Skip to content

Commit e49cf74

Browse files
rabbitstackrabbitstack
committed
refactor(event)!: Rename image to module
1 parent f2bb1a9 commit e49cf74

49 files changed

Lines changed: 402 additions & 381 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎configs/fibratus.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ event:
187187
serialize-threads: false
188188

189189
# Indicates if modules such as Dynamic Linked Libraries are serialized as part of the process state
190-
serialize-images: false
190+
serialize-modules: false
191191

192192
# Indicates if handles are serialized as part of the process state
193193
serialize-handles: false
@@ -240,8 +240,8 @@ eventsource:
240240
# Determines whether VA map/unmap events are collected by Kernel Logger provider
241241
#enable-vamap: true
242242

243-
# Determines whether image events are collected by Kernel Logger provider
244-
#enable-image: true
243+
# Determines whether module events are collected by Kernel Logger provider
244+
#enable-module: true
245245

246246
# Determines whether object manager events (handle creation/destruction) are
247247
# collected by Kernel Logger provider

‎internal/etw/processors/chain_windows.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ func NewChain(
5656
if config.EventSource.EnableRegistryEvents {
5757
chain.addProcessor(newRegistryProcessor(hsnap))
5858
}
59-
if config.EventSource.EnableImageEvents {
59+
if config.EventSource.EnableModuleEvents {
6060
chain.addProcessor(newModuleProcessor(psnap))
6161
}
6262
if config.EventSource.EnableNetEvents {

‎internal/etw/processors/handle_windows.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,14 @@
1919
package processors
2020

2121
import (
22+
"strings"
23+
2224
"github.com/rabbitstack/fibratus/pkg/event"
2325
"github.com/rabbitstack/fibratus/pkg/event/params"
2426
"github.com/rabbitstack/fibratus/pkg/fs"
2527
"github.com/rabbitstack/fibratus/pkg/handle"
2628
"github.com/rabbitstack/fibratus/pkg/ps"
2729
"github.com/rabbitstack/fibratus/pkg/util/key"
28-
"strings"
2930
)
3031

3132
type handleProcessor struct {
@@ -92,7 +93,7 @@ func (h *handleProcessor) processEvent(e *event.Event) (*event.Event, error) {
9293
driverPath = driverName
9394
}
9495
h.devPathResolver.RemovePath(driverName)
95-
e.Params.Append(params.ImagePath, params.Path, driverPath)
96+
e.Params.Append(params.ModulePath, params.Path, driverPath)
9697
}
9798
// assign the formatted handle name
9899
if err := e.Params.SetValue(params.HandleObjectName, name); err != nil {

‎internal/etw/processors/module_windows.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,24 +34,24 @@ func newModuleProcessor(psnap ps.Snapshotter) Processor {
3434
return m
3535
}
3636

37-
func (*moduleProcessor) Name() ProcessorType { return Image }
37+
func (*moduleProcessor) Name() ProcessorType { return Module }
3838

3939
func (m *moduleProcessor) ProcessEvent(e *event.Event) (*event.Event, bool, error) {
40-
if e.IsLoadImageInternal() {
40+
if e.IsLoadModuleInternal() {
4141
// state management
4242
return e, false, m.psnap.AddModule(e)
4343
}
4444

45-
if e.IsUnloadImage() {
45+
if e.IsUnloadModule() {
4646
pid := e.Params.MustGetPid()
47-
addr := e.Params.TryGetAddress(params.ImageBase)
47+
addr := e.Params.TryGetAddress(params.ModuleBase)
4848
if pid == 0 {
4949
pid = e.PID
5050
}
5151
return e, false, m.psnap.RemoveModule(pid, addr)
5252
}
5353

54-
if e.IsLoadImage() || e.IsImageRundown() {
54+
if e.IsLoadModule() || e.IsModuleRundown() {
5555
return e, false, m.psnap.AddModule(e)
5656
}
5757

