Skip to content

refactor(event)!: Rename image to module #656

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rabbitstack wants to merge 1 commit into
base: master
Choose a base branch
from
Open

refactor(event)!: Rename image to module #656

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions configs/fibratus.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ event:
serialize-threads: false

# Indicates if modules such as Dynamic Linked Libraries are serialized as part of the process state
serialize-images: false
serialize-modules: false

# Indicates if handles are serialized as part of the process state
serialize-handles: false
Expand Down Expand Up @@ -240,8 +240,8 @@ eventsource:
# Determines whether VA map/unmap events are collected by Kernel Logger provider
#enable-vamap: true

# Determines whether image events are collected by Kernel Logger provider
#enable-image: true
# Determines whether module events are collected by Kernel Logger provider
#enable-module: true

# Determines whether object manager events (handle creation/destruction) are
# collected by Kernel Logger provider
Expand Down
2 changes: 1 addition & 1 deletion internal/etw/processors/chain_windows.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ func NewChain(
if config.EventSource.EnableRegistryEvents {
chain.addProcessor(newRegistryProcessor(hsnap))
}
if config.EventSource.EnableImageEvents {
if config.EventSource.EnableModuleEvents {
chain.addProcessor(newModuleProcessor(psnap))
}
if config.EventSource.EnableNetEvents {
Expand Down
5 changes: 3 additions & 2 deletions internal/etw/processors/handle_windows.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,14 @@
package processors

import (
"strings"

"github.com/rabbitstack/fibratus/pkg/event"
"github.com/rabbitstack/fibratus/pkg/event/params"
"github.com/rabbitstack/fibratus/pkg/fs"
"github.com/rabbitstack/fibratus/pkg/handle"
"github.com/rabbitstack/fibratus/pkg/ps"
"github.com/rabbitstack/fibratus/pkg/util/key"
"strings"
)

type handleProcessor struct {
Expand Down Expand Up @@ -92,7 +93,7 @@ func (h *handleProcessor) processEvent(e *event.Event) (*event.Event, error) {
driverPath = driverName
}
h.devPathResolver.RemovePath(driverName)
e.Params.Append(params.ImagePath, params.Path, driverPath)
e.Params.Append(params.ModulePath, params.Path, driverPath)
}
// assign the formatted handle name
if err := e.Params.SetValue(params.HandleObjectName, name); err != nil {
Expand Down
10 changes: 5 additions & 5 deletions internal/etw/processors/module_windows.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,24 +34,24 @@ func newModuleProcessor(psnap ps.Snapshotter) Processor {
return m
}

func (*moduleProcessor) Name() ProcessorType { return Image }
func (*moduleProcessor) Name() ProcessorType { return Module }

func (m *moduleProcessor) ProcessEvent(e *event.Event) (*event.Event, bool, error) {
if e.IsLoadImageInternal() {
if e.IsLoadModuleInternal() {
// state management
return e, false, m.psnap.AddModule(e)
}

if e.IsUnloadImage() {
if e.IsUnloadModule() {
pid := e.Params.MustGetPid()
addr := e.Params.TryGetAddress(params.ImageBase)
addr := e.Params.TryGetAddress(params.ModuleBase)
if pid == 0 {
pid = e.PID
}
return e, false, m.psnap.RemoveModule(pid, addr)
}

if e.IsLoadImage() || e.IsImageRundown() {
if e.IsLoadModule() || e.IsModuleRundown() {
return e, false, m.psnap.AddModule(e)
}

