admin/8damon-Blackbird-Platform
1
0
Fork 0
mirror of https://github.com/8damon/Blackbird-Platform synced 2026-06-21 13:41:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dev
8damon-Blackbird-Platform/Client/analysis/Shell/MainWindow.Backend.cs
T
dutchpsycho e8bb4f0841 ui/shell: rebuild main window backend flow
2026-05-06 09:11:24 +10:00

8674 lines
408 KiB
C#
Raw Permalink Blame History

using BlackbirdInterface.Capture;
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.Diagnostics;
using System.Globalization;
using System.Linq;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using System.Windows;
using System.Windows.Controls;
using System.Windows.Threading;
namespace BlackbirdInterface
{
public partial class MainWindow
{
private BlackbirdBackendSession? _backendSession;
private int _backendGeneration;
private Action<IoctlParsedEvent>? _sessionIoctlHandler;
private Action<BlackbirdNative.BkIpcEtwEvent>? _sessionEtwHandler;
private Action<BackendStatsView>? _sessionStatsHandler;
private Action<string>? _sessionStatusHandler;
private CaptureProjectionEngine? _captureProjection;
private readonly Dictionary<int, List<GroupedEventRow>> _etwHistoryByPid = new();
private readonly Dictionary<int, List<GroupedEventRow>> _heuristicsHistoryByPid = new();
private readonly Dictionary<int, List<GroupedEventRow>> _filesystemHistoryByPid = new();
private readonly Dictionary<int, List<GroupedEventRow>> _registryHistoryByPid = new();
private readonly Dictionary<int, List<GroupedEventRow>> _relationsHistoryByPid = new();
private readonly Dictionary<int, List<ApiCallGraphRowSnapshot>> _apiGraphHistoryByPid = new();
private readonly Dictionary<int, List<ExtendedActivityRowSnapshot>> _extendedHistoryByPid = new();
private readonly Dictionary<string, ApiCallGraphRowSnapshot> _apiGraphRowsByKey = new(StringComparer.Ordinal);
private readonly Dictionary<string, ExtendedActivityRowSnapshot> _extendedRowsByKey =
new(StringComparer.Ordinal);
private readonly Dictionary<string, string> _apiGraphReasonByKey = new(StringComparer.Ordinal);
private readonly Dictionary<string, string> _apiGraphActionByKey = new(StringComparer.Ordinal);
private readonly Dictionary<string, string> _apiGraphDecodedByKey = new(StringComparer.Ordinal);
private readonly Dictionary<string, string> _apiGraphFramesByKey = new(StringComparer.Ordinal);
private readonly Dictionary<string, string> _apiGraphSensorByKey = new(StringComparer.Ordinal);
private readonly Dictionary<string, DateTime> _apiGraphTimelineLastEmitByKey = new(StringComparer.Ordinal);
private readonly Dictionary<string, DateTime> _observedHookStackLastPersistByThread =
new(StringComparer.Ordinal);
private readonly Dictionary<string, DateTime> _threadStackFallbackLastCaptureByThread =
new(StringComparer.Ordinal);
private readonly ConcurrentDictionary<string, byte> _pendingThreadStackFallbackCaptures =
new(StringComparer.Ordinal);
private readonly Dictionary<ulong, ApiMemoryPageSignal> _apiMemorySignalsByPage = new();
private readonly Dictionary<uint, string> _targetExitReasonByPid = new();
private long _usermodeHookEventCount;
private long _kernelHookEventCount;
private bool _apiGraphSnapshotDirty;
private bool _extendedViewSnapshotDirty;
private BlackbirdPreflightReport? _lastPreflight;
private string? _lastConnectivityIssueSignature;
private readonly ConcurrentQueue<IoctlParsedEvent> _pendingIoctlEvents = new();
private readonly ConcurrentQueue<BlackbirdNative.BkIpcEtwEvent> _pendingEtwEvents = new();
private readonly ConcurrentQueue<string> _pendingStatusLines = new();
private readonly ConcurrentQueue<BackendUiWorkItem> _pendingUiWork = new();
private readonly AutoResetEvent _backendTransformSignal = new(false);
private CancellationTokenSource? _backendTransformCts;
private Task? _backendTransformTask;
private readonly ConcurrentDictionary<uint, byte> _pendingMonitoredProcessRegistrations = new();
private long _pendingIoctlCount;
private long _pendingEtwCount;
private long _pendingStatusCount;
private long _pendingUiWorkCount;
private long _droppedIoctlForPressure;
private long _droppedEtwForPressure;
private long _droppedUiWorkForPressure;
private int _backendUiFlushScheduled;
private const int MaxBackendTransformItemsPerBatch = 1500;
private const int MaxBackendUiItemsPerFlush = 220;
private const int MaxBackendUiItemsPerFlushUnderPressure = 1400;
private const int MaxBackendStatusLinesPerTransformBatch = 64;
private const int MaxBackendStatusLinesPerUiFlush = 32;
private const int FilesystemTimelineClusterFlushCount = 600;
private const int MaxRecentImageFileAccesses = 2048;
private const int MaxRecentImageMapStates = 2048;
private const int MaxPendingIoctlEvents = 30000;
private const int MaxPendingEtwEvents = 18000;
private const int MaxPendingUiWorkItems = 20000;
private const int IoctlPressureSoftLimit = (MaxPendingIoctlEvents * 7) / 10;
private const int IoctlPressureCriticalLimit = (MaxPendingIoctlEvents * 9) / 10;
private const int EtwPressureSoftLimit = (MaxPendingEtwEvents * 7) / 10;
private const int EtwPressureCriticalLimit = (MaxPendingEtwEvents * 9) / 10;
private const double MemoryHighEntropyBits = 7.15;
private const double MemoryEntropyFlipDeltaBits = 0.55;
private const uint MemoryEntropyMinSampleBytes = 32;
private const uint CorrelationIntentMask = 0x00000007u;
private const uint HandleFlagExecProtect = 0x00000001u;
private const uint HandleFlagFromNtdll = 0x00000002u;
private const uint HandleFlagFromExe = 0x00000004u;
private const uint HandleFlagThreadObject = 0x00000010u;
private const uint HandleFlagDuplicateOperation = 0x00000020u;
private const uint HandleFlagStackValidated = 0x00000400u;
private const uint HandleFlagStackSpoofSuspect = 0x00000800u;
private const uint HandleFlagSyscallExportMatch = 0x00001000u;
private const uint HandleFlagSyscallExportMismatch = 0x00002000u;
private const uint HandleFlagTebStackBoundsValid = 0x00010000u;
private const uint HandleFlagFramesOutsideTebStack = 0x00020000u;
private const uint HighSignalHandleMask = HandleFlagStackSpoofSuspect | HandleFlagSyscallExportMismatch;
private const uint ThreadHighSignalMask =
0x00000004u | 0x00000008u | 0x00000010u | 0x00000020u | 0x00000040u | 0x00000080u | 0x00000100u;
private static readonly TimeSpan BackendUiFlushBudget = TimeSpan.FromMilliseconds(5);
private static readonly TimeSpan BackendUiFlushBudgetUnderPressure = TimeSpan.FromMilliseconds(18);
private static readonly TimeSpan FilesystemTimelineClusterWindow = TimeSpan.FromMilliseconds(15000);
private static readonly TimeSpan FilesystemTimelineClusterIdleFlush = TimeSpan.FromMilliseconds(1500);
private static readonly TimeSpan ApiTimelineEmissionWindow = TimeSpan.FromSeconds(5);
private static readonly TimeSpan ImageMapFileCorrelationWindow = TimeSpan.FromSeconds(4);
private static readonly TimeSpan ImageMapRepeatWindow = TimeSpan.FromSeconds(45);
private static readonly(string Token, string Label)[] VirtualizationArtifactPatterns = {
("\\VBoxGuest", "VirtualBox guest driver"),
("\\VBoxMouse", "VirtualBox mouse driver"),
("\\VBoxMini", "VirtualBox mini redirector"),
("\\VBoxSF", "VirtualBox shared folders"),
("\\VBoxVideo", "VirtualBox video driver"),
("VirtualBox Guest Additions", "VirtualBox guest additions"),
("Oracle\\VirtualBox", "VirtualBox registry key"),
("VBOX__", "VirtualBox ACPI firmware marker"),
("VEN_80EE", "VirtualBox PCI vendor"),
("DiskVBOX", "VirtualBox disk vendor"),
("SystemBiosVersion\\VBOX", "VirtualBox BIOS marker"),
("\\vmhgfs", "VMware shared folders"),
("\\vmmouse", "VMware mouse driver"),
("\\vmci", "VMware VMCI driver"),
("\\vmx_svga", "VMware SVGA driver"),
("VMware Tools", "VMware tools"),
("VMware, Inc.", "VMware registry key"),
("VEN_15AD", "VMware PCI vendor"),
("DiskVMware", "VMware disk vendor"),
("VMW0003", "VMware ACPI marker"),
("qemu-ga", "QEMU guest agent"),
("\\qemufwcfg", "QEMU firmware config driver"),
("QEMU HARDDISK", "QEMU disk vendor"),
("Red Hat VirtIO", "QEMU/VirtIO vendor"),
("\\viostor", "VirtIO storage driver"),
("\\viofs", "VirtIO filesystem driver"),
("\\netkvm", "VirtIO network driver"),
("\\balloon", "VirtIO balloon driver"),
("VEN_1AF4", "VirtIO PCI vendor"),
("\\xen", "Xen driver or registry key"),
("XenTools", "Xen tools"),
("VEN_5853", "Xen PCI vendor"),
("\\prl_", "Parallels driver"),
("Parallels Tools", "Parallels tools"),
("VEN_1AB8", "Parallels PCI vendor"),
("Hyper-V", "Hyper-V registry key"),
("\\VMBus", "Hyper-V VMBus driver"),
("VID_1414", "Microsoft Hyper-V vendor"),
("SystemManufacturer\\Microsoft Corporation", "Microsoft virtual machine manufacturer")
};
private string? _lastEtwTimelineSignature;
private DateTime _lastEtwTimelineTimestampUtc;
private readonly Dictionary<ulong, IoctlParsedEvent> _recentHandleEvidenceByPair = new();
private DateTime _lastHandleEvidencePruneUtc = DateTime.MinValue;
private readonly Dictionary<string, int> _filesystemClusterOperationCounts = new(StringComparer.Ordinal);
private readonly Dictionary<string, (uint Pid, uint Tid, string Path, uint Operation)>
_filesystemClusterSamplesByOperation = new(StringComparer.Ordinal);
private readonly Dictionary<string, int> _crossProcWriteCountByPair = new(StringComparer.Ordinal);
private readonly Dictionary<string, int> _crossProcRwxAllocCountByPair = new(StringComparer.Ordinal);
private readonly Dictionary<string, int> _antiAnalysisCountByEvidence = new(StringComparer.OrdinalIgnoreCase);
private readonly object _imageMapCorrelationLock = new();
private readonly List<RecentImageFileAccess> _recentImageFileAccesses = new();
private readonly Dictionary<string, RecentImageMapState> _recentImageMapByPidPath =
new(StringComparer.OrdinalIgnoreCase);
private DateTime _lastImageMapCorrelationPruneUtc = DateTime.MinValue;
private readonly Dictionary<uint, DateTime> _observedProcessStartUtcByPid = new();
private readonly Dictionary<uint, ulong> _observedProcessStartKeyByPid = new();
private readonly Dictionary<uint, uint> _observedInitialThreadIdByPid = new();
private readonly Dictionary<string, RegionLifecycleState> _regionLifecycleByIdentity =
new(StringComparer.Ordinal);
private readonly Dictionary<string, ulong> _functionTableBaseByPointer = new(StringComparer.Ordinal);
private volatile int _filterRootPid;
private readonly ConcurrentDictionary<uint, byte> _filterTrackedPids = new();
private volatile int _focusedPid;
internal ObservableCollection<MonitoredProcessEntry> MonitoredProcesses { get; } = new();
private readonly HashSet<uint> _monitoredProcessSet = new();
private int _filesystemClusterTotal;
private DateTime _filesystemClusterWindowStartUtc = DateTime.MinValue;
private DateTime _filesystemClusterLastSeenUtc = DateTime.MinValue;
public void SetFocusedPid(int pid)
{
_focusedPid = pid;
BroadcastFocusedPid(pid);
RefreshProcessSelectorBar();
}
private void BroadcastFocusedPid(int pid)
{
EtwPaneHost.FocusedPid = pid;
EventsPaneHost.FocusedPid = pid;
HeuristicsPaneHost.FocusedPid = pid;
FilesystemPaneHost.FocusedPid = pid;
ProcessRelationsPaneHost.FocusedPid = pid;
}
private void RefreshProcessSelectorBar()
{
ProcessSelectorBarPanel.Children.Clear();
/* "All" chip */
var allBtn =
new System.Windows.Controls.Button { Content = "All", Margin = new System.Windows.Thickness(2, 2, 2, 2),
Padding = new System.Windows.Thickness(8, 2, 8, 2), FontSize = 11,
Tag = 0 };
allBtn.Click += (_, __) => SetFocusedPid(0);
ProcessSelectorBarPanel.Children.Add(allBtn);
foreach (MonitoredProcessEntry entry in MonitoredProcesses)
{
var btn = new System.Windows.Controls.Button { Content = entry.Label,
Margin = new System.Windows.Thickness(2, 2, 2, 2),
Padding = new System.Windows.Thickness(8, 2, 8, 2),
FontSize = 11,
Tag = (int)entry.Pid,
FontWeight = (_focusedPid == (int)entry.Pid)
? System.Windows.FontWeights.Bold
: System.Windows.FontWeights.Normal };
var capturedPid = (int)entry.Pid;
btn.Click += (_, __) => SetFocusedPid(capturedPid);
ProcessSelectorBarPanel.Children.Add(btn);
}
ProcessSelectorBarBorder.Visibility =
MonitoredProcesses.Count > 1 ? System.Windows.Visibility.Visible : System.Windows.Visibility.Collapsed;
}
private void TryRegisterMonitoredProcess(uint pid)
{
if (pid == 0 || _monitoredProcessSet.Contains(pid))
return;
_monitoredProcessSet.Add(pid);
string imageName = string.Empty;
try
{
imageName = ProcessIdentityResolver.Resolve(pid) ?? string.Empty;
}
catch
{
}
MonitoredProcesses.Add(
new MonitoredProcessEntry { Pid = pid, ImageName = imageName, FirstSeenUtc = DateTime.UtcNow });
RefreshProcessSelectorBar();
}
private void RefreshSubsystemSegmentationDiagnostics()
{
bool kernelHooksEnabled = _currentSession?.KernelHooksEnabled ?? _kernelHooksArmed;
bool usermodeHooksEnabled = _currentSession?.UseUsermodeHooks ?? false;
bool signatureIntelEnabled = _currentSession?.SignatureIntelEnabled ?? _signatureIntelEnabled;
bool memoryScanEnabled =
_currentSession?.SignatureIntelMemoryScanEnabled ?? _signatureIntelMemoryScanEnabled;
bool pageScanEnabled = _currentSession?.SignatureIntelPageScanEnabled ?? _signatureIntelPageScanEnabled;
if (!kernelHooksEnabled)
{
DiagnosticsState.SetValue("Kernel Hooks", "Disabled by operator");
}
else
{
string? kernelHooks = DiagnosticsState.GetValue("Kernel Hooks");
if (string.IsNullOrWhiteSpace(kernelHooks) ||
kernelHooks.Contains("Disabled", StringComparison.OrdinalIgnoreCase) ||
kernelHooks.Contains("Inactive", StringComparison.OrdinalIgnoreCase) ||
kernelHooks.Contains("Awaiting", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("Kernel Hooks", "Awaiting telemetry");
}
}
if (!usermodeHooksEnabled)
{
DiagnosticsState.SetValue("Usermode Hooks", "Disabled by operator");
DiagnosticsState.SetValue("Hook Integrity", "Disabled (no usermode hooks)");
DiagnosticsState.SetValue("AMSI Integrity", "Disabled (no usermode hooks)");
}
else
{
string? usermode = DiagnosticsState.GetValue("Usermode Hooks");
if (string.IsNullOrWhiteSpace(usermode) ||
usermode.Contains("Inactive", StringComparison.OrdinalIgnoreCase) ||
usermode.Contains("Disabled", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("Usermode Hooks", "Awaiting hook-ready");
}
if (string.Equals(DiagnosticsState.GetValue("Hook Integrity"), "Disabled (no usermode hooks)",
StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("Hook Integrity", "Unknown");
}
if (string.Equals(DiagnosticsState.GetValue("AMSI Integrity"), "Disabled (no usermode hooks)",
StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("AMSI Integrity", "Unknown");
}
}
DiagnosticsState.SetValue(
"Signature Intel",
signatureIntelEnabled
? $"Enabled memory={(memoryScanEnabled ? "on" : "off")} page={(pageScanEnabled ? "on" : "off")} hash=on"
: "Disabled by operator");
}
private void InitializeBackendUi()
{
EtwPaneHost.ClearAll();
HeuristicsPaneHost.ClearAll();
FilesystemPaneHost.ClearAll();
RegistryPaneHost.ClearAll();
ProcessRelationsPaneHost.ClearAll();
_apiGraphRowsByKey.Clear();
_captureProjection = null;
_extendedRowsByKey.Clear();
_apiGraphReasonByKey.Clear();
_apiGraphActionByKey.Clear();
_apiGraphDecodedByKey.Clear();
_apiGraphFramesByKey.Clear();
_apiGraphSensorByKey.Clear();
_apiGraphTimelineLastEmitByKey.Clear();
_observedHookStackLastPersistByThread.Clear();
_threadStackFallbackLastCaptureByThread.Clear();
_pendingThreadStackFallbackCaptures.Clear();
_apiMemorySignalsByPage.Clear();
_crossProcWriteCountByPair.Clear();
_crossProcRwxAllocCountByPair.Clear();