‎internal/etw/processors/module_windows_test.go‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -41,16 +41,16 @@ func TestModuleProcessor(t *testing.T) {
4141
assertions func(*event.Event, *testing.T, *ps.SnapshotterMock)
4242
}{
4343
{
44-
"load new image",
44+
"load new Module",
4545
&event.Event{
46-
Type: event.LoadImage,
46+
Type: event.LoadModule,
4747
Params: event.Params{
48-
params.ImagePath: {Name: params.ImagePath, Type: params.UnicodeString, Value: filepath.Join(os.Getenv("windir"), "System32", "kernel32.dll")},
49-
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)},
50-
params.ImageCheckSum: {Name: params.ImageCheckSum, Type: params.Uint32, Value: uint32(2323432)},
51-
params.ImageBase: {Name: params.ImageBase, Type: params.Address, Value: uint64(0x7ffb313833a3)},
52-
params.ImageSignatureType: {Name: params.ImageSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types},
53-
params.ImageSignatureLevel: {Name: params.ImageSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels},
48+
params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: filepath.Join(os.Getenv("windir"), "System32", "kernel32.dll")},
49+
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)},
50+
params.ModuleCheckSum: {Name: params.ModuleCheckSum, Type: params.Uint32, Value: uint32(2323432)},
51+
params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0x7ffb313833a3)},
52+
params.ModuleSignatureType: {Name: params.ModuleSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types},
53+
params.ModuleSignatureLevel: {Name: params.ModuleSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels},
5454
},
5555
},
5656
func() *ps.SnapshotterMock {
@@ -61,21 +61,21 @@ func TestModuleProcessor(t *testing.T) {
6161
func(e *event.Event, t *testing.T, psnap *ps.SnapshotterMock) {
6262
psnap.AssertNumberOfCalls(t, "AddModule", 1)
6363
// should get the signature verified
64-
assert.Equal(t, "EMBEDDED", e.GetParamAsString(params.ImageSignatureType))
65-
assert.Equal(t, "AUTHENTICODE", e.GetParamAsString(params.ImageSignatureLevel))
64+
assert.Equal(t, "EMBEDDED", e.GetParamAsString(params.ModuleSignatureType))
65+
assert.Equal(t, "AUTHENTICODE", e.GetParamAsString(params.ModuleSignatureLevel))
6666
},
6767
},
6868
{
69-
"parse image characteristics",
69+
"parse Module characteristics",
7070
&event.Event{
71-
Type: event.LoadImage,
71+
Type: event.LoadModule,
7272
Params: event.Params{
73-
params.ImagePath: {Name: params.ImagePath, Type: params.UnicodeString, Value: "../_fixtures/mscorlib.dll"},
74-
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)},
75-
params.ImageCheckSum: {Name: params.ImageCheckSum, Type: params.Uint32, Value: uint32(2323432)},
76-
params.ImageBase: {Name: params.ImageBase, Type: params.Address, Value: uint64(0x7ffb313833a3)},
77-
params.ImageSignatureType: {Name: params.ImageSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types},
78-
params.ImageSignatureLevel: {Name: params.ImageSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels},
73+
params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "../_fixtures/mscorlib.dll"},
74+
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)},
75+
params.ModuleCheckSum: {Name: params.ModuleCheckSum, Type: params.Uint32, Value: uint32(2323432)},
76+
params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0x7ffb313833a3)},
77+
params.ModuleSignatureType: {Name: params.ModuleSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types},
78+
params.ModuleSignatureLevel: {Name: params.ModuleSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels},
7979
},
8080
},
8181
func() *ps.SnapshotterMock {
@@ -88,16 +88,16 @@ func TestModuleProcessor(t *testing.T) {
8888
},
8989
},
9090
{
91-
"unload image",
91+
"unload Module",
9292
&event.Event{
93-
Type: event.UnloadImage,
93+
Type: event.LoadModule,
9494
Params: event.Params{
95-
params.ImagePath: {Name: params.ImagePath, Type: params.UnicodeString, Value: "C:\\Windows\\system32\\kernel32.dll"},
96-
params.ProcessName: {Name: params.ProcessName, Type: params.AnsiString, Value: "csrss.exe"},
97-
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(676)},
98-
params.ImageBase: {Name: params.ImageBase, Type: params.Address, Value: uint64(0xfffb313833a3)},
99-
params.ImageSignatureType: {Name: params.ImageSignatureType, Type: params.Enum, Value: uint32(0), Enum: signature.Types},
100-
params.ImageSignatureLevel: {Name: params.ImageSignatureLevel, Type: params.Enum, Value: uint32(0), Enum: signature.Levels},
95+
params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "C:\\Windows\\system32\\kernel32.dll"},
96+
params.ProcessName: {Name: params.ProcessName, Type: params.AnsiString, Value: "csrss.exe"},
97+
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(676)},
98+
params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0xfffb313833a3)},
99+
params.ModuleSignatureType: {Name: params.ModuleSignatureType, Type: params.Enum, Value: uint32(0), Enum: signature.Types},
100+
params.ModuleSignatureLevel: {Name: params.ModuleSignatureLevel, Type: params.Enum, Value: uint32(0), Enum: signature.Levels},
101101
},
102102
},
103103
func() *ps.SnapshotterMock {