Expand Down
52 changes: 26 additions & 26 deletions internal/etw/processors/module_windows_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,16 +41,16 @@ func TestModuleProcessor(t *testing.T) {
assertions func(*event.Event, *testing.T, *ps.SnapshotterMock)
}{
{
"load new image",
"load new Module",
&event.Event{
Type: event.LoadImage,
Type: event.LoadModule,
Params: event.Params{
params.ImagePath: {Name: params.ImagePath, Type: params.UnicodeString, Value: filepath.Join(os.Getenv("windir"), "System32", "kernel32.dll")},
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)},
params.ImageCheckSum: {Name: params.ImageCheckSum, Type: params.Uint32, Value: uint32(2323432)},
params.ImageBase: {Name: params.ImageBase, Type: params.Address, Value: uint64(0x7ffb313833a3)},
params.ImageSignatureType: {Name: params.ImageSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types},
params.ImageSignatureLevel: {Name: params.ImageSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels},
params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: filepath.Join(os.Getenv("windir"), "System32", "kernel32.dll")},
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)},
params.ModuleCheckSum: {Name: params.ModuleCheckSum, Type: params.Uint32, Value: uint32(2323432)},
params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0x7ffb313833a3)},
params.ModuleSignatureType: {Name: params.ModuleSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types},
params.ModuleSignatureLevel: {Name: params.ModuleSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels},
},
},
func() *ps.SnapshotterMock {
Expand All @@ -61,21 +61,21 @@ func TestModuleProcessor(t *testing.T) {
func(e *event.Event, t *testing.T, psnap *ps.SnapshotterMock) {
psnap.AssertNumberOfCalls(t, "AddModule", 1)
// should get the signature verified
assert.Equal(t, "EMBEDDED", e.GetParamAsString(params.ImageSignatureType))
assert.Equal(t, "AUTHENTICODE", e.GetParamAsString(params.ImageSignatureLevel))
assert.Equal(t, "EMBEDDED", e.GetParamAsString(params.ModuleSignatureType))
assert.Equal(t, "AUTHENTICODE", e.GetParamAsString(params.ModuleSignatureLevel))
},
},
{
"parse image characteristics",
"parse Module characteristics",
&event.Event{
Type: event.LoadImage,
Type: event.LoadModule,
Params: event.Params{
params.ImagePath: {Name: params.ImagePath, Type: params.UnicodeString, Value: "../_fixtures/mscorlib.dll"},
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)},
params.ImageCheckSum: {Name: params.ImageCheckSum, Type: params.Uint32, Value: uint32(2323432)},
params.ImageBase: {Name: params.ImageBase, Type: params.Address, Value: uint64(0x7ffb313833a3)},
params.ImageSignatureType: {Name: params.ImageSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types},
params.ImageSignatureLevel: {Name: params.ImageSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels},
params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "../_fixtures/mscorlib.dll"},
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(1023)},
params.ModuleCheckSum: {Name: params.ModuleCheckSum, Type: params.Uint32, Value: uint32(2323432)},
params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0x7ffb313833a3)},
params.ModuleSignatureType: {Name: params.ModuleSignatureType, Type: params.Enum, Value: uint32(1), Enum: signature.Types},
params.ModuleSignatureLevel: {Name: params.ModuleSignatureLevel, Type: params.Enum, Value: uint32(4), Enum: signature.Levels},
},
},
func() *ps.SnapshotterMock {
Expand All @@ -88,16 +88,16 @@ func TestModuleProcessor(t *testing.T) {
},
},
{
"unload image",
"unload Module",
&event.Event{
Type: event.UnloadImage,
Type: event.LoadModule,
Params: event.Params{
params.ImagePath: {Name: params.ImagePath, Type: params.UnicodeString, Value: "C:\\Windows\\system32\\kernel32.dll"},
params.ProcessName: {Name: params.ProcessName, Type: params.AnsiString, Value: "csrss.exe"},
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(676)},
params.ImageBase: {Name: params.ImageBase, Type: params.Address, Value: uint64(0xfffb313833a3)},
params.ImageSignatureType: {Name: params.ImageSignatureType, Type: params.Enum, Value: uint32(0), Enum: signature.Types},
params.ImageSignatureLevel: {Name: params.ImageSignatureLevel, Type: params.Enum, Value: uint32(0), Enum: signature.Levels},
params.ModulePath: {Name: params.ModulePath, Type: params.UnicodeString, Value: "C:\\Windows\\system32\\kernel32.dll"},
params.ProcessName: {Name: params.ProcessName, Type: params.AnsiString, Value: "csrss.exe"},
params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: uint32(676)},
params.ModuleBase: {Name: params.ModuleBase, Type: params.Address, Value: uint64(0xfffb313833a3)},
params.ModuleSignatureType: {Name: params.ModuleSignatureType, Type: params.Enum, Value: uint32(0), Enum: signature.Types},
params.ModuleSignatureLevel: {Name: params.ModuleSignatureLevel, Type: params.Enum, Value: uint32(0), Enum: signature.Levels},
},
},
func() *ps.SnapshotterMock {
Expand Down
8 changes: 4 additions & 4 deletions internal/etw/processors/processor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,8 @@ const (
Fs
// Registry represents the registry event processor.
Registry
// Image represents the image event processor.
Image
// Module represents the module event processor.
Module
// Net represents the network event processor.
Net
// Handle represents the handle event processor.
Expand Down Expand Up @@ -66,8 +66,8 @@ func (typ ProcessorType) String() string {
return "file"
case Registry:
return "registry"
case Image:
return "image"
case Module:
return "module"
case Net:
return "net"
case Handle:
Expand Down
9 changes: 5 additions & 4 deletions internal/etw/source.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,9 @@ import (
"errors"
"expvar"
"fmt"
"time"
"unsafe"