_antiAnalysisCountByEvidence.Clear();
ResetImageMapCorrelationCaches();
_observedProcessStartUtcByPid.Clear();
_targetExitReasonByPid.Clear();
_extendedViewRows.Clear();
_extendedComRows.Clear();
_extendedEtwRows.Clear();
_extendedJobRows.Clear();
_extendedYaraRows.Clear();
_extendedViewSnapshotDirty = false;
_extendedViewRefreshTimer.Stop();
if (ExtendedViewSummaryBlock != null)
{
ExtendedViewSummaryBlock.Text = "No extended activity yet";
}
_observedProcessStartKeyByPid.Clear();
_observedInitialThreadIdByPid.Clear();
_regionLifecycleByIdentity.Clear();
_functionTableBaseByPointer.Clear();
PublishApiGraphSnapshot();
ResetFilesystemTimelineCluster();
ProcessRelationsPaneHost.SetRootPid(0);
RefreshExplorerDataBadges();
DiagnosticsState.SetValue("UI", "Initialized");
DiagnosticsState.SetValue("Operator Connection Established", "Disabled in analyst interface");
DiagnosticsState.SetValue("Hook Integrity", "Unknown");
DiagnosticsState.SetValue("AMSI Integrity", "Unknown");
DiagnosticsState.SetValue("ETW Integrity", "Unknown");
DiagnosticsState.SetValue("ETW Status", "Ready");
DiagnosticsState.SetValue("API Graph", "patterns=0/0 visible=False");
RefreshSubsystemSegmentationDiagnostics();
}
private void StartBackendForPid(int pid, bool useUsermodeHooks, bool stopExistingSession = true,
bool fastStopExistingSession = false)
{
BlackbirdBackendSession? preparedSession = null;
if (stopExistingSession)
{
StopBackendSession(fastTeardown: fastStopExistingSession);
OutputCapture.Clear();
}
else
{
ClearPendingBackendUiQueues();
}
if (pid <= 0)
{
DisposePreparedLaunchBackendSession();
return;
}
if (_preparedLaunchBackendSession != null)
{
if (_preparedLaunchBackendPid == pid && useUsermodeHooks)
{
preparedSession = _preparedLaunchBackendSession;
_preparedLaunchBackendSession = null;
_preparedLaunchBackendPid = 0;
}
else
{
DisposePreparedLaunchBackendSession();
}
}
_lastEtwTimelineSignature = null;
_lastEtwTimelineTimestampUtc = DateTime.MinValue;
ResetFilesystemTimelineCluster();
ResetImageMapCorrelationCaches();
int generation = ++_backendGeneration;
try
{
_filterRootPid = pid;
_captureProjection = new CaptureProjectionEngine(pid, $"ui-{pid}", "BlackbirdInterface");
_filterTrackedPids.Clear();
_filterTrackedPids.TryAdd((uint)pid, 0);
_targetExitReasonByPid.Remove((uint)pid);
_observedProcessStartUtcByPid[(uint)pid] = DateTime.UtcNow;
MonitoredProcesses.Clear();
_monitoredProcessSet.Clear();
_focusedPid = 0;
BroadcastFocusedPid(0);
TryRegisterMonitoredProcess((uint)pid);
if (_currentSession != null)
{
_currentSession.UseUsermodeHooks = useUsermodeHooks;
_currentSession.KernelHooksEnabled = _kernelHooksArmed;
_currentSession.SignatureIntelEnabled = _signatureIntelEnabled;
_currentSession.SignatureIntelMemoryScanEnabled = _signatureIntelMemoryScanEnabled;
_currentSession.SignatureIntelPageScanEnabled = _signatureIntelPageScanEnabled;
}
RefreshSubsystemSegmentationDiagnostics();
QueueSignatureIntelForRootPid(pid);
var session =
preparedSession ?? BlackbirdBackendSession.Start(pid, BlackbirdNative.StreamAll, useUsermodeHooks);
_backendSession = session;
_sessionIoctlHandler = record =>
{
if (generation != _backendGeneration)
return;
if (!ShouldTrackRawIoctlRecord(record))
{
return;
}
long pending = Interlocked.Read(ref _pendingIoctlCount);
if (!ShouldAdmitIoctlRecord(record, pending))
{
Interlocked.Increment(ref _droppedIoctlForPressure);
return;
}
_pendingIoctlEvents.Enqueue(record);
Interlocked.Increment(ref _pendingIoctlCount);
_backendTransformSignal.Set();
};
_sessionEtwHandler = etw =>
{
if (generation != _backendGeneration)
return;
if (!ShouldTrackRawEtwEvent(etw))
{
return;
}
long pending = Interlocked.Read(ref _pendingEtwCount);
if (!ShouldAdmitEtwEvent(etw, pending))
{
Interlocked.Increment(ref _droppedEtwForPressure);
return;
}
_pendingEtwEvents.Enqueue(etw);
Interlocked.Increment(ref _pendingEtwCount);
_backendTransformSignal.Set();
};
_sessionStatsHandler = stats =>
{
if (Dispatcher.HasShutdownStarted)
return;
Dispatcher.BeginInvoke(new Action(
() =>
{
if (generation != _backendGeneration)
return;
DiagnosticsState.SetValue(
"Session Stats",
$"subs={stats.SubscriptionCount} depth={stats.QueueDepth} dropped={stats.DroppedEvents}");
}));
};
_sessionStatusHandler = text =>
{
if (generation != _backendGeneration)
return;
_captureProjection?.ObserveStatus(text);
_pendingStatusLines.Enqueue($"[session pid={pid}] {text}");
Interlocked.Increment(ref _pendingStatusCount);
_backendTransformSignal.Set();
};
session.IoctlEvent += _sessionIoctlHandler;
session.EtwEvent += _sessionEtwHandler;
session.Stats += _sessionStatsHandler;
session.Status += _sessionStatusHandler;
StartBackendTransformLoop(generation);
StatusBlock.Text = $"Status: Session active for PID {pid}";
OutputCapture.AppendLine($"Session started for PID {pid}");
DiagnosticsState.SetValue("Session", $"Active PID {pid}");
ProcessRelationsPaneHost.SetRootPid(pid);
}
catch (Exception ex)
{
if (preparedSession != null)
{
try
{
preparedSession.Dispose();
}
catch
{
}
}
string displayError = FormatSessionStartError(ex);
_backendSession = null;
StatusBlock.Text = $"Status: Session start failed ({displayError})";
OutputCapture.AppendLine($"Session start failed for PID {pid}: {displayError}");
DiagnosticsState.SetValue("Session", $"Start failed PID {pid}");
DiagnosticsState.SetValue("Connectivity", $"Session start failed: {displayError}");
SetBackendConnectivity(false);
}
}
private static string FormatSessionStartError(Exception ex)
{
if (ex is EntryPointNotFoundException)
{
return "IPC runtime DLL is outdated (missing export). Rebuild/deploy J58.dll and controller.";
}
if (ex is System.ComponentModel.Win32Exception wx &&
(wx.NativeErrorCode == 127 || wx.NativeErrorCode == BlackbirdNative.ErrorInvalidFunction))
{
return "IPC runtime DLL/controller mismatch (missing function). Rebuild/deploy latest J58.dll and controller.";
}
if (ex is System.ComponentModel.Win32Exception brokerWx &&
(brokerWx.NativeErrorCode == 109 || brokerWx.NativeErrorCode == 233))
{
return "Broker handshake failed because the loaded J58.dll does not match the running BlackbirdController build. Rebuild/redeploy both together.";
}
return ex.Message;
}
private void DetachSessionHandlers(BlackbirdBackendSession session)
{
if (_sessionIoctlHandler != null)
{
session.IoctlEvent -= _sessionIoctlHandler;
_sessionIoctlHandler = null;
}
if (_sessionEtwHandler != null)
{
session.EtwEvent -= _sessionEtwHandler;
_sessionEtwHandler = null;
}
if (_sessionStatsHandler != null)
{
session.Stats -= _sessionStatsHandler;
_sessionStatsHandler = null;
}
if (_sessionStatusHandler != null)
{
session.Status -= _sessionStatusHandler;
_sessionStatusHandler = null;
}
}
private void StopBackendSession(bool preserveApiGraphSnapshot = false, bool fastTeardown = false)
{
_liveAnalysisSession = null;
if (_backendSession == null)
{
StopBackendTransformLoop();
DisposeLiveCaptureStore();
ClearPendingBackendUiQueues();
return;
}
try
{
DetachSessionHandlers(_backendSession);
_backendSession.Dispose();
}
catch
{
}
_backendSession = null;
_captureProjection?.WaitForPendingStackCaptures(
fastTeardown ? TimeSpan.FromMilliseconds(50) : TimeSpan.FromSeconds(1));
_captureProjection = null;
_filterRootPid = 0;
_filterTrackedPids.Clear();
_pendingMonitoredProcessRegistrations.Clear();
StopBackendTransformLoop();
DisposeLiveCaptureStore();
ClearPendingBackendUiQueues();
_lastEtwTimelineSignature = null;
_lastEtwTimelineTimestampUtc = DateTime.MinValue;
Interlocked.Exchange(ref _droppedIoctlForPressure, 0);
Interlocked.Exchange(ref _droppedEtwForPressure, 0);
Interlocked.Exchange(ref _droppedUiWorkForPressure, 0);
ResetFilesystemTimelineCluster();
ResetImageMapCorrelationCaches();
if (!preserveApiGraphSnapshot)
{
_apiGraphRowsByKey.Clear();
_extendedRowsByKey.Clear();
_extendedViewRows.Clear();
_extendedComRows.Clear();
_extendedEtwRows.Clear();
_extendedJobRows.Clear();
_extendedYaraRows.Clear();
_apiGraphReasonByKey.Clear();
_apiGraphActionByKey.Clear();
_apiGraphDecodedByKey.Clear();
_apiGraphFramesByKey.Clear();
_apiGraphSensorByKey.Clear();
_apiGraphTimelineLastEmitByKey.Clear();
_observedHookStackLastPersistByThread.Clear();
_threadStackFallbackLastCaptureByThread.Clear();
_pendingThreadStackFallbackCaptures.Clear();
_apiMemorySignalsByPage.Clear();
_crossProcWriteCountByPair.Clear();
_crossProcRwxAllocCountByPair.Clear();
_antiAnalysisCountByEvidence.Clear();
ResetImageMapCorrelationCaches();
_observedProcessStartUtcByPid.Clear();
_targetExitReasonByPid.Clear();
_extendedViewSnapshotDirty = false;
_extendedViewRefreshTimer.Stop();
if (ExtendedViewSummaryBlock != null)
{
ExtendedViewSummaryBlock.Text = "No extended activity yet";
}
_observedProcessStartKeyByPid.Clear();
_observedInitialThreadIdByPid.Clear();
_regionLifecycleByIdentity.Clear();
_functionTableBaseByPointer.Clear();
PublishApiGraphSnapshot();
}
DiagnosticsState.SetValue("Session", "Stopped");
DiagnosticsState.SetValue("Kernel Hooks", "Inactive");
DiagnosticsState.SetValue("Usermode Hooks", "Inactive");
DiagnosticsState.SetValue("Operator Connection Established", "Disabled in analyst interface");
DiagnosticsState.SetValue("Hook Integrity", "Unknown");
DiagnosticsState.SetValue("AMSI Integrity", "Unknown");
DiagnosticsState.SetValue("ETW Integrity", "Unknown");
DiagnosticsState.SetValue("Signature Intel", "Inactive");
}
private void ScheduleApiGraphSnapshot()
{
_apiGraphSnapshotDirty = true;
}
private void ApiGraphRefreshTimer_Tick(object? sender, EventArgs e)
{
if (!_apiGraphSnapshotDirty)
{
return;
}
_apiGraphSnapshotDirty = false;
PublishApiGraphSnapshot();
}
private void StartBackendTransformLoop(int generation)
{
StopBackendTransformLoop();
var cts = new CancellationTokenSource();
_backendTransformCts = cts;
_backendTransformTask = Task.Run(() => BackendTransformLoop(generation, cts.Token));
}
private void StopBackendTransformLoop()
{
CancellationTokenSource? cts = _backendTransformCts;
Task? task = _backendTransformTask;
_backendTransformCts = null;
_backendTransformTask = null;
if (cts == null)
{
return;
}
try
{
cts.Cancel();
_backendTransformSignal.Set();
task?.Wait(300);
}
catch
{
}
finally
{
cts.Dispose();
}
}
private void BackendTransformLoop(int generation, CancellationToken ct)
{
while (!ct.IsCancellationRequested && generation == _backendGeneration)
{
bool producedUiWork = false;
int transformed = 0;
int etwBudget =
Math.Min(MaxBackendTransformItemsPerBatch / 2, Math.Max(128, MaxBackendTransformItemsPerBatch));
while (transformed < etwBudget && _pendingEtwEvents.TryDequeue(out var etw))
{
Interlocked.Decrement(ref _pendingEtwCount);
BrokerEtwEventView view = BrokerEtwEventMapper.FromNative(etw);
_captureProjection?.ObserveEtw(view);
ProcessIdentityResolver.Prime(view.ActorPid);
ProcessIdentityResolver.Prime(view.TargetPid);
if (view.Family == BlackbirdNative.IpcEtwFamilyProcess &&
(view.Flags & BlackbirdNative.IpcEtwFlagProcessIsCreate) != 0)
{
uint etwCreator = view.CreatorPid != 0 ? view.CreatorPid : view.ActorPid;
uint etwChild = view.ProcessPid != 0 ? view.ProcessPid : view.TargetPid;
if (etwCreator != 0 && etwChild != 0 && etwCreator != etwChild &&
_filterTrackedPids.ContainsKey(etwCreator))
{
_filterTrackedPids.TryAdd(etwChild, 0);
QueueMonitoredProcessRegistration(generation, etwChild);
}
}
if (view.ActorPid != 0 && _filterTrackedPids.ContainsKey(view.ActorPid))
{
QueueMonitoredProcessRegistration(generation, view.ActorPid);
}
producedUiWork |= TryEnqueueUiWork(BackendUiWorkItem.FromEtw(view));
transformed += 1;
}
while (transformed < MaxBackendTransformItemsPerBatch && _pendingIoctlEvents.TryDequeue(out var ioctl))
{
Interlocked.Decrement(ref _pendingIoctlCount);
DateTime nowUtc = DateTime.UtcNow;
_captureProjection?.ObserveIoctl(ioctl, nowUtc);
bool acceptFilesystem = ShouldAcceptFilesystemRecord(ioctl);
if (acceptFilesystem)
{
RememberRecentImageFileAccess(ioctl, nowUtc);
}
IReadOnlyList<TelemetryEvent> filesystemClusterEvents =
acceptFilesystem ? AccumulateFilesystemTimelineCluster(ioctl, nowUtc)
: Array.Empty<TelemetryEvent>();
if (filesystemClusterEvents.Count > 0)
{
for (int i = 0; i < filesystemClusterEvents.Count; i += 1)
{
if (TryEnqueueUiWork(
BackendUiWorkItem.FromIoctl(filesystemClusterEvents[i], null, null, null, null)))
{
producedUiWork = true;
}
else
{
break;
}
}
}
if (ioctl.Type == BlackbirdNative.EventTypeThread && ioctl.ProcessPid != 0 &&
ioctl.CreatorPid != 0 && ioctl.ProcessPid != ioctl.CreatorPid &&
_filterTrackedPids.ContainsKey(ioctl.CreatorPid))
{
_filterTrackedPids.TryAdd(ioctl.ProcessPid, 0);
}
TelemetryEvent? telemetry = MapIoctlRecord(ioctl);
ProcessRelationView? relation = MapIoctlRelation(ioctl);
HeuristicEventView? heuristic = MapIoctlHeuristic(ioctl);
IReadOnlyList<HeuristicEventView> signatureIntelIoctlFindings =
ShouldEvaluateSignatureIntelForIoctl(ioctl, acceptFilesystem)
? EvaluateSignatureIntelForIoctl(ioctl)
: Array.Empty<HeuristicEventView>();
ThreadLifecycleEventSample? threadLifecycle = MapIoctlThreadLifecycle(ioctl);
IoctlParsedEvent? filesystem = acceptFilesystem ? MapIoctlFilesystem(ioctl) : null;
IoctlParsedEvent? registry = MapIoctlRegistry(ioctl);
if (relation != null)
{
ProcessIdentityResolver.Prime(relation.SourcePid);
ProcessIdentityResolver.Prime(relation.TargetPid);
}
if (heuristic != null)
{
ProcessIdentityResolver.Prime(heuristic.ActorPid);
ProcessIdentityResolver.Prime(heuristic.TargetPid);
}
if (signatureIntelIoctlFindings.Count > 0)
{
for (int i = 0; i < signatureIntelIoctlFindings.Count; i += 1)
{
ProcessIdentityResolver.Prime(signatureIntelIoctlFindings[i].ActorPid);
ProcessIdentityResolver.Prime(signatureIntelIoctlFindings[i].TargetPid);
}
}
if (filesystem != null)
{
ProcessIdentityResolver.Prime(filesystem.FileProcessPid);
}
if (registry != null)
{
ProcessIdentityResolver.Prime(registry.RegistryProcessPid);
}
if (ioctl.Type == BlackbirdNative.EventTypeEnterprise)
{
ProcessIdentityResolver.Prime(ioctl.EnterpriseProcessPid);
ProcessIdentityResolver.Prime(ioctl.EnterpriseTargetProcessPid);
}
if (acceptFilesystem &&
(ShouldPersistIoctlRecord(ioctl, telemetry, relation, heuristic, filesystem) ||
signatureIntelIoctlFindings.Count > 0))
{
AppendIoctlToCaptureStore(nowUtc, ioctl);
}
if (telemetry != null || relation != null || heuristic != null || threadLifecycle != null ||
filesystem != null || registry != null)
{
producedUiWork |= TryEnqueueUiWork(BackendUiWorkItem.FromIoctl(
telemetry, relation, heuristic, threadLifecycle, filesystem, registry));
}
if (signatureIntelIoctlFindings.Count > 0)
{
for (int i = 0; i < signatureIntelIoctlFindings.Count; i += 1)
{
producedUiWork |= TryEnqueueUiWork(
BackendUiWorkItem.FromIoctl(null, null, signatureIntelIoctlFindings[i], null, null));
}
}
transformed += 1;
}
int statusLines = 0;
while (statusLines < MaxBackendStatusLinesPerTransformBatch &&
_pendingStatusLines.TryDequeue(out var statusLine))
{
Interlocked.Decrement(ref _pendingStatusCount);
producedUiWork |= TryEnqueueUiWork(BackendUiWorkItem.FromStatus(statusLine));
statusLines += 1;
}
IReadOnlyList<TelemetryEvent> idleFilesystemClusters =
FlushFilesystemTimelineClusterIfNeeded(DateTime.UtcNow, force: false);
if (idleFilesystemClusters.Count > 0)
{
for (int i = 0; i < idleFilesystemClusters.Count; i += 1)
{
if (TryEnqueueUiWork(
BackendUiWorkItem.FromIoctl(idleFilesystemClusters[i], null, null, null, null)))
{
producedUiWork = true;
