, 0x5C, 0x00,
30+
0x52, 0x00, 0x45, 0x00, 0x47, 0x00, 0x49, 0x00, 0x53, 0x00, 0x54, 0x00, 0x52, 0x00, 0x59, 0x00,
31+
0x5C, 0x00, 0x55, 0x00, 0x53, 0x00, 0x45, 0x00, 0x52, 0x00, 0x5C, 0x00, 0x53, 0x00, 0x2D, 0x00,
32+
0x31, 0x00, 0x2D, 0x00, 0x35, 0x00, 0x2D, 0x00, 0x32, 0x00, 0x31, 0x00, 0x2D, 0x00, 0x32, 0x00,
33+
0x32, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30, 0x00, 0x33, 0x00, 0x34, 0x00, 0x34, 0x00, 0x35, 0x00,
34+
0x32, 0x00, 0x2D, 0x00, 0x32, 0x00, 0x36, 0x00, 0x30, 0x00, 0x36, 0x00, 0x32, 0x00, 0x37, 0x00,
35+
0x30, 0x00, 0x30, 0x00, 0x39, 0x00, 0x39, 0x00, 0x2D, 0x00, 0x39, 0x00, 0x38, 0x00, 0x34, 0x00,
36+
0x38, 0x00, 0x37, 0x00, 0x31, 0x00, 0x35, 0x00, 0x36, 0x00, 0x39, 0x00, 0x2D, 0x00, 0x31, 0x00,
37+
0x30, 0x00, 0x30, 0x00, 0x31, 0x00, 0x00, 0x00}
38+
p := uintptr(unsafe.Pointer(&b[0]))
39+
40+
assert.Equal(t, uint64(18446698504724233072), ReadUint64(p, 0))
41+
assert.Equal(t, uint32(668), ReadUint32(p, 8))
42+
assert.Equal(t, uint16(44), ReadUint16(p, 12))
43+
assert.Equal(t, "\\REGISTRY\\USER\\S-1-5-21-2271034452-2606270099-984871569-1001", ConsumeUTF16String(p, 14, uint16(len(b))))
44+
}

‎pkg/kstream/controller_windows.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,11 @@ type TraceSession struct {
5656
GUID syscall.GUID
5757
}
5858

59+
// IsKernelLogger determines if the session is tied to the NT Kernel Logger provider.
60+
func (s TraceSession) IsKernelLogger() bool {
61+
return s.GUID == etw.KernelTraceControlGUID
62+
}
63+
5964
// TraceProvider describes the ETW provider metainfo. The provider
6065
// acts as a source of events that are published to the tracing
6166
// session.

‎pkg/kstream/interceptors/fs_windows.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -217,15 +217,15 @@ func (f *fsInterceptor) Intercept(kevt *kevent.Kevent) (*kevent.Kevent, bool, er
217217
if err != nil {
218218
return kevt, true, err
219219
}
220-
extraInfo, err := kevt.Kparams.TryGetHexAsUint8(kparams.FileExtraInfo)
220+
extraInfo, err := kevt.Kparams.TryGetHexAsUint64(kparams.FileExtraInfo)
221221
if err != nil {
222222
return kevt, true, err
223223
}
224224
fkevt, ok := f.pendingKevents[irp]
225225
if !ok {
226226
return kevt, true, kerrors.ErrCancelUpstreamKevent
227227
}
228-
fkevt.Kparams.Append(kparams.FileExtraInfo, kparams.Uint8, extraInfo)
228+
fkevt.Kparams.Append(kparams.FileExtraInfo, kparams.Uint64, extraInfo)
229229

230230
// resolve the status of the file operation
231231
status, err := kevt.Kparams.GetUint32(kparams.NTStatus)
@@ -337,7 +337,7 @@ func (f *fsInterceptor) processCreateFile(kevt *kevent.Kevent) error {
337337
if err != nil {
338338
return err
339339
}
340-
extraInfo, err := kevt.Kparams.GetUint8(kparams.FileExtraInfo)
340+
extraInfo, err := kevt.Kparams.GetUint64(kparams.FileExtraInfo)
341341
if err != nil {
342342
return err
343343
}