‎internal/etw/processors/processor.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ const (
3232
Fs
3333
// Registry represents the registry event processor.
3434
Registry
35-
// Image represents the image event processor.
36-
Image
35+
// Module represents the module event processor.
36+
Module
3737
// Net represents the network event processor.
3838
Net
3939
// Handle represents the handle event processor.
@@ -66,8 +66,8 @@ func (typ ProcessorType) String() string {
6666
return "file"
6767
case Registry:
6868
return "registry"
69-
case Image:
70-
return "image"
69+
case Module:
70+
return "module"
7171
case Net:
7272
return "net"
7373
case Handle:

‎internal/etw/source.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ import (
2222
"errors"
2323
"expvar"
2424
"fmt"
25+
"time"
26+
"unsafe"
27+
2528
"github.com/rabbitstack/fibratus/internal/etw/processors"
2629
"github.com/rabbitstack/fibratus/pkg/config"
2730
errs "github.com/rabbitstack/fibratus/pkg/errors"
@@ -34,8 +37,6 @@ import (
3437
"github.com/rabbitstack/fibratus/pkg/util/multierror"
3538
log "github.com/sirupsen/logrus"
3639
"golang.org/x/sys/windows/registry"
37-
"time"
38-
"unsafe"
3940
)
4041

4142
const (
@@ -129,7 +130,7 @@ func (e *EventSource) Open(config *config.Config) error {
129130
// are not captured
130131
if e.r != nil {
131132
config.EventSource.EnableThreadEvents = config.EventSource.EnableThreadEvents && e.r.HasThreadEvents
132-
config.EventSource.EnableImageEvents = config.EventSource.EnableImageEvents && e.r.HasImageEvents
133+
config.EventSource.EnableModuleEvents = config.EventSource.EnableModuleEvents && e.r.HasModuleEvents
133134
config.EventSource.EnableNetEvents = config.EventSource.EnableNetEvents && e.r.HasNetworkEvents
134135
config.EventSource.EnableRegistryEvents = config.EventSource.EnableRegistryEvents && (e.r.HasRegistryEvents || (config.Yara.Enabled && !config.Yara.SkipRegistry))
135136
config.EventSource.EnableFileIOEvents = config.EventSource.EnableFileIOEvents && (e.r.HasFileEvents || (config.Yara.Enabled && !config.Yara.SkipFiles))
@@ -140,7 +141,7 @@ func (e *EventSource) Open(config *config.Config) error {
140141
config.EventSource.EnableThreadpoolEvents = config.EventSource.EnableThreadpoolEvents && e.r.HasThreadpoolEvents
141142
for _, typ := range event.All() {
142143
if typ == event.CreateProcess || typ == event.TerminateProcess ||
143-
typ == event.LoadImage || typ == event.UnloadImage {
144+
typ == event.LoadModule || typ == event.UnloadModule {
144145
// always allow fundamental events
145146
continue
146147
}

‎internal/etw/source_test.go‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
168168