}
else
{
break;
}
}
}
if (producedUiWork)
{
ScheduleBackendUiFlush(generation);
continue;
}
_backendTransformSignal.WaitOne(120);
}
}
private void ScheduleBackendUiFlush(int generation)
{
if (Interlocked.Exchange(ref _backendUiFlushScheduled, 1) != 0)
{
return;
}
Dispatcher.BeginInvoke(new Action(() => FlushBackendUi(generation)), DispatcherPriority.Background);
}
private void FlushBackendUi(int generation)
{
Interlocked.Exchange(ref _backendUiFlushScheduled, 0);
if (generation != _backendGeneration)
{
ClearPendingBackendUiQueues();
return;
}
var stopwatch = Stopwatch.StartNew();
int processed = 0;
bool underPressure = Interlocked.Read(ref _pendingUiWorkCount) > (MaxPendingUiWorkItems / 2) ||
Interlocked.Read(ref _pendingIoctlCount) > (MaxPendingIoctlEvents / 2) ||
Interlocked.Read(ref _pendingEtwCount) > (MaxPendingEtwEvents / 2);
int maxItemsThisFlush = underPressure ? MaxBackendUiItemsPerFlushUnderPressure : MaxBackendUiItemsPerFlush;
TimeSpan budget = underPressure ? BackendUiFlushBudgetUnderPressure : BackendUiFlushBudget;
var telemetryBatch = new List<TelemetryEvent>(96);
var relationBatch = new List<ProcessRelationView>(32);
var heuristicBatch = new List<HeuristicEventView>(32);
var threadLifecycleBatch = new List<ThreadLifecycleEventSample>(32);
var filesystemBatch = new List<IoctlParsedEvent>(32);
var registryBatch = new List<IoctlParsedEvent>(32);
var etwBatch = new List<BrokerEtwEventView>(96);
var statusBatch = new List<string>(32);
while (processed < maxItemsThisFlush && stopwatch.Elapsed < budget &&
_pendingUiWork.TryDequeue(out var uiWork))
{
Interlocked.Decrement(ref _pendingUiWorkCount);
if (uiWork.Kind == BackendUiWorkKind.Status)
{
if (statusBatch.Count < MaxBackendStatusLinesPerUiFlush &&
!string.IsNullOrWhiteSpace(uiWork.StatusLine))
{
statusBatch.Add(uiWork.StatusLine);
}
}
else if (uiWork.Kind == BackendUiWorkKind.Ioctl)
{
if (uiWork.Telemetry != null)
{
telemetryBatch.Add(uiWork.Telemetry);
}
if (uiWork.Relation != null)
{
relationBatch.Add(uiWork.Relation);
}
if (uiWork.Heuristic != null)
{
heuristicBatch.Add(uiWork.Heuristic);
}
if (uiWork.ThreadLifecycle != null)
{
threadLifecycleBatch.Add(uiWork.ThreadLifecycle);
}
if (uiWork.Filesystem != null)
{
filesystemBatch.Add(uiWork.Filesystem);
}
if (uiWork.Registry != null)
{
registryBatch.Add(uiWork.Registry);
}
}
else if (uiWork.Kind == BackendUiWorkKind.Etw && uiWork.EtwView != null)
{
etwBatch.Add(uiWork.EtwView);
}
processed += 1;
}
for (int i = 0; i < statusBatch.Count; i += 1)
{
OutputCapture.AppendLine(statusBatch[i]);
}
if (telemetryBatch.Count > 0)
{
AppendEvents(telemetryBatch);
}
if (relationBatch.Count > 0)
{
ProcessRelationsPaneHost.PushRelations(relationBatch);
_explorer.FirstOrDefault(x => x.Name == "Process Relations")
?.PushPreviewValue(ProcessRelationsPaneHost.TotalRawCount);
SetExplorerHasData("Process Relations", ProcessRelationsPaneHost.ItemCount > 0);
}
if (heuristicBatch.Count > 0)
{
HeuristicsPaneHost.PushHeuristics(heuristicBatch);
bool extendedChanged = false;
for (int i = 0; i < heuristicBatch.Count; i += 1)
{
extendedChanged |= ObserveSignatureIntelActivity(heuristicBatch[i]);
}
if (extendedChanged)
{
ScheduleExtendedActivitySnapshot();
}
_explorer.FirstOrDefault(x => x.Name == "Heuristics")
?.PushPreviewValue(HeuristicsPaneHost.TotalRawCount);
SetExplorerHasData("Heuristics", HeuristicsPaneHost.ItemCount > 0);
DiagnosticsState.Increment("Heuristics", heuristicBatch.Count);
}
if (threadLifecycleBatch.Count > 0)
{
PerformancePaneHost.PushThreadLifecycles(threadLifecycleBatch);
if (_currentSession != null)
{
for (int i = 0; i < threadLifecycleBatch.Count; i += 1)
{
_currentSession.ThreadLifecycleHistory.Add(CloneThreadLifecycleEvent(threadLifecycleBatch[i]));
}
if (_currentSession.ThreadLifecycleHistory.Count > 12_000)
{
_currentSession.ThreadLifecycleHistory.RemoveRange(
0, _currentSession.ThreadLifecycleHistory.Count - 12_000);
}
}
}
if (filesystemBatch.Count > 0)
{
FilesystemPaneHost.PushFileEvents(filesystemBatch);
_explorer.FirstOrDefault(x => x.Name == "Filesystem")
?.PushPreviewValue(FilesystemPaneHost.TotalRawCount);
SetExplorerHasData("Filesystem", FilesystemPaneHost.ItemCount > 0);
}
if (registryBatch.Count > 0)
{
RegistryPaneHost.PushRegistryEvents(registryBatch);
_explorer.FirstOrDefault(x => x.Name == "Registry")?.PushPreviewValue(RegistryPaneHost.TotalRawCount);
SetExplorerHasData("Registry", RegistryPaneHost.ItemCount > 0);
}
SpillCurrentSessionWorkingSetIfNeeded();
if (etwBatch.Count > 0)
{
HandleBrokerEtwViews(etwBatch);
}
DiagnosticsState.SetValue(
"UI Flush",
$"items={processed} ms={stopwatch.Elapsed.TotalMilliseconds:0.0} pending={Interlocked.Read(ref _pendingUiWorkCount)}");
if (HasPendingBackendUiData())
{
ScheduleBackendUiFlush(generation);
}
}
private bool HasPendingBackendUiData()
{
return Interlocked.Read(ref _pendingIoctlCount) > 0 || Interlocked.Read(ref _pendingEtwCount) > 0 ||
Interlocked.Read(ref _pendingStatusCount) > 0 || Interlocked.Read(ref _pendingUiWorkCount) > 0;
}
private void ClearPendingBackendUiQueues()
{
while (_pendingIoctlEvents.TryDequeue(out _))
{
}
while (_pendingEtwEvents.TryDequeue(out _))
{
}
while (_pendingStatusLines.TryDequeue(out _))
{
}
while (_pendingUiWork.TryDequeue(out _))
{
}
Interlocked.Exchange(ref _pendingIoctlCount, 0);
Interlocked.Exchange(ref _pendingEtwCount, 0);
Interlocked.Exchange(ref _pendingStatusCount, 0);
Interlocked.Exchange(ref _pendingUiWorkCount, 0);
Interlocked.Exchange(ref _backendUiFlushScheduled, 0);
ResetFilesystemTimelineCluster();
}
private bool TryEnqueueUiWork(BackendUiWorkItem item)
{
if (Interlocked.Read(ref _pendingUiWorkCount) >= MaxPendingUiWorkItems)
{
Interlocked.Increment(ref _droppedUiWorkForPressure);
return false;
}
_pendingUiWork.Enqueue(item);
Interlocked.Increment(ref _pendingUiWorkCount);
return true;
}
private void QueueMonitoredProcessRegistration(int generation, uint pid)
{
if (pid == 0 || !_pendingMonitoredProcessRegistrations.TryAdd(pid, 0) || Dispatcher.HasShutdownStarted)
{
return;
}
Dispatcher.BeginInvoke(new Action(() =>
{
_pendingMonitoredProcessRegistrations.TryRemove(pid, out _);
if (generation == _backendGeneration)
{
TryRegisterMonitoredProcess(pid);
}
}),
DispatcherPriority.Background);
}
private void AppendIoctlToCaptureStore(DateTime timestampUtc, IoctlParsedEvent record)
{
BlackbirdCaptureLiveStore? store = _liveCaptureStore;
if (store == null)
{
return;
}
try
{
store.AppendIoctl(timestampUtc, record);
}
catch (Exception ex)
{
DiagnosticsState.SetValue("Capture Store", $"IOCTL append failed: {ex.Message}");
}
}
private void AppendEtwToCaptureStore(BrokerEtwEventView view)
{
BlackbirdCaptureLiveStore? store = _liveCaptureStore;
if (store == null)
{
return;
}
try
{
store.AppendEtw(view);
}
catch (Exception ex)
{
DiagnosticsState.SetValue("Capture Store", $"ETW append failed: {ex.Message}");
}
}
private static ulong BuildRelationKey(uint actorPid, uint targetPid) => ((ulong)actorPid << 32) | targetPid;
private void RememberHandleEvidence(IoctlParsedEvent record)
{
if (record.Type != BlackbirdNative.EventTypeHandle || record.CallerPid == 0 || record.TargetPid == 0)
{
return;
}
uint highSignalMask = 0x00000800 | 0x00002000;
bool highRiskAccess = (record.DesiredAccess & (0x0002u | 0x0008u | 0x0010u | 0x0020u | 0x0800u)) != 0;
if (!highRiskAccess)
{
bool processAll = (record.DesiredAccess & 0x001F0FFFu) == 0x001F0FFFu;
bool threadAll = (record.DesiredAccess & 0x001F03FFu) == 0x001F03FFu;
highRiskAccess = processAll || threadAll;
}
bool suspicious = record.HandleClass == 2 || ((record.HandleFlags & highSignalMask) != 0);
if (!highRiskAccess && !suspicious)
{
return;
}
_recentHandleEvidenceByPair[BuildRelationKey(record.CallerPid, record.TargetPid)] = record;
_recentHandleEvidenceByPair[BuildRelationKey(record.TargetPid, record.CallerPid)] = record;
DateTime now = DateTime.UtcNow;
if ((now - _lastHandleEvidencePruneUtc).TotalSeconds < 20)
{
return;
}
_lastHandleEvidencePruneUtc = now;
if (_recentHandleEvidenceByPair.Count > 4096)
{
_recentHandleEvidenceByPair.Clear();
}
}
private bool TryGetHandleEvidence(uint actorPid, uint targetPid, out IoctlParsedEvent evidence)
{
if (_recentHandleEvidenceByPair.TryGetValue(BuildRelationKey(actorPid, targetPid), out IoctlParsedEvent? found))
{
evidence = found;
return true;
}
evidence = new IoctlParsedEvent();
return false;
}
private static bool IsBlackbirdOwnEvent(BrokerEtwEventView view) =>
(view.DetectionTraits & BlackbirdNative.IpcEtwTraitBlackbirdOwn) != 0 ||
view.DetectionName.Equals("BK_INSTRUMENTATION", StringComparison.OrdinalIgnoreCase);
private static bool ShouldKeepEtwEvent(BrokerEtwEventView view)
{
/* Always surface BK-instrumentation events — but they are
annotated and displayed distinctly so analysts aren't confused. */
if (IsBlackbirdOwnEvent(view))
return true;
if (view.Family == BlackbirdNative.IpcEtwFamilyUserHook)
{
return true;
}
if (view.Family == BlackbirdNative.IpcEtwFamilySocket ||
EventDetailFormatting.IsKernelNetworkEtwSource(view))
{
return true;
}
if (IsDirectSyscallDetection(view))
{
return true;
}
if (!string.IsNullOrWhiteSpace(view.DetectionName))
{
return true;
}
if (view.Severity >= 4)
{
return true;
}
if (EventDetailFormatting.IsThreatIntelEtwSource(view))
{
return view.Task == 1 || view.Task == 2 || view.Task == 7;
}
if (view.EventName.Equals("ThreadTelemetry", StringComparison.OrdinalIgnoreCase) ||
view.EventName.Equals("ApcTelemetry", StringComparison.OrdinalIgnoreCase))
{
return true;
}
return false;
}
private static bool ShouldPromoteHeuristic(BrokerEtwEventView view)
{
if (IsDirectSyscallDetection(view))
{
return view.Severity >= 2 || IsDirectSyscallHandleTelemetry(view);
}
if (string.IsNullOrWhiteSpace(view.DetectionName))
{
return false;
}
string det = view.DetectionName;
if (IsHookTamperDetection(view))
{
return true;
}
if (det.Contains("AMSI_PATCH_TAMPERED", StringComparison.OrdinalIgnoreCase) ||
det.Contains("ETW_PATCH_TAMPERED", StringComparison.OrdinalIgnoreCase))
{
return true;
}
if (det.Equals("USERMODE_COM_INIT", StringComparison.OrdinalIgnoreCase) ||
det.Equals("USERMODE_COM_SECURITY_INIT", StringComparison.OrdinalIgnoreCase) ||
det.Equals("USERMODE_COM_INSTANCE_CREATE", StringComparison.OrdinalIgnoreCase) ||
det.Equals("USERMODE_WMI_ACTIVITY", StringComparison.OrdinalIgnoreCase) ||
det.Equals("USERMODE_ETW_SESSION_CONTROL", StringComparison.OrdinalIgnoreCase) ||
det.Equals("USERMODE_ETW_SUBSCRIPTION", StringComparison.OrdinalIgnoreCase) ||
det.Equals("USERMODE_ETW_PROVIDER_REGISTER", StringComparison.OrdinalIgnoreCase) ||
det.Equals("USERMODE_ETW_PROVIDER_UNREGISTER", StringComparison.OrdinalIgnoreCase))
{
return true;
}
if (det.Contains("ANTI_DEBUG", StringComparison.OrdinalIgnoreCase) ||
det.Contains("ANTI_VM", StringComparison.OrdinalIgnoreCase) ||
det.Contains("ANTI_VIRTUAL", StringComparison.OrdinalIgnoreCase))
{
return view.Severity >= 4;
}
if (det.Contains("HOLLOW", StringComparison.OrdinalIgnoreCase) ||
det.Contains("INJECTION", StringComparison.OrdinalIgnoreCase) ||
det.Contains("THREAD_HIJACK", StringComparison.OrdinalIgnoreCase) ||
det.Contains("REMOTE_APC", StringComparison.OrdinalIgnoreCase))
{
return view.Severity >= 5;
}
if (det.Contains("REMOTE_THREAD_WITH_RECENT_HANDLE_INTENT", StringComparison.OrdinalIgnoreCase) ||
det.Contains("THREAD_ACTIVITY_WITH_THREAD_CONTEXT_INTENT", StringComparison.OrdinalIgnoreCase) ||
det.Contains("REMOTE_THREAD_OUTSIDE_MAIN_IMAGE", StringComparison.OrdinalIgnoreCase))
{
return false;
}
return view.Severity >= 6;
}
private HeuristicEventView? EvaluateCrossProcessMemoryHeuristic(BrokerEtwEventView view)
{
string apiName = !string.IsNullOrWhiteSpace(view.EventName)
? view.EventName
: (!string.IsNullOrWhiteSpace(view.Operation) ? view.Operation : string.Empty);
if (string.IsNullOrEmpty(apiName))
{
return null;
}
uint actor = view.ActorPid != 0 ? view.ActorPid : view.ProcessPid;
uint target = view.TargetPid != 0 ? view.TargetPid : actor;
if (actor == 0 || actor == target)
{
return null;
}
string pairKey = $"{actor}|{target}";
if (apiName.Equals("NtWriteVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
_crossProcWriteCountByPair.TryGetValue(pairKey, out int count);
count += 1;
_crossProcWriteCountByPair[pairKey] = count;
if (count != 5 && count != 25 && count != 100)
{
return null;
}
uint severity = count >= 100 ? 8u : count >= 25 ? 7u : 6u;
return new HeuristicEventView {
TimestampUtc = view.TimestampUtc,
LastSeenUtc = view.TimestampUtc,
Severity = severity,
DetectionName = "CROSS_PROCESS_WRITE_PATTERN",
ActorPid = actor,
TargetPid = target,
Source = "BK/MemoryPattern",
EventName = "NtWriteVirtualMemory",
Reason = $"reason=cross-process write accumulation; count={count}; actor={actor}; target={target}",
Evidence = $"NtWriteVirtualMemory observed {count}x from pid {actor} into pid {target}",
RepeatCount = 1
};
}
if (apiName.Equals("NtAllocateVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
Dictionary<string, string> fields = ParseReasonFields(view.Reason ?? string.Empty);
uint protect = (uint)FirstU64(fields, "protect", "c3", "a5");
bool isRwx = protect != 0 && (protect & 0x40u) != 0;
if (!isRwx)
{
return null;
}
_crossProcRwxAllocCountByPair.TryGetValue(pairKey, out int count);
count += 1;
_crossProcRwxAllocCountByPair[pairKey] = count;
if (count != 3 && count != 12 && count != 48)
{
return null;
}
uint severity = count >= 48 ? 9u : count >= 12 ? 8u : 7u;
return new HeuristicEventView {
TimestampUtc = view.TimestampUtc,
LastSeenUtc = view.TimestampUtc,
Severity = severity,
DetectionName = "CROSS_PROCESS_RWX_ALLOC_PATTERN",
ActorPid = actor,
TargetPid = target,
Source = "BK/MemoryPattern",
EventName = "NtAllocateVirtualMemory",
Reason =
$"reason=repeated cross-process RWX allocation; count={count}; actor={actor}; target={target}",
Evidence =
$"NtAllocateVirtualMemory(PAGE_EXECUTE_READWRITE) observed {count}x from pid {actor} into pid {target}",
RepeatCount = 1
};
}
return null;
}
private HeuristicEventView? EvaluateMemoryLifecycleHeuristic(MemoryRegionAttributionSample sample)
{
if (sample.BlackbirdOwned || sample.TargetPid == 0)
{
return null;
}
bool protectEvent = sample.ProtectFlipCount != 0 &&
sample.EventKind.Equals("ProtectChange", StringComparison.OrdinalIgnoreCase);
bool guardNoAccessSignal = sample.GuardNoAccessFlipCount != 0;
bool writableExecutableSignal = sample.WritableExecutableFlipCount != 0;
bool firstHighSignalProtect = sample.ProtectFlipCount == 1 &&
(guardNoAccessSignal || writableExecutableSignal || sample.CrossProcess);
bool repeatedProtect = protectEvent && (IsMemoryPatternMilestone(sample.ProtectFlipCount) ||
sample.RapidProtectFlipCount == 1 ||
IsMemoryPatternMilestone(sample.RapidProtectFlipCount));
if (protectEvent && (firstHighSignalProtect || repeatedProtect))
{
uint severity = ComputeMemoryLifecycleSeverity(sample, protectSignal: true, entropySignal: false);
string detectionName = guardNoAccessSignal ? "MEMORY_GUARD_NOACCESS_PROTECTION_FLIP"
: writableExecutableSignal ? "MEMORY_WRITABLE_EXECUTABLE_PROTECTION_FLIP"
: "MEMORY_PROTECTION_FLIP_PATTERN";
string transition =
string.IsNullOrWhiteSpace(sample.ProtectionTransition) ? "unknown" : sample.ProtectionTransition;
string entropyText =
sample.EntropyBits >= 0 ? sample.EntropyBits.ToString("F2", CultureInfo.InvariantCulture) : "n/a";
string maxEntropyText = sample.MaxEntropyBits >= 0