‎pkg/kstream/interceptors/fs_windows_test.go‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,9 @@ func TestCreateFile(t *testing.T) {
5656
Tid: 2484,
5757
PID: 859,
5858
Kparams: kevent.Kparams{
59-
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: kparams.Hex("12456738026482168384")},
59+
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.HexInt64, Value: kparams.Hex("12456738026482168384")},
6060
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "\\Device\\HarddiskVolume2\\Windows\\system32\\user32.dll"},
61-
kparams.FileIrpPtr: {Name: kparams.FileIrpPtr, Type: kparams.Uint64, Value: kparams.Hex("1234543123112321")},
61+
kparams.FileIrpPtr: {Name: kparams.FileIrpPtr, Type: kparams.HexInt64, Value: kparams.Hex("1234543123112321")},
6262
},
6363
})
6464
require.NoError(t, err)
@@ -68,12 +68,12 @@ func TestCreateFile(t *testing.T) {
6868
Tid: 2484,
6969
PID: 859,
7070
Kparams: kevent.Kparams{
71-
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: kparams.Hex("18446738026482168384")},
71+
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.HexInt64, Value: kparams.Hex("18446738026482168384")},
7272
kparams.ThreadID: {Name: kparams.ThreadID, Type: kparams.Uint32, Value: uint32(1484)},
7373
kparams.FileCreateOptions: {Name: kparams.FileCreateOptions, Type: kparams.Uint32, Value: uint32(1223456)},
7474
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "\\Device\\HarddiskVolume2\\Windows\\system32\\kernel32.dll"},
7575
kparams.FileShareMask: {Name: kparams.FileShareMask, Type: kparams.Uint32, Value: uint32(5)},
76-
kparams.FileIrpPtr: {Name: kparams.FileIrpPtr, Type: kparams.Uint64, Value: kparams.Hex("1234543123112321")},
76+
kparams.FileIrpPtr: {Name: kparams.FileIrpPtr, Type: kparams.HexInt64, Value: kparams.Hex("1234543123112321")},
7777
},
7878
}
7979
devMapper.On("Convert", "\\Device\\HarddiskVolume2\\Windows\\system32\\kernel32.dll").Return(fmt.Sprintf("%s\\system32\\kernel32.dll", sysRoot))
@@ -89,10 +89,10 @@ func TestCreateFile(t *testing.T) {
8989
Tid: 2484,
9090
PID: 859,
9191
Kparams: kevent.Kparams{
92-
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: kparams.Hex("18446738026482168384")},
92+
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.HexInt64, Value: kparams.Hex("18446738026482168384")},
9393
kparams.ThreadID: {Name: kparams.ThreadID, Type: kparams.Uint32, Value: uint32(1484)},
94-
kparams.FileIrpPtr: {Name: kparams.FileIrpPtr, Type: kparams.Uint64, Value: kparams.Hex("1234543123112321")},
95-
kparams.FileExtraInfo: {Name: kparams.FileExtraInfo, Type: kparams.Uint8, Value: kparams.Hex("2")},
94+
kparams.FileIrpPtr: {Name: kparams.FileIrpPtr, Type: kparams.HexInt64, Value: kparams.Hex("1234543123112321")},
95+
kparams.FileExtraInfo: {Name: kparams.FileExtraInfo, Type: kparams.Uint64, Value: uint64(2)},
9696
},
9797
}
9898
kevt1, _, err = fsi.Intercept(opEnd)
@@ -125,7 +125,7 @@ func TestRundownFile(t *testing.T) {
125125
Tid: 2484,
126126
PID: 859,
127127
Kparams: kevent.Kparams{
128-
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: kparams.Hex("124567380264")},
128+
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.HexInt64, Value: kparams.Hex("124567380264")},
129129
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "\\Device\\HarddiskVolume2\\Windows\\system32\\user32.dll"},
130130
},
131131
})
@@ -155,7 +155,7 @@ func TestDeleteFile(t *testing.T) {
155155
Tid: 2484,
156156
PID: 859,
157157
Kparams: kevent.Kparams{
158-
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: kparams.Hex("12456738026482168384")},
158+
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.HexInt64, Value: kparams.Hex("12456738026482168384")},
159159
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "\\Device\\HarddiskVolume2\\Windows\\system32\\user32.dll"},
160160
},
161161
})
@@ -166,8 +166,8 @@ func TestDeleteFile(t *testing.T) {
166166
Tid: 2484,
167167
PID: 859,
168168
Kparams: kevent.Kparams{
169-
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: kparams.Hex("12456738026482168384")},
170-
kparams.FileKey: {Name: kparams.FileKey, Type: kparams.Uint64, Value: kparams.Hex("12456738026482168384")},
169+
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.HexInt64, Value: kparams.Hex("12456738026482168384")},
170+
kparams.FileKey: {Name: kparams.FileKey, Type: kparams.HexInt64, Value: kparams.Hex("12456738026482168384")},
171171
kparams.ThreadID: {Name: kparams.ThreadID, Type: kparams.Uint32, Value: uint32(1484)},
172172
},
173173
}