169169
r := &config.RulesCompileResult{
170170
HasProcEvents: true,
171-
HasImageEvents: true,
171+
HasModuleEvents: true,
172172
HasRegistryEvents: true,
173173
HasNetworkEvents: true,
174174
HasFileEvents: true,
@@ -177,7 +177,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
177177
HasAuditAPIEvents: true,
178178
UsedEvents: []event.Type{
179179
event.CreateProcess,
180-
event.LoadImage,
180+
event.LoadModule,
181181
event.RegCreateKey,
182182
event.RegSetValue,
183183
event.CreateFile,
@@ -191,7 +191,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
191191
EventSource: config.EventSourceConfig{
192192
EnableThreadEvents: true,
193193
EnableRegistryEvents: true,
194-
EnableImageEvents: true,
194+
EnableModuleEvents: true,
195195
EnableFileIOEvents: true,
196196
EnableAuditAPIEvents: true,
197197
},
@@ -212,7 +212,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
212212
// rules compile result doesn't have the thread event
213213
// and thread events are enabled in the config
214214
require.True(t, flags&etw.Thread == 0)
215-
require.True(t, flags&etw.ImageLoad != 0)
215+
require.True(t, flags&etw.Module != 0)
216216
require.True(t, flags&etw.Registry != 0)
217217
// rules compile result has the network event
218218
// but network I/O is disabled in the config
@@ -222,7 +222,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
222222
// but VAMap is disabled in the config
223223
require.True(t, flags&etw.VaMap == 0)
224224

225-
require.False(t, cfg.EventSource.TestDropMask(event.UnloadImage))
225+
require.False(t, cfg.EventSource.TestDropMask(event.UnloadModule))
226226
require.True(t, cfg.EventSource.TestDropMask(event.WriteFile))
227227
require.True(t, cfg.EventSource.TestDropMask(event.UnmapViewFile))
228228
require.False(t, cfg.EventSource.TestDropMask(event.OpenProcess))
@@ -248,15 +248,15 @@ func TestEventSourceEnableFlagsDynamicallyWithYaraEnabled(t *testing.T) {
248248

249249
r := &config.RulesCompileResult{
250250
HasProcEvents: true,
251-
HasImageEvents: true,
251+
HasModuleEvents: true,
252252
HasRegistryEvents: true,
253253
HasNetworkEvents: true,
254254
HasFileEvents: false,
255255
HasThreadEvents: false,
256256
HasAuditAPIEvents: true,
257257
UsedEvents: []event.Type{
258258
event.CreateProcess,
259-
event.LoadImage,
259+
event.LoadModule,
260260
event.RegCreateKey,
261261
event.RegSetValue,
262262
event.RenameFile,
@@ -268,7 +268,7 @@ func TestEventSourceEnableFlagsDynamicallyWithYaraEnabled(t *testing.T) {
268268
EventSource: config.EventSourceConfig{
269269
EnableThreadEvents: true,
270270
EnableRegistryEvents: true,
271-
EnableImageEvents: true,
271+
EnableModuleEvents: true,
272272
EnableFileIOEvents: true,
273273
EnableAuditAPIEvents: true,
274274
EnableVAMapEvents: false,
@@ -326,7 +326,7 @@ func TestEventSourceRundownEvents(t *testing.T) {
326326

327327
evsConfig := config.EventSourceConfig{
328328
EnableThreadEvents: true,
329-
EnableImageEvents: true,
329+
EnableModuleEvents: true,
330330
EnableFileIOEvents: true,
331331
EnableNetEvents: true,
332332
EnableRegistryEvents: true,
@@ -348,7 +348,7 @@ func TestEventSourceRundownEvents(t *testing.T) {
348348
rundownsByType := map[event.Type]bool{
349349
event.ProcessRundown: false,
350350
event.ThreadRundown: false,
351-
event.ImageRundown: false,
351+
event.ModuleRundown: false,
352352
event.FileRundown: false,
353353
event.RegKCBRundown: false,
354354
}
@@ -435,11 +435,11 @@ func TestEventSourceAllEvents(t *testing.T) {
435435
false,
436436
},
437437
{
438-
"load image",
438+
"load module",
439439
nil,
440440
func(e *event.Event) bool {
441441
img := filepath.Join(os.Getenv("windir"), "System32", "notepad.exe")
442-
return e.IsLoadImage() && strings.EqualFold(img, e.GetParamAsString(params.ImagePath))
442+
return e.IsLoadModule() && strings.EqualFold(img, e.GetParamAsString(params.ModulePath))
443443
},
444444
false,
445445
},
@@ -491,7 +491,7 @@ func TestEventSourceAllEvents(t *testing.T) {
491491
{
492492
"map view section",
493493
func() error {
494-
const SecImage = 0x01000000
494+
const SecModule = 0x01000000
495495
const SectionRead = 0x4
496496