? sample.MaxEntropyBits.ToString("F2", CultureInfo.InvariantCulture)
: "n/a";
return new HeuristicEventView {
TimestampUtc = sample.TimestampUtc == default ? DateTime.UtcNow : sample.TimestampUtc,
LastSeenUtc = sample.TimestampUtc == default ? DateTime.UtcNow : sample.TimestampUtc,
Severity = severity,
DetectionName = detectionName,
ActorPid = sample.ActorPid != 0 ? sample.ActorPid : sample.TargetPid,
TargetPid = sample.TargetPid,
Source = "BK/MemoryLifecycle",
EventName = string.IsNullOrWhiteSpace(sample.ApiName) ? sample.EventKind : sample.ApiName,
Reason =
$"reason=memory protection flip pattern; region=0x{sample.BaseAddress:X}; size=0x{sample.RegionSize:X}; " +
$"transition={transition}; flips={sample.ProtectFlipCount}; rapid={sample.RapidProtectFlipCount}; " +
$"execFlips={sample.ExecutableFlipCount}; guardNoAccessFlips={sample.GuardNoAccessFlipCount}; " +
$"wxFlips={sample.WritableExecutableFlipCount}; writes={sample.WriteCount}; entropy={entropyText}; maxEntropy={maxEntropyText}",
Evidence =
$"Region 0x{sample.BaseAddress:X} changed protection {transition}; " +
$"protection flips={sample.ProtectFlipCount}, rapid flips={sample.RapidProtectFlipCount}, " +
$"exec/guard/WX flips={sample.ExecutableFlipCount}/{sample.GuardNoAccessFlipCount}/{sample.WritableExecutableFlipCount}, " +
$"writes={sample.WriteCount}, entropy={entropyText} bits/byte"
};
}
bool entropyEvent = sample.EventKind.Equals("MemoryWrite", StringComparison.OrdinalIgnoreCase) &&
HasUsableEntropySample(sample);
bool highEntropy = entropyEvent && sample.EntropyBits >= MemoryHighEntropyBits;
bool repeatedEntropyShift = entropyEvent && (IsMemoryPatternMilestone(sample.EntropyFlipCount) ||
sample.RapidEntropyFlipCount == 1 ||
IsMemoryPatternMilestone(sample.RapidEntropyFlipCount));
bool highEntropyMilestone = highEntropy && IsHighEntropyWriteMilestone(sample.HighEntropyWriteCount);
if (entropyEvent && (highEntropyMilestone || repeatedEntropyShift))
{
uint severity = ComputeMemoryLifecycleSeverity(sample, protectSignal: false, entropySignal: true);
string entropyText = sample.EntropyBits.ToString("F2", CultureInfo.InvariantCulture);
string maxEntropyText = sample.MaxEntropyBits >= 0
? sample.MaxEntropyBits.ToString("F2", CultureInfo.InvariantCulture)
: entropyText;
string detectionName =
highEntropy ? "MEMORY_HIGH_ENTROPY_WRITE_PATTERN" : "MEMORY_ENTROPY_SHIFT_PATTERN";
return new HeuristicEventView {
TimestampUtc = sample.TimestampUtc == default ? DateTime.UtcNow : sample.TimestampUtc,
LastSeenUtc = sample.TimestampUtc == default ? DateTime.UtcNow : sample.TimestampUtc,
Severity = severity,
DetectionName = detectionName,
ActorPid = sample.ActorPid != 0 ? sample.ActorPid : sample.TargetPid,
TargetPid = sample.TargetPid,
Source = "BK/MemoryLifecycle",
EventName = string.IsNullOrWhiteSpace(sample.ApiName) ? sample.EventKind : sample.ApiName,
Reason =
$"reason=memory entropy pattern; region=0x{sample.BaseAddress:X}; size=0x{sample.RegionSize:X}; " +
$"entropy={entropyText}; maxEntropy={maxEntropyText}; entropyFlips={sample.EntropyFlipCount}; " +
$"rapidEntropyFlips={sample.RapidEntropyFlipCount}; highEntropyWrites={sample.HighEntropyWriteCount}; " +
$"sampleBytes={sample.SampleBytes}; protectFlips={sample.ProtectFlipCount}",
Evidence =
$"Region 0x{sample.BaseAddress:X} write sample entropy={entropyText} bits/byte " +
$"(max={maxEntropyText}, entropy flips={sample.EntropyFlipCount}, high entropy writes={sample.HighEntropyWriteCount}, " +
$"sample bytes={sample.SampleBytes})"
};
}
return null;
}
private HeuristicEventView? EvaluateAntiAnalysisHeuristic(BrokerEtwEventView view)
{
if (IsBlackbirdOwnEvent(view))
{
return null;
}
string apiName = !string.IsNullOrWhiteSpace(view.Operation)
? view.Operation
: (!string.IsNullOrWhiteSpace(view.EventName) ? view.EventName : string.Empty);
if (string.IsNullOrWhiteSpace(apiName))
{
return null;
}
Dictionary<string, string> fields = BuildHookFieldMap(view);
uint actor = view.ActorPid != 0 ? view.ActorPid : view.ProcessPid;
uint target = view.TargetPid != 0 ? view.TargetPid : actor;
if (actor == 0)
{
return null;
}
if (apiName.Equals("NtQueryInformationProcess", StringComparison.OrdinalIgnoreCase))
{
uint infoClass = (uint)FirstU64(fields, "processInformationClass", "ProcessInformationClass",
"infoClass", "class", "a1", "c1");
string className = infoClass switch {
7 => "ProcessDebugPort",
30 => "ProcessDebugObjectHandle",
31 => "ProcessDebugFlags",
_ => string.Empty
};
if (string.IsNullOrWhiteSpace(className))
{
return null;
}
string evidence = $"{apiName} {className} actor={actor} target={target}";
return BuildAntiAnalysisFinding(
view.TimestampUtc, actor, target, "ANTI_DEBUG_PROCESS_QUERY", 6, "UserHook/AntiAnalysis", apiName,
$"queried anti-debug process information class {className} (0x{infoClass:X})", evidence);
}
if (apiName.Equals("NtQuerySystemInformation", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("NtQuerySystemInformationEx", StringComparison.OrdinalIgnoreCase))
{
uint infoClass = (uint)FirstU64(fields, "systemInformationClass", "SystemInformationClass", "infoClass",
"class", "a0", "c0");
if (infoClass == 35)
{
string evidence = $"{apiName} SystemKernelDebuggerInformation actor={actor}";
return BuildAntiAnalysisFinding(
view.TimestampUtc, actor, target, "ANTI_DEBUG_KERNEL_DEBUGGER_QUERY", 6,
"UserHook/AntiAnalysis", apiName,
"queried kernel debugger state with SystemKernelDebuggerInformation", evidence);
}
if (infoClass == 76)
{
string evidence = $"{apiName} SystemFirmwareTableInformation actor={actor}";
return BuildAntiAnalysisFinding(
view.TimestampUtc, actor, target, "ANTI_VM_FIRMWARE_TABLE_QUERY", 5, "UserHook/AntiAnalysis",
apiName, "queried firmware tables commonly used for hypervisor/vendor checks", evidence);
}
}
return null;
}
private HeuristicEventView? EvaluateImageSectionMapHeuristic(BrokerEtwEventView view)
{
if (IsBlackbirdOwnEvent(view))
{
return null;
}
string apiName = !string.IsNullOrWhiteSpace(view.Operation)
? view.Operation
: (!string.IsNullOrWhiteSpace(view.EventName) ? view.EventName : string.Empty);
if (!IsImageSectionMapApi(apiName))
{
return null;
}
uint actor = view.ActorPid != 0 ? view.ActorPid
: view.ProcessPid != 0 ? view.ProcessPid
: view.EventProcessId;
if (actor == 0)
{
return null;
}
uint tid = view.EventThreadId != 0 ? view.EventThreadId : view.ThreadId;
DateTime observedUtc = view.TimestampUtc == default ? DateTime.UtcNow : view.TimestampUtc;
Dictionary<string, string> fields = BuildHookFieldMap(view);
string mappedPath = ExtractMappedImagePath(view, fields);
RecentImageFileAccess ? linkedAccess;
RecentImageMapState mapState;
lock (_imageMapCorrelationLock)
{
PruneImageMapCorrelationCachesLocked(observedUtc);
linkedAccess = FindRecentImageFileAccessLocked(actor, tid, mappedPath, observedUtc);
if (string.IsNullOrWhiteSpace(mappedPath) && linkedAccess != null)
{
mappedPath = linkedAccess.Path;
}
mappedPath = NormalizeCorrelationPath(mappedPath);
if (!IsImagePathForMapping(mappedPath))
{
return null;
}
mapState = RememberImageMapLocked(actor, mappedPath, apiName, observedUtc, linkedAccess);
}
string fileName = ModuleNameFromPath(mappedPath);
bool isNtdll = fileName.Equals("ntdll.dll", StringComparison.OrdinalIgnoreCase);
bool hasFilesystemLink = linkedAccess != null;
bool emitMilestone = mapState.Count == 2 || mapState.Count == 4 || mapState.Count == 8 ||
(mapState.Count > 0 && mapState.Count % 16 == 0);
if (!emitMilestone)
{
return null;
}
if (!isNtdll && !hasFilesystemLink && mapState.Count < 4)
{
return null;
}
uint severity = isNtdll ? 5u : hasFilesystemLink ? 4u : 3u;
string fileEvidence =
hasFilesystemLink
? $"linkedFs={DescribeFileOperation(linkedAccess!.Operation)} pid={linkedAccess.Pid} tid={linkedAccess.Tid} path={linkedAccess.Path}"
: "linkedFs=<none>";
string targetText = view.TargetPid == 0 || view.TargetPid == actor
? "self"
: view.TargetPid.ToString(CultureInfo.InvariantCulture);
string reason =
isNtdll
? "repeated mapping of ntdll.dll in one process; normal loader startup maps it once, so later repeat maps are worth review"
: "repeated image-backed section mapping correlated with recent filesystem image access";
return new HeuristicEventView {
TimestampUtc = observedUtc,
LastSeenUtc = observedUtc,
Severity = severity,
DetectionName = isNtdll ? "REPEATED_NTDLL_IMAGE_MAPPING" : "REPEATED_IMAGE_SECTION_MAPPING",
ActorPid = actor,
TargetPid = view.TargetPid == 0 ? actor : view.TargetPid,
Source = "BK/ImageMapCorrelation",
EventName = apiName,
Reason = $"reason={reason}; count={mapState.Count}; target={targetText}",
Evidence =
$"api={apiName} path={mappedPath} firstSeen={mapState.FirstSeenUtc:O} lastSeen={mapState.LastSeenUtc:O} {fileEvidence}",
RepeatCount = 1
};
}
private void RememberRecentImageFileAccess(IoctlParsedEvent record, DateTime observedUtc)
{
if (record.Type != BlackbirdNative.EventTypeFileSystem || record.FileProcessPid == 0 ||
(record.FileOperation != BlackbirdNative.FileOperationCreate &&
record.FileOperation != BlackbirdNative.FileOperationRead))
{
return;
}
string path = NormalizeCorrelationPath(record.FilePath);
if (!IsImagePathForMapping(path))
{
return;
}
var access = new RecentImageFileAccess { TimestampUtc = observedUtc,
Pid = record.FileProcessPid,
Tid = record.FileThreadId,
Operation = record.FileOperation,
Path = path,
FileName = ModuleNameFromPath(path) };
lock (_imageMapCorrelationLock)
{
PruneImageMapCorrelationCachesLocked(observedUtc);
_recentImageFileAccesses.Add(access);
if (_recentImageFileAccesses.Count > MaxRecentImageFileAccesses)
{
_recentImageFileAccesses.RemoveRange(0,
_recentImageFileAccesses.Count - MaxRecentImageFileAccesses);
}
}
}
private void ResetImageMapCorrelationCaches()
{
lock (_imageMapCorrelationLock)
{
_recentImageFileAccesses.Clear();
_recentImageMapByPidPath.Clear();
_lastImageMapCorrelationPruneUtc = DateTime.MinValue;
}
}
private void PruneImageMapCorrelationCachesLocked(DateTime nowUtc)
{
if (_lastImageMapCorrelationPruneUtc != DateTime.MinValue &&
nowUtc < _lastImageMapCorrelationPruneUtc.AddSeconds(2))
{
return;
}
DateTime fileCutoff = nowUtc - ImageMapFileCorrelationWindow - TimeSpan.FromSeconds(2);
_recentImageFileAccesses.RemoveAll(x => x.TimestampUtc < fileCutoff);
DateTime mapCutoff = nowUtc - ImageMapRepeatWindow;
foreach (string key in _recentImageMapByPidPath.Where(x => x.Value.LastSeenUtc < mapCutoff)
.Select(x => x.Key)
.ToList())
{
_recentImageMapByPidPath.Remove(key);
}
if (_recentImageMapByPidPath.Count > MaxRecentImageMapStates)
{
foreach (string key in _recentImageMapByPidPath.OrderBy(x => x.Value.LastSeenUtc)
.Take(_recentImageMapByPidPath.Count - MaxRecentImageMapStates)
.Select(x => x.Key)
.ToList())
{
_recentImageMapByPidPath.Remove(key);
}
}
_lastImageMapCorrelationPruneUtc = nowUtc;
}
private RecentImageFileAccess? FindRecentImageFileAccessLocked(uint pid, uint tid, string mappedPath,
DateTime observedUtc)
{
string normalizedPath = NormalizeCorrelationPath(mappedPath);
string fileName = ModuleNameFromPath(normalizedPath);
bool hasPath = !string.IsNullOrWhiteSpace(normalizedPath);
bool hasFileName =
!string.IsNullOrWhiteSpace(fileName) && !fileName.Equals("unknown", StringComparison.OrdinalIgnoreCase);
return _recentImageFileAccesses
.Where(x => x.Pid == pid &&
IsWithinCorrelationWindow(x.TimestampUtc, observedUtc, ImageMapFileCorrelationWindow) &&
(!hasPath || x.Path.Equals(normalizedPath, StringComparison.OrdinalIgnoreCase) ||
(hasFileName && x.FileName.Equals(fileName, StringComparison.OrdinalIgnoreCase))))
.OrderByDescending(x => x.Tid == tid && tid != 0)
.ThenByDescending(x => x.Path.Equals(normalizedPath, StringComparison.OrdinalIgnoreCase))
.ThenBy(x => Math.Abs((x.TimestampUtc - observedUtc).TotalMilliseconds))
.FirstOrDefault();
}
private RecentImageMapState RememberImageMapLocked(uint pid, string mappedPath, string apiName,
DateTime observedUtc, RecentImageFileAccess? linkedAccess)
{
string key = $"{pid}|{mappedPath}";
if (!_recentImageMapByPidPath.TryGetValue(key, out RecentImageMapState? state) ||
observedUtc > state.LastSeenUtc.Add(ImageMapRepeatWindow))
{
state = new RecentImageMapState {
FirstSeenUtc = observedUtc, LastSeenUtc = observedUtc, Path = mappedPath,
LastApi = apiName, LastLinkedFileAccess = linkedAccess, Count = 0
};
_recentImageMapByPidPath[key] = state;
}
state.Count += 1;
state.LastSeenUtc = observedUtc;
state.LastApi = apiName;
if (linkedAccess != null)
{
state.LastLinkedFileAccess = linkedAccess;
}
return state.Clone();
}
private static bool IsWithinCorrelationWindow(DateTime leftUtc, DateTime rightUtc, TimeSpan window) =>
Math.Abs((leftUtc - rightUtc).TotalMilliseconds) <= window.TotalMilliseconds;
private static bool IsImageSectionMapApi(string apiName)
{
string api = (apiName ?? string.Empty).Trim();
return api.Equals("NtMapViewOfSection", StringComparison.OrdinalIgnoreCase) ||
api.Equals("ZwMapViewOfSection", StringComparison.OrdinalIgnoreCase) ||
api.Equals("NtCreateSection", StringComparison.OrdinalIgnoreCase) ||
api.Equals("ZwCreateSection", StringComparison.OrdinalIgnoreCase) ||
api.Equals("CreateFileMappingA", StringComparison.OrdinalIgnoreCase) ||
api.Equals("CreateFileMappingW", StringComparison.OrdinalIgnoreCase) ||
api.Equals("CreateFileMapping", StringComparison.OrdinalIgnoreCase) ||
api.Equals("MapViewOfFile", StringComparison.OrdinalIgnoreCase) ||
api.Equals("MapViewOfFileEx", StringComparison.OrdinalIgnoreCase);
}
private static string ExtractMappedImagePath(BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields)
{
foreach (string candidate in new[] {
view.ImagePath, ReadTrimmedField(fields, "sectionPath"), ReadTrimmedField(fields, "filePath"),
ReadTrimmedField(fields, "imagePath"), ReadTrimmedField(fields, "modulePath"),
ReadTrimmedField(fields, "mappedPath"), ReadTrimmedField(fields, "path"),
ReadTrimmedField(fields, "objectName"), ReadTrimmedField(fields, "name")
})
{
string normalized = NormalizeCorrelationPath(candidate);
if (IsImagePathForMapping(normalized))
{
return normalized;
}
}
return string.Empty;
}
private static string NormalizeCorrelationPath(string? path)
{
string value = (path ?? string.Empty).Trim().Trim('"');
if (value.Length == 0)
{
return string.Empty;
}
value = value.Replace('/', '\\');
if (value.StartsWith("\\??\\", StringComparison.OrdinalIgnoreCase))
{
value = value[4..];
}
if (value.StartsWith("file:", StringComparison.OrdinalIgnoreCase))
{
value = value[5..].TrimStart('\\');
}
return value.Trim();
}
private static bool IsImagePathForMapping(string? path)
{
string name = ModuleNameFromPath(path ?? string.Empty);
return name.EndsWith(".dll", StringComparison.OrdinalIgnoreCase) ||
name.EndsWith(".exe", StringComparison.OrdinalIgnoreCase) ||
name.EndsWith(".ocx", StringComparison.OrdinalIgnoreCase) ||
name.EndsWith(".sys", StringComparison.OrdinalIgnoreCase);
}
private HeuristicEventView? BuildAntiAnalysisFinding(DateTime timestampUtc, uint actor, uint target,
string detection, uint severity, string source,
string eventName, string reason, string evidence)
{
string key = $"{actor}|{target}|{detection}|{evidence}";
_antiAnalysisCountByEvidence.TryGetValue(key, out int count);
count += 1;
_antiAnalysisCountByEvidence[key] = count;
if (count != 1 && count != 5 && count != 25 && count != 100)
{
return null;
}
return new HeuristicEventView { TimestampUtc = timestampUtc,
LastSeenUtc = timestampUtc,
Severity = severity,
