Skip to content

Commit f1cf59e

Browse files
rabbitstackrabbitstack
committed
refactor(filter,field): Rename image.* fields
1 parent 81c4832 commit f1cf59e

8 files changed

Lines changed: 362 additions & 200 deletions

File tree

‎pkg/filter/accessor.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ func (f *filter) narrowAccessors() {
156156
removeEvtAccessor = true
157157
removePsAccessor = true
158158
removeThreadAccessor = true
159-
removeImageAccessor = true
159+
removeModuleAccessor = true
160160
removeFileAccessor = true
161161
removeRegistryAccessor = true
162162
removeNetworkAccessor = true
@@ -169,14 +169,14 @@ func (f *filter) narrowAccessors() {
169169

170170
for _, field := range f.fields {
171171
switch {
172-
case field.Name.IsKevtField(), field.Name.IsEvtField():
172+
case field.Name.IsEvtField() || field.Name.IsKevtField():
173173
removeEvtAccessor = false
174174
case field.Name.IsPsField():
175175
removePsAccessor = false
176176
case field.Name.IsThreadField():
177177
removeThreadAccessor = false
178-
case field.Name.IsImageField():
179-
removeImageAccessor = false
178+
case field.Name.IsImageField() || field.Name.IsModuleField():
179+
removeModuleAccessor = false
180180
case field.Name.IsFileField():
181181
removeFileAccessor = false
182182
case field.Name.IsRegistryField():
@@ -205,8 +205,8 @@ func (f *filter) narrowAccessors() {
205205
if removeThreadAccessor {
206206
f.removeAccessor(&threadAccessor{})
207207
}
208-
if removeImageAccessor {
209-
f.removeAccessor(&imageAccessor{})
208+
if removeModuleAccessor {
209+
f.removeAccessor(&moduleAccessor{})
210210
}
211211
if removeFileAccessor {
212212
f.removeAccessor(&fileAccessor{})

‎pkg/filter/accessor_windows.go‎

Lines changed: 42 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ func GetAccessors() []Accessor {
5959
newDNSAccessor(),
6060
newFileAccessor(),
6161
newEventAccessor(),
62-
newImageAccessor(),
62+
newModuleAccessor(),
6363
newThreadAccessor(),
6464
newHandleAccessor(),
6565
newNetworkAccessor(),
@@ -616,7 +616,7 @@ func (t *threadAccessor) Get(f Field, e *event.Event) (params.Value, error) {
616616
return frame.Symbol, nil
617617
}
618618
return nil, nil
619-
case fields.ThreadCallstackFinalUserModuleSignatureIsSigned, fields.ThreadCallstackFinalUserModuleSignatureIsTrusted:
619+
case fields.ThreadCallstackFinalUserModuleSignatureExists, fields.ThreadCallstackFinalUserModuleSignatureTrusted:
620620
frame := e.Callstack.FinalUserFrame()
621621
if frame == nil || (frame != nil && frame.ModuleAddress.IsZero()) {
622622
return nil, nil
@@ -627,12 +627,12 @@ func (t *threadAccessor) Get(f Field, e *event.Event) (params.Value, error) {
627627
return nil, nil
628628
}
629629

630-
if f.Name == fields.ThreadCallstackFinalUserModuleSignatureIsSigned {
630+
if f.Name == fields.ThreadCallstackFinalUserModuleSignatureExists {
631631
return sign.IsSigned(), nil
632632
}
633633

634634
return sign.IsTrusted(), nil
635-
case fields.ThreadCallstackFinalUserModuleSignatureCertIssuer, fields.ThreadCallstackFinalUserModuleSignatureCertSubject:
635+
case fields.ThreadCallstackFinalUserModuleSignatureIssuer, fields.ThreadCallstackFinalUserModuleSignatureSubject:
636636
frame := e.Callstack.FinalUserFrame()
637637
if frame == nil || (frame != nil && frame.ModuleAddress.IsZero()) {
638638
return nil, nil
@@ -643,7 +643,7 @@ func (t *threadAccessor) Get(f Field, e *event.Event) (params.Value, error) {
643643
return nil, nil
644644
}
645645

646-
if sign.HasCertificate() && f.Name == fields.ThreadCallstackFinalUserModuleSignatureCertIssuer {
646+
if sign.HasCertificate() && f.Name == fields.ThreadCallstackFinalUserModuleSignatureIssuer {
647647
return sign.Cert.Issuer, nil
648648
}
649649