"github.com/rabbitstack/fibratus/internal/etw/processors"
"github.com/rabbitstack/fibratus/pkg/config"
errs "github.com/rabbitstack/fibratus/pkg/errors"
Expand All @@ -34,8 +37,6 @@ import (
"github.com/rabbitstack/fibratus/pkg/util/multierror"
log "github.com/sirupsen/logrus"
"golang.org/x/sys/windows/registry"
"time"
"unsafe"
)

const (
Expand Down Expand Up @@ -129,7 +130,7 @@ func (e *EventSource) Open(config *config.Config) error {
// are not captured
if e.r != nil {
config.EventSource.EnableThreadEvents = config.EventSource.EnableThreadEvents && e.r.HasThreadEvents
config.EventSource.EnableImageEvents = config.EventSource.EnableImageEvents && e.r.HasImageEvents
config.EventSource.EnableModuleEvents = config.EventSource.EnableModuleEvents && e.r.HasModuleEvents
config.EventSource.EnableNetEvents = config.EventSource.EnableNetEvents && e.r.HasNetworkEvents
config.EventSource.EnableRegistryEvents = config.EventSource.EnableRegistryEvents && (e.r.HasRegistryEvents || (config.Yara.Enabled && !config.Yara.SkipRegistry))
config.EventSource.EnableFileIOEvents = config.EventSource.EnableFileIOEvents && (e.r.HasFileEvents || (config.Yara.Enabled && !config.Yara.SkipFiles))
Expand All @@ -140,7 +141,7 @@ func (e *EventSource) Open(config *config.Config) error {
config.EventSource.EnableThreadpoolEvents = config.EventSource.EnableThreadpoolEvents && e.r.HasThreadpoolEvents
for _, typ := range event.All() {
if typ == event.CreateProcess || typ == event.TerminateProcess ||
typ == event.LoadImage || typ == event.UnloadImage {
typ == event.LoadModule || typ == event.UnloadModule {
// always allow fundamental events
continue
}
Expand Down
40 changes: 20 additions & 20 deletions internal/etw/source_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {

r := &config.RulesCompileResult{
HasProcEvents: true,
HasImageEvents: true,
HasModuleEvents: true,
HasRegistryEvents: true,
HasNetworkEvents: true,
HasFileEvents: true,
Expand All @@ -177,7 +177,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
HasAuditAPIEvents: true,
UsedEvents: []event.Type{
event.CreateProcess,
event.LoadImage,
event.LoadModule,
event.RegCreateKey,
event.RegSetValue,
event.CreateFile,
Expand All @@ -191,7 +191,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
EventSource: config.EventSourceConfig{
EnableThreadEvents: true,
EnableRegistryEvents: true,
EnableImageEvents: true,
EnableModuleEvents: true,
EnableFileIOEvents: true,
EnableAuditAPIEvents: true,
},
Expand All @@ -212,7 +212,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
// rules compile result doesn't have the thread event
// and thread events are enabled in the config
require.True(t, flags&etw.Thread == 0)
require.True(t, flags&etw.ImageLoad != 0)
require.True(t, flags&etw.Module != 0)
require.True(t, flags&etw.Registry != 0)
// rules compile result has the network event
// but network I/O is disabled in the config
Expand All @@ -222,7 +222,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
// but VAMap is disabled in the config
require.True(t, flags&etw.VaMap == 0)

require.False(t, cfg.EventSource.TestDropMask(event.UnloadImage))
require.False(t, cfg.EventSource.TestDropMask(event.UnloadModule))
require.True(t, cfg.EventSource.TestDropMask(event.WriteFile))
require.True(t, cfg.EventSource.TestDropMask(event.UnmapViewFile))
require.False(t, cfg.EventSource.TestDropMask(event.OpenProcess))
Expand All @@ -248,15 +248,15 @@ func TestEventSourceEnableFlagsDynamicallyWithYaraEnabled(t *testing.T) {

r := &config.RulesCompileResult{
HasProcEvents: true,
HasImageEvents: true,
HasModuleEvents: true,
HasRegistryEvents: true,
HasNetworkEvents: true,
HasFileEvents: false,
HasThreadEvents: false,
HasAuditAPIEvents: true,
UsedEvents: []event.Type{
event.CreateProcess,
event.LoadImage,
event.LoadModule,
event.RegCreateKey,
event.RegSetValue,
event.RenameFile,
Expand All @@ -268,7 +268,7 @@ func TestEventSourceEnableFlagsDynamicallyWithYaraEnabled(t *testing.T) {
EventSource: config.EventSourceConfig{
EnableThreadEvents: true,
EnableRegistryEvents: true,
EnableImageEvents: true,
EnableModuleEvents: true,
EnableFileIOEvents: true,
EnableAuditAPIEvents: true,
EnableVAMapEvents: false,
Expand Down Expand Up @@ -326,7 +326,7 @@ func TestEventSourceRundownEvents(t *testing.T) {