497497
var sec windows.Handle
@@ -514,7 +514,7 @@ func TestEventSourceAllEvents(t *testing.T) {
514514
0,
515515
uintptr(unsafe.Pointer(&size)),
516516
windows.PAGE_READONLY,
517-
SecImage,
517+
SecModule,
518518
windows.Handle(f.Fd()),
519519
); err != nil {
520520
return fmt.Errorf("NtCreateSection: %v", err)
@@ -539,7 +539,7 @@ func TestEventSourceAllEvents(t *testing.T) {
539539
func(e *event.Event) bool {
540540
return e.CurrentPid() && e.Type == event.MapViewFile &&
541541
e.GetParamAsString(params.MemProtect) == "EXECUTE_READWRITE|READONLY" &&
542-
e.GetParamAsString(params.FileViewSectionType) == "IMAGE" &&
542+
e.GetParamAsString(params.FileViewSectionType) == "Module" &&
543543
strings.Contains(e.GetParamAsString(params.FilePath), "_fixtures\\yara-test.dll")
544544
},
545545
false,
@@ -717,7 +717,7 @@ func TestEventSourceAllEvents(t *testing.T) {
717717

718718
evsConfig := config.EventSourceConfig{
719719
EnableThreadEvents: true,
720-
EnableImageEvents: true,
720+
EnableModuleEvents: true,
721721
EnableFileIOEvents: true,
722722
EnableVAMapEvents: true,
723723
EnableNetEvents: true,
@@ -889,10 +889,10 @@ func testCallstackEnrichment(t *testing.T, hsnap handle.Snapshotter, psnap ps.Sn
889889
false,
890890
},
891891
{
892-
"load image callstack",
892+
"load Module callstack",
893893
nil,
894894
func(e *event.Event) bool {
895-
if e.IsLoadImage() && filepath.Ext(e.GetParamAsString(params.FilePath)) == ".dll" {
895+
if e.IsLoadModule() && filepath.Ext(e.GetParamAsString(params.FilePath)) == ".dll" {
896896
callstack := e.Callstack.String()
897897
return strings.Contains(strings.ToLower(callstack), strings.ToLower("\\WINDOWS\\System32\\KERNELBASE.dll!LoadLibraryExW")) &&
898898
strings.Contains(strings.ToLower(callstack), strings.ToLower("\\WINDOWS\\system32\\ntoskrnl.exe!NtMapViewOfSection"))
@@ -1202,7 +1202,7 @@ func testCallstackEnrichment(t *testing.T, hsnap handle.Snapshotter, psnap ps.Sn
12021202

12031203
evsConfig := config.EventSourceConfig{
12041204
EnableThreadEvents: true,
1205-
EnableImageEvents: true,
1205+
EnableModuleEvents: true,
12061206
EnableFileIOEvents: true,
12071207
EnableRegistryEvents: true,
12081208
EnableMemEvents: true,
@@ -1327,7 +1327,7 @@ func TestEvasionScanner(t *testing.T) {
13271327

13281328
evsConfig := config.EventSourceConfig{
13291329
EnableThreadEvents: true,
1330-
EnableImageEvents: true,
1330+
EnableModuleEvents: true,
13311331
EnableFileIOEvents: false,
13321332
EnableVAMapEvents: true,
13331333
EnableNetEvents: true,

0 commit comments

Comments
 (0)