@@ -737,24 +737,24 @@ func (l *fileAccessor) Get(f Field, e *event.Event) (params.Value, error) {
737737
return nil, nil
738738
}
739739

740-
// imageAccessor extracts image (DLL, executable, driver) event values.
741-
type imageAccessor struct{}
740+
// moduleAccessor extracts module (DLL, executable, driver) event values.
741+
type moduleAccessor struct{}
742742

743-
func (imageAccessor) SetFields(fields []Field) {
743+
func (moduleAccessor) SetFields(fields []Field) {
744744
initLOLDriversClient(fields)
745745
}
746-
func (imageAccessor) SetSegments([]fields.Segment) {}
746+
func (moduleAccessor) SetSegments([]fields.Segment) {}
747747

748-
func (imageAccessor) IsFieldAccessible(e *event.Event) bool {
748+
func (moduleAccessor) IsFieldAccessible(e *event.Event) bool {
749749
return e.Category == event.Image
750750
}
751751

752-
func newImageAccessor() Accessor {
753-
return &imageAccessor{}
752+
func newModuleAccessor() Accessor {
753+
return &moduleAccessor{}
754754
}
755755

756-
func (i *imageAccessor) Get(f Field, e *event.Event) (params.Value, error) {
757-
if e.IsLoadImage() && (f.Name == fields.ImageSignatureType || f.Name == fields.ImageSignatureLevel || f.Name.IsImageCert()) {
756+
func (*moduleAccessor) Get(f Field, e *event.Event) (params.Value, error) {
757+
if e.IsLoadImage() && (f.Name.IsModuleSignature() || f.Name == fields.ImageSignatureType || f.Name == fields.ImageSignatureLevel || f.Name.IsImageCert()) {
758758
filename := e.GetParamAsString(params.ImagePath)
759759
addr := e.Params.MustGetUint64(params.ImageBase)
760760
typ := e.Params.MustGetUint32(params.ImageSignatureType)
@@ -771,7 +771,7 @@ func (i *imageAccessor) Get(f Field, e *event.Event) (params.Value, error) {
771771
Filename: filename,
772772
}
773773
}
774-
if f.Name.IsImageCert() {
774+
if f.Name.IsImageCert() || f.Name.IsModuleCert() {
775775
err := sign.ParseCertificate()
776776
if err != nil {
777777
certErrors.Add(1)
@@ -795,7 +795,7 @@ func (i *imageAccessor) Get(f Field, e *event.Event) (params.Value, error) {
795795
if sign.IsSigned() {
796796
sign.Verify()
797797
}
798-
if f.Name.IsImageCert() {
798+
if f.Name.IsImageCert() || f.Name.IsModuleCert() {
799799
err := sign.ParseCertificate()
800800
if err != nil {
801801
certErrors.Add(1)
@@ -816,49 +816,56 @@ func (i *imageAccessor) Get(f Field, e *event.Event) (params.Value, error) {
816816
e.AppendParam(params.ImageCertNotAfter, params.Time, sign.Cert.NotAfter)
817817
e.AppendParam(params.ImageCertNotBefore, params.Time, sign.Cert.NotBefore)
818818
}
819+
820+
switch f.Name {
821+
case fields.ModuleSignatureExists, fields.DllSignatureExists:
822+
return sign != nil && sign.IsSigned(), nil
823+
case fields.ModuleSignatureTrusted, fields.DllSignatureTrusted:
824+
return sign != nil && sign.IsTrusted(), nil
825+
}
819826
}
820827