evsConfig := config.EventSourceConfig{
EnableThreadEvents: true,
EnableImageEvents: true,
EnableModuleEvents: true,
EnableFileIOEvents: true,
EnableNetEvents: true,
EnableRegistryEvents: true,
Expand All @@ -348,7 +348,7 @@ func TestEventSourceRundownEvents(t *testing.T) {
rundownsByType := map[event.Type]bool{
event.ProcessRundown: false,
event.ThreadRundown: false,
event.ImageRundown: false,
event.ModuleRundown: false,
event.FileRundown: false,
event.RegKCBRundown: false,
}
Expand Down Expand Up @@ -435,11 +435,11 @@ func TestEventSourceAllEvents(t *testing.T) {
false,
},
{
"load image",
"load module",
nil,
func(e *event.Event) bool {
img := filepath.Join(os.Getenv("windir"), "System32", "notepad.exe")
return e.IsLoadImage() && strings.EqualFold(img, e.GetParamAsString(params.ImagePath))
return e.IsLoadModule() && strings.EqualFold(img, e.GetParamAsString(params.ModulePath))
},
false,
},
Expand Down Expand Up @@ -491,7 +491,7 @@ func TestEventSourceAllEvents(t *testing.T) {
{
"map view section",
func() error {
const SecImage = 0x01000000
const SecModule = 0x01000000
const SectionRead = 0x4

var sec windows.Handle
Expand All @@ -514,7 +514,7 @@ func TestEventSourceAllEvents(t *testing.T) {
0,
uintptr(unsafe.Pointer(&size)),
windows.PAGE_READONLY,
SecImage,
SecModule,
windows.Handle(f.Fd()),
); err != nil {
return fmt.Errorf("NtCreateSection: %v", err)
Expand All @@ -539,7 +539,7 @@ func TestEventSourceAllEvents(t *testing.T) {
func(e *event.Event) bool {
return e.CurrentPid() && e.Type == event.MapViewFile &&
e.GetParamAsString(params.MemProtect) == "EXECUTE_READWRITE|READONLY" &&
e.GetParamAsString(params.FileViewSectionType) == "IMAGE" &&
e.GetParamAsString(params.FileViewSectionType) == "Module" &&
strings.Contains(e.GetParamAsString(params.FilePath), "_fixtures\\yara-test.dll")
},
false,
Expand Down Expand Up @@ -717,7 +717,7 @@ func TestEventSourceAllEvents(t *testing.T) {

evsConfig := config.EventSourceConfig{
EnableThreadEvents: true,
EnableImageEvents: true,
EnableModuleEvents: true,
EnableFileIOEvents: true,
EnableVAMapEvents: true,
EnableNetEvents: true,
Expand Down Expand Up @@ -889,10 +889,10 @@ func testCallstackEnrichment(t *testing.T, hsnap handle.Snapshotter, psnap ps.Sn
false,
},
{
"load image callstack",
"load Module callstack",
nil,
func(e *event.Event) bool {
if e.IsLoadImage() && filepath.Ext(e.GetParamAsString(params.FilePath)) == ".dll" {
if e.IsLoadModule() && filepath.Ext(e.GetParamAsString(params.FilePath)) == ".dll" {
callstack := e.Callstack.String()
return strings.Contains(strings.ToLower(callstack), strings.ToLower("\\WINDOWS\\System32\\KERNELBASE.dll!LoadLibraryExW")) &&
strings.Contains(strings.ToLower(callstack), strings.ToLower("\\WINDOWS\\system32\\ntoskrnl.exe!NtMapViewOfSection"))
Expand Down Expand Up @@ -1202,7 +1202,7 @@ func testCallstackEnrichment(t *testing.T, hsnap handle.Snapshotter, psnap ps.Sn

evsConfig := config.EventSourceConfig{
EnableThreadEvents: true,
EnableImageEvents: true,
EnableModuleEvents: true,
EnableFileIOEvents: true,
EnableRegistryEvents: true,
EnableMemEvents: true,
Expand Down Expand Up @@ -1327,7 +1327,7 @@ func TestEvasionScanner(t *testing.T) {

evsConfig := config.EventSourceConfig{
EnableThreadEvents: true,
EnableImageEvents: true,
EnableModuleEvents: true,
EnableFileIOEvents: false,
EnableVAMapEvents: true,
EnableNetEvents: true,
Expand Down
Loading
Loading