DetectionName = detection,
ActorPid = actor,
TargetPid = target == 0 ? actor : target,
Source = source,
EventName = eventName,
Reason = $"reason={reason}; hits={count}",
Evidence = evidence,
RepeatCount = 1 };
}
private static bool HasDetectionTrait(BrokerEtwEventView view, uint trait) => (view.DetectionTraits & trait) !=
0;
private static bool IsDirectSyscallDetection(BrokerEtwEventView view)
{
if (HasDetectionTrait(view, BlackbirdNative.IpcEtwTraitDirectSyscall))
{
return true;
}
if (IsDirectSyscallHandleTelemetry(view))
{
return true;
}
string detection = view.DetectionName;
if (string.IsNullOrWhiteSpace(detection))
{
return false;
}
return detection.Contains("DIRECT_SYSCALL", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("DIRECT-SYSCALL", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("SUSPECT_HANDLE_OPERATION", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("ANOMALY_ON_HANDLE_OP", StringComparison.OrdinalIgnoreCase);
}
private static bool IsDirectSyscallHandleTelemetry(BrokerEtwEventView view)
{
if (view.Family != BlackbirdNative.IpcEtwFamilyHandle)
{
return false;
}
if (view.ClassName.Equals("DIRECT-SYSCALL-SUSPECT", StringComparison.OrdinalIgnoreCase))
{
return true;
}
bool exportMismatch = (view.Flags & HandleFlagSyscallExportMismatch) != 0;
bool stackSpoof = (view.Flags & HandleFlagStackSpoofSuspect) != 0;
bool execOutsideNtdll =
(view.Flags & HandleFlagExecProtect) != 0 && (view.Flags & HandleFlagFromNtdll) == 0;
return exportMismatch || stackSpoof || execOutsideNtdll;
}
private static bool IsHookTamperDetection(BrokerEtwEventView view)
{
if (HasDetectionTrait(view, BlackbirdNative.IpcEtwTraitHookTamper))
{
return true;
}
string detection = view.DetectionName;
if (string.IsNullOrWhiteSpace(detection))
{
return false;
}
return detection.Contains("USERMODE_HOOK_TAMPERED", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("AMSI_PATCH_TAMPERED", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("ETW_PATCH_TAMPERED", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("IAT_TAMPER", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("EAT_TAMPER", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("NTDLL_IMAGE_TAMPER", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("SR71_HOOK_WRITE_BLOCKED", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("SR71_HOOK_PROTECT_BLOCKED", StringComparison.OrdinalIgnoreCase) ||
detection.Contains("HOOK_TAMPER", StringComparison.OrdinalIgnoreCase);
}
private static string BuildHandleEvidenceText(IoctlParsedEvent record)
{
string accessDecoded = EventDetailFormatting.DescribeHandleAccess(record.DesiredAccess);
string flagsDecoded = EventDetailFormatting.DescribeHandleFlags(record.HandleFlags);
string sampleHex = EventDetailFormatting.FormatSampleHex(record.DeepSample, (int)record.DeepSampleSize);
string disasm = EventDetailFormatting.InferSampleDisassembly(record.DeepSample, (int)record.DeepSampleSize);
string stackSnapshotHex =
EventDetailFormatting.FormatSampleHex(record.StackSnapshot, (int)record.StackSnapshotSize);
string stack0 = record.Frames.Length > 0 ? FormatIoctlCodeAddress(record, record.Frames[0]) : "n/a";
string stack1 = record.Frames.Length > 1 ? FormatIoctlCodeAddress(record, record.Frames[1]) : "n/a";
string moduleName = EventDetailFormatting.ModuleNameFromPath(record.OriginPath);
string originAddress = FormatIoctlCodeAddress(record, record.OriginAddress);
string allocationBase = FormatIoctlCodeAddress(record, record.DeepAllocationBase);
string fullFrames = BuildFrameList(record, record.FullFrames, record.FullFrameCount);
string captureFlags = DescribeCaptureFlags(record.CaptureFlags);
string directSyscallName =
EventDetailFormatting.ResolveDirectSyscallApi(record.DesiredAccess, record.HandleFlags);
string directSyscallLabel = EventDetailFormatting.BuildDirectSyscallLabel(
record.DesiredAccess, record.HandleFlags, record.DeepSample, (int)record.DeepSampleSize);
bool hasContext = (record.CaptureFlags & 0x00000001u) != 0;
bool hasDebugRegs = (record.CaptureFlags & 0x00000002u) != 0;
bool hasFullFrames = (record.CaptureFlags & 0x00000004u) != 0;
bool hasStackSnapshot = (record.CaptureFlags & 0x00000008u) != 0;
string frameSegment = hasFullFrames ? $"fullFrameCount={record.FullFrameCount} fullFrames={fullFrames} "
: "fullFrameCount=0 fullFrames=<none> ";
string registerSegment =
hasContext
? $"rax=0x{record.RegRax:X} rbx=0x{record.RegRbx:X} rcx=0x{record.RegRcx:X} rdx=0x{record.RegRdx:X} " +
$"rsi=0x{record.RegRsi:X} rdi=0x{record.RegRdi:X} rbp=0x{record.RegRbp:X} rsp=0x{record.RegRsp:X} " +
$"r8=0x{record.RegR8:X} r9=0x{record.RegR9:X} r10=0x{record.RegR10:X} r11=0x{record.RegR11:X} " +
$"r12=0x{record.RegR12:X} r13=0x{record.RegR13:X} r14=0x{record.RegR14:X} r15=0x{record.RegR15:X} " +
$"rip=0x{record.RegRip:X} eflags=0x{record.RegEFlags:X} "
: string.Empty;
string debugSegment =
hasDebugRegs
? $"dr0=0x{record.RegDr0:X} dr1=0x{record.RegDr1:X} dr2=0x{record.RegDr2:X} dr3=0x{record.RegDr3:X} dr6=0x{record.RegDr6:X} dr7=0x{record.RegDr7:X} "
: string.Empty;
string stackSegment =
hasStackSnapshot
? $"stackSnapshotAddress=0x{record.StackSnapshotAddress:X} stackSnapshotSize={record.StackSnapshotSize} stackSnapshot={stackSnapshotHex} "
: "stackSnapshotAddress=0x0 stackSnapshotSize=0 stackSnapshot=<none> ";
return $"ioctlEvidence class={record.HandleClass} syscallName={directSyscallName} syscallLabel={directSyscallLabel.Replace(' ', '_')} access=0x{record.DesiredAccess:X8} ({accessDecoded}) flags=0x{record.HandleFlags:X8} ({flagsDecoded}) " +
$"origin={originAddress} protect=0x{record.OriginProtect:X8} module={moduleName} " +
$"allocationBase={allocationBase} regionSize=0x{record.DeepRegionSize:X} regionProtect=0x{record.DeepRegionProtect:X8} ({EventDetailFormatting.DescribeMemoryProtection(record.DeepRegionProtect)}) " +
$"regionState=0x{record.DeepRegionState:X8} ({EventDetailFormatting.DescribeMemoryState(record.DeepRegionState)}) regionType=0x{record.DeepRegionType:X8} ({EventDetailFormatting.DescribeMemoryType(record.DeepRegionType)}) " +
$"path={record.OriginPath} stack0={stack0} stack1={stack1} " +
$"captureFlags=0x{record.CaptureFlags:X8} ({captureFlags}) " + frameSegment + registerSegment +
debugSegment + stackSegment +
$"deepSampleSize={record.DeepSampleSize} deepSample={sampleHex} sampleDisasmHint={disasm}";
}
private static string DescribeCaptureFlags(uint captureFlags)
{
var labels = new List<string>();
if ((captureFlags & 0x00000001u) != 0)
{
labels.Add("CONTEXT");
}
if ((captureFlags & 0x00000002u) != 0)
{
labels.Add("DEBUG_REGS");
}
if ((captureFlags & 0x00000004u) != 0)
{
labels.Add("FULL_FRAMES");
}
if ((captureFlags & 0x00000008u) != 0)
{
labels.Add("STACK_SNAPSHOT");
}
return labels.Count == 0 ? "NONE" : string.Join("|", labels);
}
private static string BuildFrameList(IoctlParsedEvent record, ulong[]? frames, uint frameCount)
{
if (frames == null || frames.Length == 0 || frameCount == 0)
{
return "<none>";
}
int safeCount = Math.Min(frames.Length, (int)frameCount);
var list = new List<string>(safeCount);
for (int i = 0; i < safeCount; i += 1)
{
ulong frame = frames[i];
if (frame == 0)
{
continue;
}
list.Add(FormatIoctlCodeAddress(record, frame));
}
return list.Count == 0 ? "<none>" : string.Join(",", list);
}
private static string FormatIoctlCodeAddress(IoctlParsedEvent record, ulong address)
{
if (address == 0)
{
return "n/a";
}
string moduleName = EventDetailFormatting.ModuleNameFromPath(record.OriginPath);
ulong allocationBase = record.DeepAllocationBase;
ulong regionSize = record.DeepRegionSize;
bool inRange = regionSize == 0 ||
(regionSize <= ulong.MaxValue - allocationBase && address < allocationBase + regionSize);
if (!moduleName.Equals("unknown", StringComparison.OrdinalIgnoreCase) && allocationBase != 0 &&
address >= allocationBase && inRange)
{
string section = (record.DeepRegionType & 0x01000000u) != 0 ? ".image" : ".region";
return $"{moduleName}{section}+0x{address - allocationBase:X}";
}
return $"unresolved+0x{address:X}";
}
private static bool IsHighRiskIoctlAccess(uint desiredAccess, bool isThreadObject)
{
if (isThreadObject)
{
bool threadAll = (desiredAccess & 0x001F03FFu) == 0x001F03FFu;
return threadAll || (desiredAccess & (0x0002u | 0x0008u | 0x0010u)) != 0;
}
bool processAll = (desiredAccess & 0x001F0FFFu) == 0x001F0FFFu;
return processAll || (desiredAccess & (0x0002u | 0x0008u | 0x0010u | 0x0020u)) != 0;
}
private static bool ShouldKeepDirectSyscallHeuristicFromEvidence(IoctlParsedEvent record)
{
if (record.HandleClass == 2)
{
return true;
}
bool exportMismatch = (record.HandleFlags & HandleFlagSyscallExportMismatch) != 0;
bool stackSpoof = (record.HandleFlags & HandleFlagStackSpoofSuspect) != 0;
bool execOutsideNtdll =
(record.HandleFlags & HandleFlagExecProtect) != 0 && (record.HandleFlags & HandleFlagFromNtdll) == 0;
bool framesOutsideTeb = (record.HandleFlags & HandleFlagFramesOutsideTebStack) != 0;
return exportMismatch || stackSpoof || execOutsideNtdll || framesOutsideTeb;
}
private static bool IsGdiSubsystemModule(string? originPath)
{
if (string.IsNullOrWhiteSpace(originPath))
{
return false;
}
string module = EventDetailFormatting.ModuleNameFromPath(originPath).ToLowerInvariant();
return module is "win32u.dll" or "gdi32.dll" or "gdi32full.dll" or "user32.dll" or "user32full.dll";
}
private static string DescribeFileOperation(uint operation)
{
return operation switch { BlackbirdNative.FileOperationCreate => "CREATE",
BlackbirdNative.FileOperationRead => "READ",
BlackbirdNative.FileOperationWrite => "WRITE",
BlackbirdNative.FileOperationClose => "CLOSE",
BlackbirdNative.FileOperationCleanup => "CLEANUP",
BlackbirdNative.FileOperationSetInformation => "SET_INFORMATION",
BlackbirdNative.FileOperationQueryInformation => "QUERY_INFORMATION",
BlackbirdNative.FileOperationDirectoryControl => "DIRECTORY_CONTROL",
BlackbirdNative.FileOperationFsControl => "FS_CONTROL",
_ => "UNKNOWN" };
}
private static string BuildFileSummaryPath(string path)
{
if (string.IsNullOrWhiteSpace(path))
{
return "<unknown>";
}
const int maxChars = 84;
if (path.Length <= maxChars)
{
return path;
}
return "..." + path[^maxChars..];
}
private static string BuildFilesystemClusterKey(IoctlParsedEvent record)
{
string path = string.IsNullOrWhiteSpace(record.FilePath) ? "<unknown>" : record.FilePath;
return $"{record.FileOperation}|{record.FileProcessPid}|{path}";
}
private void ResetFilesystemTimelineCluster()
{
_filesystemClusterOperationCounts.Clear();
_filesystemClusterSamplesByOperation.Clear();
_filesystemClusterTotal = 0;
_filesystemClusterWindowStartUtc = DateTime.MinValue;
_filesystemClusterLastSeenUtc = DateTime.MinValue;
}
private IReadOnlyList<TelemetryEvent> FlushFilesystemTimelineClusterIfNeeded(DateTime nowUtc, bool force)
{
if (_filesystemClusterTotal <= 0)
{
return Array.Empty<TelemetryEvent>();
}
if (!force && (nowUtc - _filesystemClusterLastSeenUtc) < FilesystemTimelineClusterIdleFlush)
{
return Array.Empty<TelemetryEvent>();
}
double windowMs =
Math.Max(1, (_filesystemClusterLastSeenUtc - _filesystemClusterWindowStartUtc).TotalMilliseconds);
var emitted = new List<TelemetryEvent>(_filesystemClusterOperationCounts.Count);
foreach (var entry in _filesystemClusterOperationCounts.OrderByDescending(x => x.Value).ThenBy(x => x.Key))
{
if (entry.Value <= 0)
{
continue;
}
int count = entry.Value;
(uint Pid, uint Tid, string Path, uint Operation) sample =
_filesystemClusterSamplesByOperation.TryGetValue(entry.Key, out var found)
? found
: (0u, 0u, "<unknown>", 0u);
string operationName = DescribeFileOperation(sample.Operation);
string samplePath = string.IsNullOrWhiteSpace(sample.Path) ? "<unknown>" : sample.Path;
string summaryPath = BuildFileSummaryPath(samplePath);
emitted.Add(new TelemetryEvent {
TimestampUtc = _filesystemClusterLastSeenUtc, PID = unchecked((int)sample.Pid),
TID = unchecked((int)sample.Tid), Group = "Filesystem", SubType = operationName,
Summary = $"{operationName} x{count} pid={sample.Pid} path={summaryPath}",
Details =
$"windowStart={_filesystemClusterWindowStartUtc:O} windowEnd={_filesystemClusterLastSeenUtc:O} windowMs={windowMs:0} " +
$"operation={operationName} count={count} clusterTotal={_filesystemClusterTotal} samplePid={sample.Pid} sampleTid={sample.Tid} samplePath={samplePath}"
});
}
ResetFilesystemTimelineCluster();
return emitted;
}
private IReadOnlyList<TelemetryEvent> AccumulateFilesystemTimelineCluster(IoctlParsedEvent record,
DateTime nowUtc)
{
if (record.Type != BlackbirdNative.EventTypeFileSystem)
{
return Array.Empty<TelemetryEvent>();
}
var emitted = new List<TelemetryEvent>();
if (_filesystemClusterTotal > 0 &&
(nowUtc - _filesystemClusterWindowStartUtc) >= FilesystemTimelineClusterWindow)
{
emitted.AddRange(FlushFilesystemTimelineClusterIfNeeded(nowUtc, force: true));
}
if (_filesystemClusterTotal == 0)
{
_filesystemClusterWindowStartUtc = nowUtc;
}
string clusterKey = BuildFilesystemClusterKey(record);
_filesystemClusterTotal += 1;
_filesystemClusterLastSeenUtc = nowUtc;
_filesystemClusterOperationCounts.TryGetValue(clusterKey, out int count);
_filesystemClusterOperationCounts[clusterKey] = count + 1;
if (!_filesystemClusterSamplesByOperation.ContainsKey(clusterKey))
{
_filesystemClusterSamplesByOperation[clusterKey] =
(record.FileProcessPid, record.FileThreadId,
string.IsNullOrWhiteSpace(record.FilePath) ? "<unknown>" : record.FilePath, record.FileOperation);
}
if (_filesystemClusterTotal >= FilesystemTimelineClusterFlushCount)
{
emitted.AddRange(FlushFilesystemTimelineClusterIfNeeded(nowUtc, force: true));
}
return emitted.Count == 0 ? Array.Empty<TelemetryEvent>() : emitted;
}
private TelemetryEvent? MapIoctlRecord(IoctlParsedEvent record)
{
DateTime now = DateTime.UtcNow;
if (record.Type == BlackbirdNative.EventTypeHandle)
{
RememberHandleEvidence(record);
uint caller = record.CallerPid;
uint target = record.TargetPid;
if (caller != 0 && !_filterTrackedPids.IsEmpty && !_filterTrackedPids.ContainsKey(caller))
{
return null;
}
string originModuleForFilter = EventDetailFormatting.ModuleNameFromPath(record.OriginPath);
if (EventDetailFormatting.IsSr71Module(originModuleForFilter))
{
return null;
}
string className = record.HandleClass switch {
1 => "LEGITIMATE-SYSCALL",
2 => "DIRECT-SYSCALL-SUSPECT",
_ => "UNKNOWN"
};
string syscallLabel = EventDetailFormatting.BuildDirectSyscallLabel(
record.DesiredAccess, record.HandleFlags, record.DeepSample, (int)record.DeepSampleSize);
return new TelemetryEvent {
TimestampUtc = now,
PID = unchecked((int)caller),
TID = unchecked((int)record.ThreadId),
Group = "Kernel-IOCTL",
SubType = "Handle",
Summary =
$"{className} {syscallLabel} caller={caller} target={target} access=0x{record.DesiredAccess:X8}",
Details = BuildHandleEvidenceText(record)
};
}
if (record.Type == BlackbirdNative.EventTypeThread)
{
uint process = record.ProcessPid;
uint creator = record.CreatorPid;
if (creator != 0 && process != 0 && creator != process && !_filterTrackedPids.IsEmpty &&
!_filterTrackedPids.ContainsKey(creator))
{
return null;
}
string eventKind =
DetermineThreadLifecycleKind(record.ThreadFlags, record.StartAddress, record.ImageSize);
string threadFlags = EventDetailFormatting.DescribeThreadFlags(record.ThreadFlags);
return new TelemetryEvent {
TimestampUtc = now,
PID = unchecked((int)process),
TID = unchecked((int)record.ThreadId),
Group = "Kernel-IOCTL",
