_processes.html

{% load analysis_tags %}
<script type="text/javascript">
    function paginationbar(pages, page) {
        if (pages === 0) return "";

        function alert_current_page(i, page) {
            if (i == page)
                return " active\"";
            return "\"";
        }

        var out = "";
        out += "<li class=\"page-item" + alert_current_page(1, page) + "><a class=\"page-link bg-dark border-secondary text-white\" href=\"#\">1</a></li>";

        if (page - 5 > 5) out += "<li class='page-item disabled'><span class='page-link bg-dark border-secondary text-white'>...</span></li>";

        for (i = Math.max(2, page - 5); i <= Math.min(pages - 1, page + 5); i++) {
            out += "<li class=\"page-item" + alert_current_page(i, page) + "><a class=\"page-link bg-dark border-secondary text-white\" href=\"#\">" + i + "</a></li>";
        }

        if (page + 5 < pages - 1) out += "<li class='page-item disabled'><span class='page-link bg-dark border-secondary text-white'>...</span></li>";

        if (pages > 1)
            out += "<li class=\"page-item" + alert_current_page(pages, page) + "><a class=\"page-link bg-dark border-secondary text-white\" href=\"#\">" + pages + "</a></li>";
        return out;
    }

    function load_chunk(pid, pagenum, callback) {
        $("#process_" + pid + " div.calltable").load("/analysis/chunk/{{id}}/" + pid + "/" + pagenum + "/", function (data, status, xhr) {
            if (status == "error") {
                $("#process_" + pid + " div.calltable").html('<div class="alert alert-danger">Error loading data. Please reload the page.</div>');
            }
            else {
                $("#process_" + pid + " ul.pagination").html(paginationbar(parseInt($("#process_" + pid).data("length")), pagenum));
                $("#process_" + pid + " ul.pagination a").click(function (e) {
                    e.preventDefault();
                    var t = $(e.target);
                    $(`#process_${pid} #top_pagination`)[0].scrollIntoView();
                    load_chunk(pid, parseInt(t.text()));
                });
                typeof callback === 'function' && callback();
            }
        });

        $("#top_pagination").removeClass("d-none");
        $("#bottom_pagination").removeClass("d-none");
        $(".badge-filter").removeClass("active");
        $("#badge_default_" + pid).addClass("active");
    }

    function show_tab(id, callback) {
        if ($('#' + id).hasClass('active')) {
            typeof callback === 'function' && callback();
        } else {
            $('a[data-bs-toggle="pill"]').on('shown.bs.tab', function (e) {
                if ($(e.target).attr('href') == '#' + id) {
                    $('a[data-bs-toggle="pill"]').off('shown.bs.tab');
                    typeof callback === 'function' && callback();
                }
            });
            $('a[href="#' + id + '"]').tab('show');
        }
    }

    function go_to_api_call(pid, call_id) {
        pagenum = Math.floor(call_id / 100) + 1;
        load_chunk(pid, pagenum, function () {
            show_tab('behavior', function () {
                show_tab('process_' + pid, function () {
                    $('#call_' + call_id).get(0).scrollIntoView(false);
                });
            });
        });
    }

    function load_filtered_chunk(pid, category, caller, tid) {
        var inputValue = $("#apifilter_" + pid).val().trim();
        var apis = inputValue.split(',').map(api => api.trim()).join(',');
        var encodedlist = (apis === "") ? encodeURI("!null") : encodeURI(apis);

        $("#process_" + pid + " div.calltable").load("/analysis/filtered/{{id}}/" + pid + "/" + category + "/" + encodedlist + "/" + caller + "/" + tid + "/", function (data, status, xhr) {
            if (status == "error") {
                $("#process_" + pid + " div.calltable").html('<div class="alert alert-danger">Error loading data.</div>');
            }
            else {
                $("#process_" + pid + " div.pagination ul").html(paginationbar(0, 0));
                $("#process_" + pid + " div.pagination a").click(function (e) {
                    var t = $(e.target);
                    load_chunk(t.parents("#process_" + pid).data("pid"), parseInt(t.text()));
                });
            }
        });

        $("#top_pagination").addClass("d-none");
        $("#bottom_pagination").addClass("d-none");
        $(".badge-filter").removeClass("active");
        $("#badge_" + category + "_" + pid).addClass("active");
    }