‎pkg/kstream/kstreamc_windows.go‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ type Consumer interface {
109109
}
110110

111111
type kstreamConsumer struct {
112-
handles []etw.TraceHandle // trace session handles
112+
traceHandles []etw.TraceHandle // trace session handles
113113

114114
errs chan error // channel for event processing errors
115115
kevts chan *kevent.Kevent // channel for fanning out generated events
@@ -129,6 +129,10 @@ type kstreamConsumer struct {
129129
eventCallback EventCallbackFunc // called on each incoming event
130130
}
131131

132+
func (k *kstreamConsumer) addTraceHandle(traceHandle etw.TraceHandle) {
133+
k.traceHandles = append(k.traceHandles, traceHandle)
134+
}
135+
132136
// NewConsumer constructs a new kernel event stream consumer.
133137
func NewConsumer(ktraceController KtraceController, psnap ps.Snapshotter, hsnap handle.Snapshotter, config *config.Config) Consumer {
134138
kconsumer := &kstreamConsumer{
@@ -159,10 +163,13 @@ func (k *kstreamConsumer) OpenKstream(traces map[string]TraceSession) error {
159163
if err != nil {
160164
return err
161165
}
162-
for loggerName := range traces {
163-
err := k.openKstream(loggerName)
166+
for _, trace := range traces {
167+
err := k.openKstream(trace.Name)
164168
if err != nil {
165-
return err
169+
if trace.IsKernelLogger() {
170+
return err
171+
}
172+
log.Warnf("unable to open %s trace: %v", trace.Name, err)
166173
}
167174
}
168175
return nil
@@ -184,9 +191,7 @@ func (k *kstreamConsumer) openKstream(loggerName string) error {
184191
if uint64(traceHandle) == winerrno.InvalidProcessTraceHandle {
185192
return fmt.Errorf("unable to open kernel trace: %v", syscall.GetLastError())
186193
}
187-
188-
k.handles = append(k.handles, traceHandle)
189-
194+
k.addTraceHandle(traceHandle)
190195
// since `ProcessTrace` blocks the current thread
191196
// we invoke it in a separate goroutine but send
192197
// any possible errors to the channel
@@ -214,7 +219,7 @@ func (k *kstreamConsumer) openKstream(loggerName string) error {
214219

215220
// CloseKstream shutdowns the event stream consumer by closing all running traces.
216221
func (k *kstreamConsumer) CloseKstream() error {
217-
for _, h := range k.handles {
222+
for _, h := range k.traceHandles {
218223
if err := etw.CloseTrace(h); err != nil {
219224
log.Warn(err)
220225
}
@@ -764,7 +769,7 @@ func (k *kstreamConsumer) produceRawParams(ktype ktypes.Ktype, evt *etw.EventRec
764769
}
765770
return kevent.KparamsFromSlice(
766771
kevent.NewKparam(kparams.FileIrpPtr, kparams.Uint64, irp),
767-
kevent.NewKparam(kparams.FileExtraInfo, kparams.Uint8, uint8(extraInfo)),
772+
kevent.NewKparam(kparams.FileExtraInfo, kparams.Uint64, extraInfo),
768773
kevent.NewKparam(kparams.NTStatus, kparams.Uint32, status),
769774
)
770775
case ktypes.FileRundown:

0 commit comments

Comments
 (0)