SubType = $"Thread{eventKind}",
Summary = $"{eventKind} creator={creator} process={process} flags=0x{record.ThreadFlags:X8}",
Details =
$"seq={record.Sequence} start=0x{record.StartAddress:X} imageBase=0x{record.ImageBase:X} imageSize=0x{record.ImageSize:X} decodedFlags={threadFlags}"
};
}
if (record.Type == BlackbirdNative.EventTypeFileSystem)
{
return null;
}
if (record.Type == BlackbirdNative.EventTypeEnterprise)
{
uint actor = record.EnterpriseProcessPid;
uint target = record.EnterpriseTargetProcessPid;
if (actor != 0 && !_filterTrackedPids.IsEmpty && !_filterTrackedPids.ContainsKey(actor))
{
return null;
}
string operation = DescribeEnterpriseOperation(record.EnterpriseOperation);
string flags = DescribeEnterpriseFlags(record.EnterpriseFlags);
return new TelemetryEvent {
TimestampUtc = now,
PID = unchecked((int)actor),
TID = unchecked((int)record.EnterpriseThreadId),
Group = "Kernel-IOCTL",
SubType = "Enterprise",
Summary = $"{operation} actor={actor} target={target} flags=0x{record.EnterpriseFlags:X8}",
Details =
$"seq={record.Sequence} op={operation} subOp={record.EnterpriseSubOperation} actor={actor} tid={record.EnterpriseThreadId} " +
$"target={target} targetTid={record.EnterpriseTargetThreadId} desired=0x{record.EnterpriseDesiredAccess:X8} " +
$"granted=0x{record.EnterpriseGrantedAccess:X8} status=0x{record.EnterpriseStatus:X8} " +
$"object=0x{record.EnterpriseObjectAddress:X} aux0=0x{record.EnterpriseAux0:X} aux1=0x{record.EnterpriseAux1:X} " +
$"protocol={record.EnterpriseProtocol} localPort={record.EnterpriseLocalPort} remotePort={record.EnterpriseRemotePort} flags={flags}"
};
}
return null;
}
private bool ShouldAcceptFilesystemRecord(IoctlParsedEvent record)
{
if (record.Type != BlackbirdNative.EventTypeFileSystem)
{
return true;
}
uint pid = record.FileProcessPid;
if (pid == 0 || (!_filterTrackedPids.IsEmpty && !_filterTrackedPids.ContainsKey(pid)))
{
return false;
}
return !IsBlackbirdInternalFilesystemPath(record.FilePath);
}
private bool ShouldEvaluateSignatureIntelForIoctl(IoctlParsedEvent record, bool acceptFilesystem)
{
if (record.Type == BlackbirdNative.EventTypeFileSystem)
{
return acceptFilesystem;
}
if (record.Type == BlackbirdNative.EventTypeRegistry)
{
return record.RegistryProcessPid != 0 && IsTrackedPid(record.RegistryProcessPid);
}
if (record.Type == BlackbirdNative.EventTypeEnterprise)
{
return record.EnterpriseProcessPid != 0 && IsTrackedPid(record.EnterpriseProcessPid);
}
if (record.Type == BlackbirdNative.EventTypeHandle)
{
if (record.CallerPid != 0 && !IsTrackedPid(record.CallerPid))
{
return false;
}
string originModule = EventDetailFormatting.ModuleNameFromPath(record.OriginPath);
return !EventDetailFormatting.IsSr71Module(originModule);
}
if (record.Type == BlackbirdNative.EventTypeThread)
{
if (record.CreatorPid != 0 && record.ProcessPid != 0 && record.CreatorPid != record.ProcessPid)
{
return IsTrackedPid(record.CreatorPid);
}
return IsTrackedPid(record.ProcessPid);
}
return true;
}
private static bool IsBlackbirdInternalFilesystemPath(string? path)
{
if (string.IsNullOrWhiteSpace(path))
{
return false;
}
string normalized = path.Replace('/', '\\').Trim();
return normalized.Contains("\\ProgramData\\Blackbird", StringComparison.OrdinalIgnoreCase) ||
normalized.Contains("\\Device\\HarddiskVolume3\\ProgramData\\Blackbird",
StringComparison.OrdinalIgnoreCase) ||
normalized.EndsWith("\\controller.log", StringComparison.OrdinalIgnoreCase) ||
normalized.EndsWith("\\controller.log.1", StringComparison.OrdinalIgnoreCase);
}
private static IoctlParsedEvent? MapIoctlFilesystem(IoctlParsedEvent record)
{
return record.Type == BlackbirdNative.EventTypeFileSystem ? record : null;
}
private static IoctlParsedEvent? MapIoctlRegistry(IoctlParsedEvent record)
{
return record.Type == BlackbirdNative.EventTypeRegistry ? record : null;
}
private static ThreadLifecycleEventSample? MapIoctlThreadLifecycle(IoctlParsedEvent record)
{
if (record.Type != BlackbirdNative.EventTypeThread)
{
return null;
}
DateTime now = DateTime.UtcNow;
string eventKind = DetermineThreadLifecycleKind(record.ThreadFlags, record.StartAddress, record.ImageSize);
string decodedFlags = EventDetailFormatting.DescribeThreadFlags(record.ThreadFlags);
return new ThreadLifecycleEventSample { TimestampUtc = now, ProcessPid = record.ProcessPid,
ThreadId = record.ThreadId, CreatorPid = record.CreatorPid,
Flags = record.ThreadFlags, StartAddress = record.StartAddress,
ImageBase = record.ImageBase, ImageSize = record.ImageSize,
EventKind = eventKind, Notes = $"flags={decodedFlags}" };
}
private static string DetermineThreadLifecycleKind(uint threadFlags, ulong startAddress, ulong imageSize)
{
if ((threadFlags & 0x00000200u) != 0)
{
return "Exit";
}
if ((threadFlags & 0x00000001u) == 0 && startAddress == 0 && imageSize == 0)
{
return "Exit";
}
if ((threadFlags & 0x00000001u) != 0)
{
return "Start";
}
return "Update";
}
private ProcessRelationView? MapIoctlRelation(IoctlParsedEvent record)
{
DateTime now = DateTime.UtcNow;
if (record.Type == BlackbirdNative.EventTypeHandle)
{
uint source = record.CallerPid;
uint target = record.TargetPid;
if (source == 0 || target == 0 || source == target)
{
return null;
}
if (!_filterTrackedPids.IsEmpty && !_filterTrackedPids.ContainsKey(source))
{
return null;
}
string accessDecoded = EventDetailFormatting.DescribeHandleAccess(record.DesiredAccess);
string flagsDecoded = EventDetailFormatting.DescribeHandleFlags(record.HandleFlags);
string originModule = EventDetailFormatting.ModuleNameFromPath(record.OriginPath);
bool isSr71Handle = EventDetailFormatting.IsSr71Module(originModule);
if (isSr71Handle)
{
return null;
}
string detailSignature =
$"handle|{source}|{target}|{record.DesiredAccess:X8}|{record.HandleFlags:X8}|{originModule}";
string detailText =
$"sourcePid={source} targetPid={target} relationType=HandleOpen access=0x{record.DesiredAccess:X8} ({accessDecoded}) " +
$"flags=0x{record.HandleFlags:X8} ({flagsDecoded}) originModule={originModule} " +
$"handleOwner={(isSr71Handle ? "SR71" : "ActorProcess")}";
return new ProcessRelationView { FirstSeenUtc = now,
LastSeenUtc = now,
SourcePid = source,
TargetPid = target,
RelationType = "HandleOpen",
LastAccessMask = record.DesiredAccess,
LastFlags = record.HandleFlags,
OriginSource = "Kernel-IOCTL",
OriginModule = originModule,
DetailSignature = detailSignature,
DetailText = detailText,
RepeatCount = 1 };
}
if (record.Type == BlackbirdNative.EventTypeThread)
{
uint source = record.CreatorPid;
uint target = record.ProcessPid;
if (source == 0 || target == 0 || source == target)
{
return null;
}
if (!_filterTrackedPids.IsEmpty && !_filterTrackedPids.ContainsKey(source))
{
return null;
}
return new ProcessRelationView { FirstSeenUtc = now,
LastSeenUtc = now,
SourcePid = source,
TargetPid = target,
RelationType = "ThreadCreate",
LastAccessMask = 0,
LastFlags = record.ThreadFlags,
OriginSource = "Kernel-IOCTL",
OriginModule =
EventDetailFormatting.ModuleNameFromPath(record.OriginPath),
RepeatCount = 1 };
}
if (record.Type == BlackbirdNative.EventTypeEnterprise)
{
uint source = record.EnterpriseProcessPid;
uint target = record.EnterpriseTargetProcessPid;
if (source == 0 || target == 0 || source == target)
{
return null;
}
if (!_filterTrackedPids.IsEmpty && !_filterTrackedPids.ContainsKey(source))
{
return null;
}
string operation = DescribeEnterpriseOperation(record.EnterpriseOperation);
return new ProcessRelationView {
FirstSeenUtc = now,
LastSeenUtc = now,
SourcePid = source,
TargetPid = target,
RelationType = "EnterpriseAccess",
LastAccessMask = record.EnterpriseDesiredAccess,
LastFlags = record.EnterpriseFlags,
OriginSource = "Kernel-IOCTL",
OriginModule = operation,
DetailSignature = $"enterprise|{source}|{target}|{record.EnterpriseOperation}|{record.EnterpriseFlags:X8}",
DetailText =
$"sourcePid={source} targetPid={target} relationType=EnterpriseAccess operation={operation} " +
$"access=0x{record.EnterpriseDesiredAccess:X8} flags=0x{record.EnterpriseFlags:X8}",
RepeatCount = 1
};
}
return null;
}
private static ProcessRelationView? MapEtwRelation(BrokerEtwEventView view)
{
if (view.Family != BlackbirdNative.IpcEtwFamilyProcess ||
(view.Flags & BlackbirdNative.IpcEtwFlagProcessIsCreate) == 0)
{
return null;
}
uint source =
view.CreatorPid != 0 ? view.CreatorPid : (view.ParentPid != 0 ? view.ParentPid : view.ActorPid);
uint target = view.ProcessPid != 0 ? view.ProcessPid : view.TargetPid;
if (source == 0 || target == 0 || source == target)
{
return null;
}
uint createStatus = unchecked((uint)view.CreateStatus);
string detailSignature = $"create|{source}|{target}|0x{view.ProcessStartKey:X}|0x{createStatus:X8}";
string detailText =
$"sourcePid={source} targetPid={target} relationType=ProcessCreate creatorPid={view.CreatorPid} " +
$"parentPid={view.ParentPid} createStatus=0x{createStatus:X8} startKey=0x{view.ProcessStartKey:X} " +
$"imagePath={view.ImagePath}";
return new ProcessRelationView { FirstSeenUtc = view.TimestampUtc,
LastSeenUtc = view.TimestampUtc,
SourcePid = source,
TargetPid = target,
RelationType = "ProcessCreate",
LastAccessMask = 0,
LastFlags = view.Flags,
OriginSource = view.Source,
OriginModule = EventDetailFormatting.ModuleNameFromPath(view.ImagePath),
DetailSignature = detailSignature,
DetailText = detailText,
RepeatCount = 1 };
}
private HeuristicEventView? MapIoctlHeuristic(IoctlParsedEvent record)
{
HeuristicEventView? antiAnalysis = EvaluateAntiAnalysisIoctlHeuristic(record);
if (antiAnalysis != null)
{
return antiAnalysis;
}
if (record.Type == BlackbirdNative.EventTypeEnterprise)
{
uint actor = record.EnterpriseProcessPid;
uint target = record.EnterpriseTargetProcessPid;
if (actor == 0 || (!_filterTrackedPids.IsEmpty && !_filterTrackedPids.ContainsKey(actor)))
{
return null;
}
string operation = DescribeEnterpriseOperation(record.EnterpriseOperation);
string flags = DescribeEnterpriseFlags(record.EnterpriseFlags);
uint enterpriseSeverity =
(record.EnterpriseFlags & BlackbirdNative.EnterpriseFlagCritical) != 0 ? 8u : 6u;
return new HeuristicEventView {
TimestampUtc = DateTime.UtcNow,
LastSeenUtc = DateTime.UtcNow,
Severity = enterpriseSeverity,
DetectionName = $"ENTERPRISE_{operation}",
ActorPid = actor,
TargetPid = target,
Source = "Kernel-IOCTL/Enterprise",
EventName = "EnterpriseTelemetry",
CorrelationFlags = record.EnterpriseFlags,
CorrelationAccessMask = record.EnterpriseDesiredAccess,
CorrelationAgeMs = 0,
Reason =
$"enterprise operation={operation}; flags={flags}; desired=0x{record.EnterpriseDesiredAccess:X8}; " +
$"status=0x{record.EnterpriseStatus:X8}",
Evidence =
$"actor={actor} tid={record.EnterpriseThreadId} target={target} targetTid={record.EnterpriseTargetThreadId} " +
$"object=0x{record.EnterpriseObjectAddress:X} aux0=0x{record.EnterpriseAux0:X} aux1=0x{record.EnterpriseAux1:X}",
RepeatCount = 1
};
}
if (record.Type != BlackbirdNative.EventTypeHandle || record.CallerPid == 0 || record.TargetPid == 0)
{
return null;
}
if (record.HandleClass != 2)
{
return null;
}
DateTime now = DateTime.UtcNow;
bool isThreadObject = (record.HandleFlags & HandleFlagThreadObject) != 0;
bool highRiskAccess = IsHighRiskIoctlAccess(record.DesiredAccess, isThreadObject);
bool exportMismatch = (record.HandleFlags & HandleFlagSyscallExportMismatch) != 0;
bool stackSpoof = (record.HandleFlags & HandleFlagStackSpoofSuspect) != 0;
bool stackValidated = (record.HandleFlags & HandleFlagStackValidated) != 0;
bool tebBoundsValid = (record.HandleFlags & HandleFlagTebStackBoundsValid) != 0;
bool execOutsideNtdll =
(record.HandleFlags & HandleFlagExecProtect) != 0 && (record.HandleFlags & HandleFlagFromNtdll) == 0;
uint severity = exportMismatch ? 6u : highRiskAccess ? 5u : (stackSpoof || execOutsideNtdll) ? 4u : 3u;
string handleFlagsDecoded = EventDetailFormatting.DescribeHandleFlags(record.HandleFlags);
string corrAccessDecoded = EventDetailFormatting.DescribeHandleAccess(record.DesiredAccess);
string syscallName =
EventDetailFormatting.ResolveDirectSyscallApi(record.DesiredAccess, record.HandleFlags);
string syscallSummary = EventDetailFormatting.BuildDirectSyscallSummary(
record.CallerPid.ToString(CultureInfo.InvariantCulture),
record.TargetPid.ToString(CultureInfo.InvariantCulture), record.DesiredAccess, record.HandleFlags,
record.DeepSample, (int)record.DeepSampleSize, record.OriginPath);
return new HeuristicEventView {
TimestampUtc = now,
LastSeenUtc = now,
Severity = severity,
DetectionName = $"DIRECT_SYSCALL_SUSPECT_HANDLE_OPERATION [{syscallName}]",
ActorPid = record.CallerPid,
TargetPid = record.TargetPid,
Source = "Kernel-IOCTL",
EventName = "HandleTelemetry",
CorrelationFlags = 0,
CorrelationAccessMask = record.DesiredAccess,
CorrelationAgeMs = 0,
Reason =
$"{syscallSummary}; ioctlClass={record.HandleClass}; directClass=true; highRiskAccess={highRiskAccess}; " +
$"exportMismatch={exportMismatch}; stackSpoof={stackSpoof}; stackValidated={stackValidated}; " +
$"tebBoundsValid={tebBoundsValid}; execOutsideNtdll={execOutsideNtdll}; " +
$"handleFlags={handleFlagsDecoded}; access={corrAccessDecoded}",
Evidence = BuildHandleEvidenceText(record),
RepeatCount = 1
};
}
private HeuristicEventView? EvaluateAntiAnalysisIoctlHeuristic(IoctlParsedEvent record)
{
DateTime now = DateTime.UtcNow;
if (record.Type == BlackbirdNative.EventTypeFileSystem)
{
if (!ShouldAcceptFilesystemRecord(record))
{
return null;
}
uint pid = record.FileProcessPid;
string path = record.FilePath ?? string.Empty;
if (!TryMatchVirtualizationArtifact(path, out string artifact))
{
return null;
}
string evidence =
$"filesystem operation=0x{record.FileOperation:X} pid={pid} tid={record.FileThreadId} artifact={artifact} path={path}";
return BuildAntiAnalysisFinding(now, pid, pid, "ANTI_VM_FILESYSTEM_ARTIFACT_PROBE", 5,
"Kernel-IOCTL/AntiAnalysis", "FileSystemTelemetry",
$"probed virtualization filesystem artifact {artifact}", evidence);
}
if (record.Type == BlackbirdNative.EventTypeRegistry)
{
uint pid = record.RegistryProcessPid;
if (pid == 0 || (!_filterTrackedPids.IsEmpty && !_filterTrackedPids.ContainsKey(pid)))
{
return null;
}
if (!IsRegistryProbeOperation(record.RegistryOperation))
{
return null;
}
string registryPath = BuildRegistryProbePath(record);
if (!TryMatchVirtualizationArtifact(registryPath, out string artifact))
{
return null;
}
string operation = DescribeRegistryProbeOperation(record.RegistryOperation);
string evidence =
$"registry operation={operation} pid={pid} tid={record.RegistryThreadId} artifact={artifact} path={registryPath}";
return BuildAntiAnalysisFinding(now, pid, pid, "ANTI_VM_REGISTRY_ARTIFACT_PROBE", 5,
"Kernel-IOCTL/AntiAnalysis", "RegistryTelemetry",
$"queried virtualization registry artifact {artifact}", evidence);
}
return null;
}
private static string BuildRegistryProbePath(IoctlParsedEvent record)
{
string key = record.RegistryKeyPath ?? string.Empty;
string value = record.RegistryValueName ?? string.Empty;
if (string.IsNullOrWhiteSpace(value))
{
return key;
}
return string.IsNullOrWhiteSpace(key) ? value : $"{key}\\{value}";
}
private static string DescribeEnterpriseOperation(uint operation)
{
return operation switch {
BlackbirdNative.EnterpriseOperationProcessCredentialAccess => "PROCESS_CREDENTIAL_ACCESS",
BlackbirdNative.EnterpriseOperationProcessPrivilegedAccess => "PROCESS_PRIVILEGED_ACCESS",
BlackbirdNative.EnterpriseOperationTokenAccess => "TOKEN_ACCESS",