821828
switch f.Name {
822-
case fields.ImagePath:
829+
case fields.ImagePath, fields.ModulePath, fields.DllPath:
823830
return e.GetParamAsString(params.ImagePath), nil
824-
case fields.ImageName:
831+
case fields.ImageName, fields.ModuleName, fields.DllName:
825832
return filepath.Base(e.GetParamAsString(params.ImagePath)), nil
826-
case fields.ImageDefaultAddress:
833+
case fields.ImageDefaultAddress, fields.ModuleDefaultAddress:
827834
return e.GetParamAsString(params.ImageDefaultBase), nil
828-
case fields.ImageBase:
835+
case fields.ImageBase, fields.ModuleBase, fields.DllBase:
829836
return e.GetParamAsString(params.ImageBase), nil
830-
case fields.ImageSize:
837+
case fields.ImageSize, fields.ModuleSize, fields.DllSize:
831838
return e.Params.GetUint64(params.ImageSize)
832-
case fields.ImageChecksum:
839+
case fields.ImageChecksum, fields.ModuleChecksum:
833840
return e.Params.GetUint32(params.ImageCheckSum)
834-
case fields.ImagePID:
841+
case fields.ImagePID, fields.ModulePID, fields.DllPID:
835842
return e.Params.GetPid()
836-
case fields.ImageSignatureType:
843+
case fields.ImageSignatureType, fields.ModuleSignatureType, fields.DllSignatureType:
837844
return e.GetParamAsString(params.ImageSignatureType), nil
838-
case fields.ImageSignatureLevel:
845+
case fields.ImageSignatureLevel, fields.ModuleSignatureLevel, fields.DllSignatureLevel:
839846
return e.GetParamAsString(params.ImageSignatureLevel), nil
840-
case fields.ImageCertSubject:
847+
case fields.ImageCertSubject, fields.ModuleSignatureSubject, fields.DllSignatureSubject:
841848
return e.GetParamAsString(params.ImageCertSubject), nil
842-
case fields.ImageCertIssuer:
849+
case fields.ImageCertIssuer, fields.ModuleSignatureIssuer, fields.DllSignatureIssuer:
843850
return e.GetParamAsString(params.ImageCertIssuer), nil
844-
case fields.ImageCertSerial:
851+
case fields.ImageCertSerial, fields.ModuleSignatureSerial, fields.DllSignatureSerial:
845852
return e.GetParamAsString(params.ImageCertSerial), nil
846-
case fields.ImageCertBefore:
853+
case fields.ImageCertBefore, fields.ModuleSignatureBefore, fields.DllSignatureBefore:
847854
return e.Params.GetTime(params.ImageCertNotBefore)
848-
case fields.ImageCertAfter:
855+
case fields.ImageCertAfter, fields.ModuleSignatureAfter, fields.DllSignatureAfter:
849856
return e.Params.GetTime(params.ImageCertNotAfter)
850-
case fields.ImageIsDriverVulnerable, fields.ImageIsDriverMalicious:
857+
case fields.ImageIsDriverVulnerable, fields.ImageIsDriverMalicious, fields.ModuleIsDriverVulnerable, fields.ModuleIsDriverMalicious:
851858
if e.IsLoadImage() {
852859
return isLOLDriver(f.Name, e)
853860
}
854861
return false, nil
855-
case fields.ImageIsDLL:
862+
case fields.ImageIsDLL, fields.ModuleIsDLL:
856863
return e.Params.GetBool(params.FileIsDLL)
857-
case fields.ImageIsDriver:
864+
case fields.ImageIsDriver, fields.ModuleIsDriver:
858865
return e.Params.GetBool(params.FileIsDriver)
859-
case fields.ImageIsExecutable:
866+
case fields.ImageIsExecutable, fields.ModuleIsExecutable:
860867
return e.Params.GetBool(params.FileIsExecutable)
861-
case fields.ImageIsDotnet:
868+
case fields.ImageIsDotnet, fields.ModuleIsDotnet, fields.DllIsDotnet:
862869
return e.Params.GetBool(params.FileIsDotnet)
863870
}
864871

‎pkg/filter/accessor_windows_test.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,14 @@
1919
package filter
2020

2121
import (
22+
"reflect"
23+
"testing"
24+
2225
"github.com/rabbitstack/fibratus/pkg/callstack"
2326
"github.com/rabbitstack/fibratus/pkg/event"
2427
ptypes "github.com/rabbitstack/fibratus/pkg/ps/types"
2528
"github.com/stretchr/testify/assert"
2629
"github.com/stretchr/testify/require"
27-
"reflect"
28-
"testing"
2930
)
3031

3132
func TestNarrowAccessors(t *testing.T) {
@@ -136,7 +137,7 @@ func TestIsFieldAccessible(t *testing.T) {
136137
true,
137138
},
138139
{
139-
newImageAccessor(),
140+
newModuleAccessor(),
140141
&event.Event{Type: event.LoadImage, Category: event.Image},
141142
true,
142143
},

0 commit comments

Comments
 (0)