    $(function () {
    var $default = $(".badge-filter[id^='badge_default_']").first();
    if (!$default.length) return;
    var m = $default.attr("id").match(/^badge_default_(\d+)$/);
    if (!m) return;
    var pid = m[1];
    load_chunk(pid, 1);
    });
</script>

<div class="card bg-dark border-secondary">
    <div class="card-header border-secondary">
        <ul class="nav nav-pills card-header-pills" id="processTabs" role="tablist">
            <li class="nav-item">
                <a class="nav-link" id="search-tab" data-bs-toggle="pill" href="#search" role="tab" aria-controls="search" aria-selected="false">
                    <i class="fas fa-search me-1"></i> Search
                </a>
            </li>
            {% for process in behavior.processes %}
            <li class="nav-item">
                <a class="nav-link {% if forloop.counter == 1 %}active{% endif %}" id="process-{{process.process_id}}-tab" data-bs-toggle="pill" href="#process_{{process.process_id}}" role="tab" aria-controls="process_{{process.process_id}}" aria-selected="{% if forloop.counter == 1 %}true{% else %}false{% endif %}">
                    <i class="fas fa-microchip me-1"></i> {{process.process_name}} <small>({{process.process_id}})</small>
                </a>
            </li>
            {% endfor %}
        </ul>
    </div>

    <div class="card-body">
        <div class="tab-content" id="processTabsContent">
            {% include "analysis/behavior/_search.html" %}

            {% for process in behavior.processes %}
            <div class="tab-pane fade {% if forloop.counter == 1%}show active{% endif %}" id="process_{{process.process_id}}" role="tabpanel" aria-labelledby="process-{{process.process_id}}-tab" data-pid="{{process.process_id}}" data-length="{{process.calls|length}}">

                <div class="alert alert-primary text-info border-primary text-center shadow-sm mb-4">
                    <h5 class="alert-heading fw-bold">{{process.process_name}}</h5>
                    <p class="mb-0">
                        PID: <strong>{{process.process_id}}</strong> | Parent PID: <strong>{{process.parent_id}}</strong>
                        <br>Path: <code class="text-white">{{process.module_path}}</code>
                        {% if process.environ.CommandLine %}<br>Cmd: <code class="text-white">{{ process.environ.CommandLine }}</code>{% endif %}
                        <br>Image Base: <strong>{% if process.environ.MainExeBase %}{{ process.environ.MainExeBase }}{% else %}{{process.image_base}}{% endif %}</strong> |
                        Size: <strong>{% if process.environ.MainExeSize %}{{ process.environ.MainExeSize }}{% else %}{{process.size}}{% endif %}</strong> |
                        Bitness: <strong>{% if process.environ.Bitness %}{{ process.environ.Bitness }}{% else %}{{process.bitness}}{% endif %}</strong>
                        {% if process.environ.DllBase %}<br />Dll Image Base: <b>{{ process.environ.DllBase }}</b>{% endif %}
                    </p>
                </div>

                <div class="row mb-4 align-items-center justify-content-center">
                    <div class="col-12 text-center">
                        <div class="btn-group flex-wrap mb-3" role="group">
                            <button id="badge_default_{{process.process_id}}" type="button" class="btn btn-cat-default badge-filter">Default</button>
                            <button id="badge_registry_{{process.process_id}}" type="button" class="btn btn-cat-registry badge-filter">Registry</button>
                            <button id="badge_filesystem_{{process.process_id}}" type="button" class="btn btn-cat-filesystem badge-filter">Filesystem</button>
                            <button id="badge_network_{{process.process_id}}" type="button" class="btn btn-cat-network badge-filter">Network</button>
                            <button id="badge_process_{{process.process_id}}" type="button" class="btn btn-cat-process badge-filter">Process</button>
                            <button id="badge_threading_{{process.process_id}}" type="button" class="btn btn-cat-threading badge-filter">Threading</button>
                            <button id="badge_services_{{process.process_id}}" type="button" class="btn btn-cat-services badge-filter">Services</button>
                            <button id="badge_sync_{{process.process_id}}" type="button" class="btn btn-cat-synchronization badge-filter">Sync</button>
                            <button id="badge_crypto_{{process.process_id}}" type="button" class="btn btn-cat-crypto badge-filter">Crypto</button>
                            <button id="badge_browser_{{process.process_id}}" type="button" class="btn btn-cat-browser badge-filter">Browser</button>
                            <button id="badge_device_{{process.process_id}}" type="button" class="btn btn-cat-device badge-filter">Device</button>
                            <button id="badge_all_{{process.process_id}}" type="button" class="btn btn-cat-all badge-filter">All</button>
                        </div>