BlackbirdNative.EnterpriseOperationRegistryCredentialHiveAccess => "REGISTRY_CREDENTIAL_HIVE",
BlackbirdNative.EnterpriseOperationRegistryLsaPolicyAccess => "REGISTRY_LSA_POLICY",
BlackbirdNative.EnterpriseOperationRegistryKerberosNtlmAccess => "REGISTRY_KERBEROS_NTLM",
BlackbirdNative.EnterpriseOperationRegistryServiceConfigAccess => "REGISTRY_SERVICE_CONFIG",
BlackbirdNative.EnterpriseOperationRegistryLpePersistenceAccess => "REGISTRY_LPE_PERSISTENCE",
BlackbirdNative.EnterpriseOperationFileCredentialStoreAccess => "FILE_CREDENTIAL_STORE",
BlackbirdNative.EnterpriseOperationFileDirectoryCredentialAccess => "FILE_CREDENTIAL_DIRECTORY",
BlackbirdNative.EnterpriseOperationFileDriverArtifactAccess => "FILE_DRIVER_ARTIFACT",
BlackbirdNative.EnterpriseOperationNetworkAdProtocolConnect => "NETWORK_AD_PROTOCOL",
_ => $"UNKNOWN_{operation}"
};
}
private static string DescribeEnterpriseFlags(uint flags)
{
var parts = new List<string>(8);
if ((flags & BlackbirdNative.EnterpriseFlagCritical) != 0)
parts.Add("Critical");
if ((flags & BlackbirdNative.EnterpriseFlagQuery) != 0)
parts.Add("Query");
if ((flags & BlackbirdNative.EnterpriseFlagWrite) != 0)
parts.Add("Write");
if ((flags & BlackbirdNative.EnterpriseFlagCreate) != 0)
parts.Add("Create");
if ((flags & BlackbirdNative.EnterpriseFlagDelete) != 0)
parts.Add("Delete");
if ((flags & BlackbirdNative.EnterpriseFlagDuplicateHandle) != 0)
parts.Add("DuplicateHandle");
if ((flags & BlackbirdNative.EnterpriseFlagProcessObject) != 0)
parts.Add("ProcessObject");
if ((flags & BlackbirdNative.EnterpriseFlagThreadObject) != 0)
parts.Add("ThreadObject");
if ((flags & BlackbirdNative.EnterpriseFlagVmRead) != 0)
parts.Add("VmRead");
if ((flags & BlackbirdNative.EnterpriseFlagVmWrite) != 0)
parts.Add("VmWrite");
if ((flags & BlackbirdNative.EnterpriseFlagVmOperation) != 0)
parts.Add("VmOperation");
if ((flags & BlackbirdNative.EnterpriseFlagCreateThread) != 0)
parts.Add("CreateThread");
if ((flags & BlackbirdNative.EnterpriseFlagCredentialProcess) != 0)
parts.Add("CredentialProcess");
if ((flags & BlackbirdNative.EnterpriseFlagPrivilegedTarget) != 0)
parts.Add("PrivilegedTarget");
if ((flags & BlackbirdNative.EnterpriseFlagLsassTarget) != 0)
parts.Add("LsassTarget");
if ((flags & BlackbirdNative.EnterpriseFlagWinlogonTarget) != 0)
parts.Add("WinlogonTarget");
if ((flags & BlackbirdNative.EnterpriseFlagServiceConfig) != 0)
parts.Add("ServiceConfig");
if ((flags & BlackbirdNative.EnterpriseFlagSecurityHive) != 0)
parts.Add("SecurityHive");
if ((flags & BlackbirdNative.EnterpriseFlagLsaPolicy) != 0)
parts.Add("LsaPolicy");
if ((flags & BlackbirdNative.EnterpriseFlagKerberosNtlm) != 0)
parts.Add("KerberosNtlm");
if ((flags & BlackbirdNative.EnterpriseFlagCredentialFile) != 0)
parts.Add("CredentialFile");
if ((flags & BlackbirdNative.EnterpriseFlagDriverArtifact) != 0)
parts.Add("DriverArtifact");
if ((flags & BlackbirdNative.EnterpriseFlagAdNetwork) != 0)
parts.Add("AdNetwork");
if ((flags & BlackbirdNative.EnterpriseFlagDirectSyscallSuspect) != 0)
parts.Add("DirectSyscallSuspect");
if ((flags & BlackbirdNative.EnterpriseFlagQueryAccess) != 0)
parts.Add("QueryAccess");
if ((flags & BlackbirdNative.EnterpriseFlagThreadContext) != 0)
parts.Add("ThreadContext");
if ((flags & BlackbirdNative.EnterpriseFlagSetOrTerminate) != 0)
parts.Add("SetOrTerminate");
return parts.Count == 0 ? "<none>" : string.Join("|", parts);
}
private static bool IsRegistryProbeOperation(uint operation)
{
return operation is BlackbirdNative.RegistryOperationQueryValue or BlackbirdNative
.RegistryOperationQueryKey or BlackbirdNative.RegistryOperationEnumerateKey or
BlackbirdNative.RegistryOperationEnumerateValue or BlackbirdNative.RegistryOperationOpenKey;
}
private static string DescribeRegistryProbeOperation(uint operation)
{
return operation switch { BlackbirdNative.RegistryOperationQueryValue => "QUERY_VALUE",
BlackbirdNative.RegistryOperationQueryKey => "QUERY_KEY",
BlackbirdNative.RegistryOperationEnumerateKey => "ENUMERATE_KEY",
BlackbirdNative.RegistryOperationEnumerateValue => "ENUMERATE_VALUE",
BlackbirdNative.RegistryOperationOpenKey => "OPEN_KEY",
_ => $"0x{operation:X}" };
}
private static bool TryMatchVirtualizationArtifact(string? text, out string artifact)
{
artifact = string.Empty;
if (string.IsNullOrWhiteSpace(text))
{
return false;
}
string normalized = text.Replace('/', '\\').Trim();
for (int i = 0; i < VirtualizationArtifactPatterns.Length; i += 1)
{
if (normalized.Contains(VirtualizationArtifactPatterns[i].Token, StringComparison.OrdinalIgnoreCase))
{
artifact = VirtualizationArtifactPatterns[i].Label;
return true;
}
}
return false;
}
private void RememberObservedProcessStart(BrokerEtwEventView view)
{
DateTime observedUtc = view.TimestampUtc == default ? DateTime.UtcNow : view.TimestampUtc;
ulong startKey = view.ProcessStartKey;
if (view.ProcessPid != 0 && !_observedProcessStartUtcByPid.ContainsKey(view.ProcessPid))
{
_observedProcessStartUtcByPid[view.ProcessPid] = observedUtc;
}
if (view.EventProcessId != 0 && !_observedProcessStartUtcByPid.ContainsKey(view.EventProcessId))
{
_observedProcessStartUtcByPid[view.EventProcessId] = observedUtc;
}
if (startKey != 0)
{
if (view.ProcessPid != 0)
{
_observedProcessStartKeyByPid[view.ProcessPid] = startKey;
}
if (view.TargetPid != 0)
{
_observedProcessStartKeyByPid[view.TargetPid] = startKey;
}
if (view.EventProcessId != 0)
{
_observedProcessStartKeyByPid[view.EventProcessId] = startKey;
}
}
if (view.Family == BlackbirdNative.IpcEtwFamilyProcess &&
(view.Flags & BlackbirdNative.IpcEtwFlagProcessIsCreate) != 0)
{
uint pid = view.ProcessPid != 0 ? view.ProcessPid : view.TargetPid;
if (pid != 0)
{
_observedProcessStartUtcByPid[pid] = observedUtc;
if (view.EventThreadId != 0)
{
_observedInitialThreadIdByPid[pid] = view.EventThreadId;
}
}
}
}
private bool TryDescribeHookStartupContext(BrokerEtwEventView view, out string headline, out string detail)
{
headline = string.Empty;
detail = string.Empty;
if (!EventDetailFormatting.IsApiGraphCandidate(view))
{
return false;
}
uint pid = view.ProcessPid != 0 ? view.ProcessPid : view.ActorPid;
if (pid == 0)
{
return false;
}
if (!_observedProcessStartUtcByPid.TryGetValue(pid, out DateTime startUtc))
{
if (_currentSession != null && _currentSession.Pid == unchecked((int)pid))
{
startUtc = _currentSession.CaptureStartUtc;
}
else
{
return false;
}
}
DateTime eventUtc = view.TimestampUtc == default ? DateTime.UtcNow : view.TimestampUtc;
if (eventUtc < startUtc)
{
startUtc = eventUtc;
}
double ageMs = Math.Max(0, (eventUtc - startUtc).TotalMilliseconds);
if (ageMs > 4000)
{
return false;
}
string callerOrigin = view.CallerOriginLabel;
bool processImageCaller = callerOrigin.Equals("process-image", StringComparison.OrdinalIgnoreCase);
bool plausibleStartupCaller = processImageCaller ||
callerOrigin.Equals("system", StringComparison.OrdinalIgnoreCase) ||
callerOrigin.Equals("non-system-dll", StringComparison.OrdinalIgnoreCase);
if (!plausibleStartupCaller)
{
return false;
}
uint initialThreadId =
_observedInitialThreadIdByPid.TryGetValue(pid, out uint trackedThreadId) ? trackedThreadId : 0;
bool primaryThread = initialThreadId != 0 && view.EventThreadId == initialThreadId;
string phase = ageMs <= 750 ? "very early process startup" : "early process startup";
headline = ageMs <= 750 ? "Startup Path" : "Early Startup";
if (processImageCaller && primaryThread && ageMs <= 750)
{
detail =
$"StartupContext: inferred {phase} on the initial thread from the process image; likely loader / CRT / compiler-generated initializer activity. " +
"TLS callbacks or .CRT$XL* initializer paths are possible here, but this remains an inference from timing and caller-origin telemetry.";
return true;
}
if (primaryThread && ageMs <= 2000)
{
detail =
$"StartupContext: inferred {phase} on the initial thread; likely loader or CRT initialization traffic rather than steady-state behavior.";
return true;
}
detail =
$"StartupContext: inferred {phase}; this call landed inside the startup window and may still reflect loader, CRT, static-initializer, or DLL attach activity.";
return true;
}
private void HandleBrokerEtwView(BrokerEtwEventView view)
{
HandleBrokerEtwViews(new[] { view });
}
private void HandleBrokerEtwViews(IReadOnlyList<BrokerEtwEventView> views)
{
if (views.Count == 0)
{
return;
}
var etwRows = new List<BrokerEtwEventView>(views.Count);
var heuristics = new List<HeuristicEventView>();
var relations = new List<ProcessRelationView>();
var memoryAttributions = new List<MemoryRegionAttributionSample>(16);
var timelineEvents = new List<TelemetryEvent>(views.Count);
for (int i = 0; i < views.Count; i += 1)
{
BrokerEtwEventView view = views[i];
RememberObservedProcessStart(view);
TelemetryEvent? apiTimelineEvent = null;
UpdateHookPipelineDiagnostics(view);
ObserveTargetOutputEvent(view);
ObserveTargetLifecycleEvent(view);
IReadOnlyList<HeuristicEventView> signatureIntelFindings = QueueSignatureIntelForView(view);
if (signatureIntelFindings.Count > 0)
{
heuristics.AddRange(signatureIntelFindings);
}
PersistObservedHookStackSnapshot(view);
QueueThreadStackFallbackCapture(view);
MemoryRegionAttributionSample? memoryAttribution = CreateMemoryRegionAttributionSample(view);
if (memoryAttribution != null)
{
memoryAttributions.Add(memoryAttribution);
HeuristicEventView? memoryLifecycleHeuristic = EvaluateMemoryLifecycleHeuristic(memoryAttribution);
if (memoryLifecycleHeuristic != null)
{
heuristics.Add(memoryLifecycleHeuristic);
}
}
if (EventDetailFormatting.IsApiGraphCandidate(view))
{
apiTimelineEvent = HandleApiHookEvent(view);
if (apiTimelineEvent != null)
{
timelineEvents.Add(apiTimelineEvent);
}
HeuristicEventView? memPatternHeuristic = EvaluateCrossProcessMemoryHeuristic(view);
if (memPatternHeuristic != null)
{
heuristics.Add(memPatternHeuristic);
}
HeuristicEventView? antiAnalysisHeuristic = EvaluateAntiAnalysisHeuristic(view);
if (antiAnalysisHeuristic != null)
{
heuristics.Add(antiAnalysisHeuristic);
}
HeuristicEventView? imageMapHeuristic = EvaluateImageSectionMapHeuristic(view);
if (imageMapHeuristic != null)
{
heuristics.Add(imageMapHeuristic);
}
}
bool keepEtw = ShouldKeepEtwEvent(view);
if (keepEtw)
{
etwRows.Add(view);
}
if (ObserveExtendedActivity(view))
{
ScheduleExtendedActivitySnapshot();
}
ProcessRelationView? relation = MapEtwRelation(view);
if (relation != null)
{
relations.Add(relation);
}
string detection = view.DetectionName;
DiagnosticsState.SetValue("ETW Status", "Live");
if (detection.Equals("USERMODE_PROCESS_TERMINATE_BREAKPOINT", StringComparison.OrdinalIgnoreCase))
{
uint terminatedPid = view.TargetPid != 0 ? view.TargetPid
: view.ProcessPid != 0 ? view.ProcessPid
: view.ActorPid;
string reason =
string.IsNullOrWhiteSpace(view.Reason)
? $"NtTerminateProcess observed from {ProcessIdentityResolver.Describe(view.ActorPid)}"
: view.Reason;
RememberTargetExitReason(terminatedPid, reason);
DiagnosticsState.SetValue("Target Exit Cause", reason);
}
if (detection.Equals("KERNEL_HOOK_STATUS", StringComparison.OrdinalIgnoreCase))
{
uint installed = view.CorrelationFlags;
uint total = view.CorrelationAccessMask;
uint requiredMiss = view.CorrelationAgeMs;
string hookStatus = requiredMiss == 0
? $"OK ({installed}/{total})"
: $"DEGRADED ({installed}/{total}, {requiredMiss} required miss)";
DiagnosticsState.SetValue("Kernel Hooks", hookStatus);
}
if (IsHookTamperDetection(view))
{
DiagnosticsState.SetValue("Hook Integrity", "TAMPERED");
}
else if (detection.Equals("USERMODE_HOOK_INTEGRITY_OK", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("Hook Integrity", "OK");
MarkSr71HookReadyFromTelemetry();
}
if (detection.Equals("AMSI_PATCH_TAMPERED", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("AMSI Integrity", "TAMPERED");
}
else if (detection.Equals("AMSI_PATCH_OK", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("AMSI Integrity", "OK");
MarkSr71HookReadyFromTelemetry();
}
if (detection.Equals("ETW_PATCH_TAMPERED", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("ETW Integrity", "TAMPERED");
}
else if (detection.Equals("ETW_PATCH_OK", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("ETW Integrity", "OK");
MarkSr71HookReadyFromTelemetry();
}
string eventName = view.EventName ?? string.Empty;
string displayDetection = BuildFallbackDetectionLabel(detection, eventName, view.Task, view.Opcode,
view.EventId, view.CorrelationFlags);
string source = view.Source;
uint actor = view.ActorPid;
bool isSocketEvent = view.Family == BlackbirdNative.IpcEtwFamilySocket ||
EventDetailFormatting.IsKernelNetworkEtwSource(view);
if (isSocketEvent)
{
PerformancePaneHost.IngestNetworkView(view);
}
string socketOperation = string.IsNullOrWhiteSpace(view.Operation) ? eventName : view.Operation;
if (string.IsNullOrWhiteSpace(socketOperation))
{
socketOperation = $"OP{view.Opcode}";
}
string timelineGroup = isSocketEvent ? "Sockets" : "BK-ETW";
string timelineSubtype = isSocketEvent ? socketOperation : eventName;
string summary = isSocketEvent ? $"{socketOperation} pid={actor} task={view.Task} opcode={view.Opcode}"
: (!string.IsNullOrWhiteSpace(displayDetection)
? $"{source}/{displayDetection} sev={view.Severity}"
: $"{source}/{eventName} sev={view.Severity}");
string timelineSignature = $"{timelineGroup}|{eventName}|{actor}|{view.EventThreadId}|{summary}";
bool duplicateTimelineEvent =
string.Equals(_lastEtwTimelineSignature, timelineSignature, StringComparison.OrdinalIgnoreCase) &&
(view.TimestampUtc - _lastEtwTimelineTimestampUtc).TotalMilliseconds <= 900;
HeuristicEventView? heuristic = CreatePromotedHeuristic(view);
if (heuristic != null)
{
heuristics.Add(heuristic);
}
bool persistView = ShouldPersistEtwView(view, keepEtw, relation != null,
heuristic != null || signatureIntelFindings.Count > 0,
apiTimelineEvent != null);
string displayDetails = string.Empty;
if (keepEtw || apiTimelineEvent != null || persistView)
{
EnsureEtwDisplayDetails(view);
displayDetails = view.DisplayDetails;
}
if (persistView)
{
AppendEtwToCaptureStore(view);
}
if (keepEtw && !duplicateTimelineEvent)
{
int timelinePid =
view.EventProcessId == 0 ? unchecked((int)actor) : unchecked((int)view.EventProcessId);
timelineEvents.Add(new TelemetryEvent { TimestampUtc = view.TimestampUtc, PID = timelinePid,
TID = unchecked((int)view.EventThreadId),
Group = timelineGroup, SubType = timelineSubtype,
Summary = summary, Details = displayDetails });
_lastEtwTimelineSignature = timelineSignature;
_lastEtwTimelineTimestampUtc = view.TimestampUtc;
}
}
if (etwRows.Count > 0)
{
EtwPaneHost.PushEvents(etwRows);
_explorer.FirstOrDefault(x => x.Name == "ETW")?.PushPreviewValue(EtwPaneHost.TotalRawCount);
SetExplorerHasData("ETW", EtwPaneHost.ItemCount > 0);
}
if (timelineEvents.Count > 0)
{
AppendEvents(timelineEvents);
}
if (memoryAttributions.Count > 0)
{
PerformancePaneHost.PushMemoryRegionAttributions(memoryAttributions);
if (_currentSession != null)
{
for (int i = 0; i < memoryAttributions.Count; i += 1)
{
_currentSession.MemoryRegionAttributionHistory.Add(
CloneMemoryRegionAttributionSample(memoryAttributions[i]));
}
if (_currentSession.MemoryRegionAttributionHistory.Count > 12_000)
{
_currentSession.MemoryRegionAttributionHistory.RemoveRange(
0, _currentSession.MemoryRegionAttributionHistory.Count - 12_000);
}
}
}
if (heuristics.Count > 0)
{
HeuristicsPaneHost.PushHeuristics(heuristics);