                        <div class="input-group mb-3 w-50 mx-auto">
                            <input type="text" class="form-control bg-dark text-white border-secondary" id="apifilter_{{process.process_id}}" placeholder="Filter API calls (e.g. 'CreateFile, !CloseHandle')">
                            <button class="btn btn-outline-info" type="button" id="search_button_{{process.process_id}}"><i class="fas fa-filter"></i> Apply</button>
                        </div>

                        <button class="btn btn-sm btn-link text-white-50" type="button" data-bs-toggle="collapse" data-bs-target="#advFilter_{{process.process_id}}">
                            Advanced Filters <i class="fas fa-chevron-down float-end text-white-50 ms-1"></i>
                        </button>

                        <div class="collapse mt-2" id="advFilter_{{process.process_id}}">
                            <div class="card card-body bg-dark">
                                <div class="row g-3">
                                    <div class="col">
                                        <input type="text" class="form-control text-white bg-dark border-1" id="callerfilter_{{process.process_id}}" placeholder="Caller">
                                    </div>
                                    <div class="col">
                                        <input type="text" class="form-control text-white bg-dark border-1" id="tidfilter_{{process.process_id}}" placeholder="Thread ID">
                                    </div>
                                    <div class="col-auto">
                                        <button id="submit_filter_{{process.process_id}}" class="btn btn-dark">Filter</button>
                                    </div>
                                </div>
                            </div>
                        </div>
                    </div>
                </div>

                <script type="text/javascript">
                $(document).ready(function() {
                    // Handlers for category buttons (simplified for brevity, replicate logic for all)
                    $("#badge_default_{{process.process_id}}").click(function() { load_chunk({{process.process_id}}, 1); });
                    $("#badge_registry_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "registry", "null", 0); });
                    $("#badge_filesystem_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "filesystem", "null", 0); });
                    $("#badge_network_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "network", "null", 0); });
                    $("#badge_process_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "process", "null", 0); });
                    $("#badge_threading_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "threading", "null", 0); });
                    $("#badge_services_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "services", "null", 0); });
                    $("#badge_sync_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "sync", "null", 0); });
                    $("#badge_crypto_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "crypto", "null", 0); });
                    $("#badge_browser_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "browser", "null", 0); });
                    $("#badge_device_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "device", "null", 0); });
                    // ... (Add other category handlers similarly) ...
                    $("#badge_all_{{process.process_id}}").click(function() { load_filtered_chunk({{process.process_id}}, "all", "null", 0); });

                    // Click handler for call links
                    $('.tab-content').on('click', '.call-link', function (event) {
                        event.preventDefault();
                        var cid = $(this).attr('data-cid');
                        var pid = $(this).attr('data-pid');
                        go_to_api_call(+pid, +cid);
                    });

                    // Search/Filter handlers
                    $("#submit_filter_{{process.process_id}}").click(function(){
                        var pid = {{process.process_id}};
                        var caller = ($("#callerfilter_"+pid).val() == "") ? "null" : $("#callerfilter_"+pid).val();
                        var tid = ($("#tidfilter_"+pid).val() == "") ? 0 : $("#tidfilter_"+pid).val();
                        load_filtered_chunk(pid, "all", caller, tid);
                    });

                    $("#apifilter_{{process.process_id}}").keypress(function(e) {
                        if (e.which == 13) { load_filtered_chunk({{process.process_id}}, "all", "null", 0); }
                    });

                    $("#search_button_{{process.process_id}}").click(function() {
                        load_filtered_chunk({{process.process_id}}, "all", "null", 0);
                    });

                    $(function () {
                        var $btn = $(".badge-filter[id^='badge_default_']").first();
                        if ($btn.length) {
                            $btn.trigger("click");
                        }
                    });
                });
                </script>

                <nav id="top_pagination" aria-label="Page navigation" class="mb-3">
                    <ul class="pagination justify-content-center"></ul>
                </nav>

                <div class="calltable"></div>

                <nav aria-label="Page navigation" class="mt-3">
                    <ul id="bottom_pagination" class="pagination justify-content-center pagination_{{process.process_id}}"></ul>
                </nav>

                <script type="text/javascript">
                    load_chunk({{ process.process_id }}, 1);
                </script>
            </div>
            {% endfor %}
        </div>
    </div>
</div>