bool extendedChanged = false;
for (int i = 0; i < heuristics.Count; i += 1)
{
extendedChanged |= ObserveSignatureIntelActivity(heuristics[i]);
}
if (extendedChanged)
{
ScheduleExtendedActivitySnapshot();
}
_explorer.FirstOrDefault(x => x.Name == "Heuristics")
?.PushPreviewValue(HeuristicsPaneHost.TotalRawCount);
SetExplorerHasData("Heuristics", HeuristicsPaneHost.ItemCount > 0);
DiagnosticsState.Increment("Heuristics", heuristics.Count);
}
if (relations.Count > 0)
{
ProcessRelationsPaneHost.PushRelations(relations);
_explorer.FirstOrDefault(x => x.Name == "Process Relations")
?.PushPreviewValue(ProcessRelationsPaneHost.TotalRawCount);
SetExplorerHasData("Process Relations", ProcessRelationsPaneHost.ItemCount > 0);
}
}
private static bool IsTargetOutputEvent(BrokerEtwEventView view) =>
view.SourceId == BlackbirdNative.IpcEtwSourceBlackbird
&& view.EventName.Equals("TargetOutput", StringComparison.OrdinalIgnoreCase);
private static bool IsTargetLifecycleEvent(BrokerEtwEventView view) =>
view.SourceId == BlackbirdNative.IpcEtwSourceBlackbird
&& view.EventName.Equals("TargetExit", StringComparison.OrdinalIgnoreCase);
private static void ObserveTargetOutputEvent(BrokerEtwEventView view)
{
if (!IsTargetOutputEvent(view))
{
return;
}
uint pid = view.ProcessPid != 0 ? view.ProcessPid : view.ActorPid;
if (pid == 0 || pid > int.MaxValue)
{
return;
}
string stream = string.IsNullOrWhiteSpace(view.Operation) ? "stdout" : view.Operation.Trim();
string message = !string.IsNullOrWhiteSpace(view.CommandLine) ? view.CommandLine : view.Reason;
if (string.IsNullOrWhiteSpace(message))
{
return;
}
DebugConsoleService.WriteExternal($"TARGET/{stream}", unchecked((int)pid), message);
}
private void ObserveTargetLifecycleEvent(BrokerEtwEventView view)
{
if (!IsTargetLifecycleEvent(view))
{
return;
}
uint pid = view.ProcessPid != 0 ? view.ProcessPid : view.ActorPid;
if (pid == 0 || pid > int.MaxValue)
{
return;
}
string message =
string.IsNullOrWhiteSpace(view.Reason) ? $"target exited status=0x{view.CreateStatus:X8}" : view.Reason;
RememberTargetExitReason(pid, message);
DebugConsoleService.WriteExternal("TARGET/lifecycle", unchecked((int)pid), message);
}
private void RememberTargetExitReason(uint pid, string reason)
{
if (pid == 0 || string.IsNullOrWhiteSpace(reason))
{
return;
}
string normalized = reason.Trim();
_targetExitReasonByPid[pid] = normalized;
if (_currentSession != null && _currentSession.Pid == unchecked((int)pid))
{
_currentSession.TargetExitReason = normalized;
}
}
private static bool ShouldPersistEtwView(BrokerEtwEventView view, bool keepEtw, bool hasRelation,
bool hasPromotedHeuristic, bool hasApiTimelineEvent)
{
if (hasRelation || hasPromotedHeuristic || hasApiTimelineEvent)
{
return true;
}
if (!keepEtw)
{
return false;
}
if (!string.IsNullOrWhiteSpace(view.DetectionName) || view.Severity >= 4)
{
return true;
}
return view.Family is BlackbirdNative.IpcEtwFamilyThread or BlackbirdNative
.IpcEtwFamilyApc or BlackbirdNative.IpcEtwFamilyUserHook or BlackbirdNative.IpcEtwFamilySocket;
}
private void UpdateHookPipelineDiagnostics(BrokerEtwEventView view)
{
if (view.Family == BlackbirdNative.IpcEtwFamilyUserHook &&
view.SourceId == BlackbirdNative.IpcEtwSourceUserHook)
{
long count = Interlocked.Increment(ref _usermodeHookEventCount);
string kind = EventDetailFormatting.HookKindName(view.NotifyClass);
string api = !string.IsNullOrWhiteSpace(view.Operation) ? view.Operation : view.EventName;
string label = !string.IsNullOrWhiteSpace(api) ? api
: !string.IsNullOrWhiteSpace(kind) ? kind
: "event";
DiagnosticsState.SetValue("Usermode Hooks", $"Active ({count} SR71 events, last={label})");
DiagnosticsState.SetValue("HookDLL->Controller IPC", "Ready (SR71 telemetry)");
DiagnosticsState.SetValue("HookDLL Hooks Set", $"OK ({kind})");
MarkSr71HookReadyFromTelemetry();
if (ShouldPromoteIntegrityStatus(DiagnosticsState.GetValue("Hook Integrity")))
{
DiagnosticsState.SetValue("Hook Integrity", "OK");
}
if (ShouldPromoteIntegrityStatus(DiagnosticsState.GetValue("AMSI Integrity")))
{
DiagnosticsState.SetValue("AMSI Integrity", "OK");
}
return;
}
if (EventDetailFormatting.IsKernelHookTelemetry(view))
{
long count = Interlocked.Increment(ref _kernelHookEventCount);
string api = !string.IsNullOrWhiteSpace(view.Operation) ? view.Operation : view.EventName;
DiagnosticsState.SetValue("Kernel Hooks", string.IsNullOrWhiteSpace(api)
? $"Active ({count} events)"
: $"Active ({count} events, last={api})");
return;
}
if (EventDetailFormatting.IsUsermodeSensorTelemetry(view))
{
string kind = EventDetailFormatting.HookKindName(view.NotifyClass);
DiagnosticsState.SetValue("Usermode Hooks", $"Active ({kind})");
DiagnosticsState.SetValue("HookDLL->Controller IPC", "Ready (SR71 telemetry)");
DiagnosticsState.SetValue("HookDLL Hooks Set", $"OK ({kind})");
MarkSr71HookReadyFromTelemetry();
if (ShouldPromoteIntegrityStatus(DiagnosticsState.GetValue("Hook Integrity")))
{
DiagnosticsState.SetValue("Hook Integrity", "OK");
}
if (ShouldPromoteIntegrityStatus(DiagnosticsState.GetValue("AMSI Integrity")))
{
DiagnosticsState.SetValue("AMSI Integrity", "OK");
}
}
}
private static bool ShouldPromoteIntegrityStatus(string? current)
{
if (string.IsNullOrWhiteSpace(current))
{
return true;
}
return current.Contains("Unknown", StringComparison.OrdinalIgnoreCase) ||
current.Contains("Awaiting", StringComparison.OrdinalIgnoreCase) ||
current.Contains("Review", StringComparison.OrdinalIgnoreCase) ||
current.Contains("Disabled (no usermode hooks)", StringComparison.OrdinalIgnoreCase);
}
private static void MarkSr71HookReadyFromTelemetry()
{
string? hookReady = DiagnosticsState.GetValue("SR71 Hook Ready");
if (string.IsNullOrWhiteSpace(hookReady) ||
hookReady.Contains("Awaiting", StringComparison.OrdinalIgnoreCase) ||
hookReady.Contains("DEGRADED", StringComparison.OrdinalIgnoreCase) ||
hookReady.Contains("missing", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("SR71 Hook Ready", "OK observed via SR71 telemetry");
}
string? instrumentation = DiagnosticsState.GetValue("SR71 Instrumentation");
if (string.IsNullOrWhiteSpace(instrumentation) ||
instrumentation.Contains("Awaiting", StringComparison.OrdinalIgnoreCase) ||
instrumentation.Contains("DEGRADED", StringComparison.OrdinalIgnoreCase))
{
DiagnosticsState.SetValue("SR71 Instrumentation", "OK observed via SR71 telemetry");
}
}
private static void TryAppendObservedModule(BrokerEtwEventView view, List<ModuleInfoRow> rows)
{
string path = view.ImagePath ?? string.Empty;
ulong baseAddress = view.ImageBase;
ulong imageSize = view.ImageSize;
if (string.IsNullOrWhiteSpace(path) && view.Family == BlackbirdNative.IpcEtwFamilyUserHook)
{
string apiName = !string.IsNullOrWhiteSpace(view.Operation) ? view.Operation : view.EventName;
if (apiName.Equals("LdrLoadDll", StringComparison.OrdinalIgnoreCase) ||
apiName.StartsWith("LoadLibrary", StringComparison.OrdinalIgnoreCase))
{
Dictionary<string, string> fields = BuildHookFieldMap(view);
path = DecodeModuleHookName(apiName, view);
baseAddress = FirstU64(fields, "handle", "module", "moduleHandle");
}
}
if (string.IsNullOrWhiteSpace(path))
{
return;
}
rows.Add(new ModuleInfoRow {
Name = ModuleNameFromPath(path), BaseAddress = baseAddress == 0 ? "observed" : $"0x{baseAddress:X}",
Size =
imageSize == 0 ? "observed" : FormatObservedBytes((long)Math.Min(imageSize, (ulong) long.MaxValue)),
Path = path
});
}
private static string FormatObservedBytes(long bytes)
{
string[] units = { "B", "KB", "MB", "GB", "TB" };
double value = Math.Max(0, bytes);
int unit = 0;
while (value >= 1024 && unit < units.Length - 1)
{
value /= 1024;
unit += 1;
}
return unit == 0 ? $"{bytes} B" : $"{value:0.0} {units[unit]}";
}
private static string ModuleNameFromPath(string path)
{
string value = (path ?? string.Empty).Trim();
if (value.Length == 0)
{
return "unknown";
}
int slash = Math.Max(value.LastIndexOf('\\'), value.LastIndexOf('/'));
return slash >= 0 && slash + 1 < value.Length ? value[(slash + 1)..] : value;
}
private void PersistObservedHookStackSnapshot(BrokerEtwEventView view)
{
if (view.Family != BlackbirdNative.IpcEtwFamilyUserHook ||
view.SourceId != BlackbirdNative.IpcEtwSourceUserHook || view.StackCount == 0)
{
return;
}
uint pid = view.ProcessPid != 0 ? view.ProcessPid : view.ActorPid;
uint tid = view.EventThreadId != 0 ? view.EventThreadId : view.ThreadId;
if (pid == 0 || tid == 0 || pid > int.MaxValue || tid > int.MaxValue)
{
return;
}
DateTime capturedUtc = view.TimestampUtc == default ? DateTime.UtcNow : view.TimestampUtc;
string throttleKey = $"{pid}:{tid}";
if (_observedHookStackLastPersistByThread.TryGetValue(throttleKey, out DateTime lastPersistUtc) &&
capturedUtc < lastPersistUtc.AddMilliseconds(250))
{
return;
}
ThreadStackSessionSnapshot? snapshot = CreateObservedHookStackSnapshot(view, capturedUtc);
if (snapshot == null || snapshot.Frames.Count == 0)
{
return;
}
_observedHookStackLastPersistByThread[throttleKey] = capturedUtc;
PersistThreadStackSnapshot(unchecked((int)pid), unchecked((int)tid), string.Empty, snapshot);
}
private void QueueThreadStackFallbackCapture(BrokerEtwEventView view)
{
if (view.StackCount != 0 || !ShouldCaptureThreadStackFallback(view))
{
return;
}
uint pid = view.ProcessPid != 0 ? view.ProcessPid
: view.ActorPid != 0 ? view.ActorPid
: view.EventProcessId;
uint tid = view.EventThreadId != 0 ? view.EventThreadId : view.ThreadId;
if (pid == 0 || tid == 0 || pid > int.MaxValue || tid > int.MaxValue)
{
return;
}
DateTime capturedUtc = view.TimestampUtc == default ? DateTime.UtcNow : view.TimestampUtc;
string key = $"{pid}:{tid}";
if (_threadStackFallbackLastCaptureByThread.TryGetValue(key, out DateTime lastCaptureUtc) &&
capturedUtc < lastCaptureUtc.AddSeconds(6))
{
return;
}
if (_pendingThreadStackFallbackCaptures.Count >= 32)
{
return;
}
if (!_pendingThreadStackFallbackCaptures.TryAdd(key, 0))
{
return;
}
_threadStackFallbackLastCaptureByThread[key] = capturedUtc;
int capturePid = unchecked((int)pid);
int captureTid = unchecked((int)tid);
_ = Task.Run(() =>
{
ThreadStackResolveResult result =
ThreadStackResolver.Resolve(capturePid, captureTid, string.Empty);
return CreateThreadStackFallbackSnapshot(capturedUtc, result);
})
.ContinueWith(
task =>
{
_pendingThreadStackFallbackCaptures.TryRemove(key, out _);
if (task.Status != TaskStatus.RanToCompletion || task.Result == null ||
task.Result.Frames.Count == 0)
{
return;
}
Dispatcher.BeginInvoke(
new Action(
() =>
{
PersistThreadStackSnapshot(capturePid, captureTid, string.Empty, task.Result);
DebugConsoleService.WriteLocal(
$"[STACK] captured fallback thread stack pid={capturePid} tid={captureTid} frames={task.Result.Frames.Count}");
}),
DispatcherPriority.Background);
},
TaskScheduler.Default);
}
private static bool ShouldCaptureThreadStackFallback(BrokerEtwEventView view)
{
if (view.Family != BlackbirdNative.IpcEtwFamilyUserHook)
{
return false;
}
string api = !string.IsNullOrWhiteSpace(view.Operation) ? view.Operation : view.EventName;
if (string.IsNullOrWhiteSpace(api))
{
return false;
}
if (!api.StartsWith("Nt", StringComparison.OrdinalIgnoreCase) &&
!api.StartsWith("Zw", StringComparison.OrdinalIgnoreCase) &&
!api.StartsWith("Co", StringComparison.OrdinalIgnoreCase) &&
!api.Contains("Trace", StringComparison.OrdinalIgnoreCase))
{
return false;
}
bool highSignal = view.Severity >= 4 || IsDirectSyscallDetection(view) ||
api.Equals("NtMapViewOfSection", StringComparison.OrdinalIgnoreCase) ||
api.Equals("ZwMapViewOfSection", StringComparison.OrdinalIgnoreCase) ||
api.Equals("NtCreateSection", StringComparison.OrdinalIgnoreCase) ||
api.Equals("ZwCreateSection", StringComparison.OrdinalIgnoreCase) ||
api.Equals("NtWriteVirtualMemory", StringComparison.OrdinalIgnoreCase) ||
api.Equals("NtProtectVirtualMemory", StringComparison.OrdinalIgnoreCase) ||
api.Equals("NtCreateThreadEx", StringComparison.OrdinalIgnoreCase);
if (!highSignal)
{
return false;
}
return view.SourceId == BlackbirdNative.IpcEtwSourceBlackbird ||
view.SourceId == BlackbirdNative.IpcEtwSourceUserHook ||
EventDetailFormatting.IsKernelHookTelemetry(view);
}
private static ThreadStackSessionSnapshot? CreateThreadStackFallbackSnapshot(DateTime capturedUtc,
ThreadStackResolveResult result)
{
if (result.Frames.Count == 0)
{
return null;
}
return new ThreadStackSessionSnapshot { CapturedAtUtc = capturedUtc,
TebAddress = result.TebAddress,
StackBase = result.StackBase,
StackTop = result.StackTop,
TebFlags = result.TebFlags,
StackPointer = result.StackPointer,
ContextSnapshot =
CloneThreadContextSnapshot(result.ContextSnapshot),
Frames = result.Frames.Select(CloneStackFrameRow).ToList() };
}
private static StackFrameRow
CloneStackFrameRow(StackFrameRow frame) => new() { Index = frame.Index,
Address = frame.Address,
Module = frame.Module,
Symbol = frame.Symbol,
InstructionPointerRaw = frame.InstructionPointerRaw,
FramePointerRaw = frame.FramePointerRaw,
FrameSpanBytes = frame.FrameSpanBytes,
IsCurrent = frame.IsCurrent };
private static ThreadContextSnapshot? CloneThreadContextSnapshot(ThreadContextSnapshot? snapshot)
{
if (snapshot == null)
{
return null;
}
return new ThreadContextSnapshot {
Rip = snapshot.Rip, Rsp = snapshot.Rsp, Rbp = snapshot.Rbp, Rax = snapshot.Rax, Rbx = snapshot.Rbx,
Rcx = snapshot.Rcx, Rdx = snapshot.Rdx, Rsi = snapshot.Rsi, Rdi = snapshot.Rdi, R8 = snapshot.R8,
R9 = snapshot.R9, R10 = snapshot.R10, R11 = snapshot.R11, R12 = snapshot.R12, R13 = snapshot.R13,
R14 = snapshot.R14, R15 = snapshot.R15, Dr0 = snapshot.Dr0, Dr1 = snapshot.Dr1, Dr2 = snapshot.Dr2,
Dr3 = snapshot.Dr3, Dr6 = snapshot.Dr6, Dr7 = snapshot.Dr7, EFlags = snapshot.EFlags
};
}
private static ThreadStackSessionSnapshot? CreateObservedHookStackSnapshot(BrokerEtwEventView view,
DateTime capturedUtc)
{
ulong[] stack = view.Stack ?? Array.Empty<ulong>();
int count = Math.Min(Math.Min((int)view.StackCount, stack.Length), BlackbirdNative.MaxIpcStackFrames);
if (count <= 0)
{
return null;
}
Dictionary<string, string> fields = BuildHookFieldMap(view);
var frames = new List<StackFrameRow>(count);
for (int i = 0; i < count; i += 1)
{
ulong ip = stack[i];
if (ip == 0)
{
continue;
}
string symbol = ReadTrimmedField(fields, $"stack{i}Symbol");
string path = ReadTrimmedField(fields, $"stack{i}Path");
string module = ModuleNameFromPath(path);
if (module.Equals("unknown", StringComparison.OrdinalIgnoreCase))
{
module = ExtractModuleFromSymbol(symbol);
}
frames.Add(new StackFrameRow { Index = frames.Count, Address = $"0x{ip:X}", Module = module,
Symbol = string.IsNullOrWhiteSpace(symbol) ? $"0x{ip:X}" : symbol,
InstructionPointerRaw = ip, IsCurrent = frames.Count == 0 });
}
if (frames.Count == 0)
{
return null;
}
ulong stackPointer = FirstU64(fields, "rsp", "sp", "stackPointer", "StackPointer");
return new ThreadStackSessionSnapshot { CapturedAtUtc = capturedUtc, StackPointer = stackPointer,
Frames = frames };
}
private static string ReadTrimmedField(IReadOnlyDictionary<string, string> fields, string key)
{
return fields.TryGetValue(key, out string? value) && !string.IsNullOrWhiteSpace(value)
? value.Trim()
: string.Empty;
}
private static string ExtractModuleFromSymbol(string symbol)
{
string value = (symbol ?? string.Empty).Trim();
int bang = value.IndexOf('!');
return bang > 0 ? value[..bang].Trim() : string.Empty;
}
private static uint DirectSyscallSeverityFloor(BrokerEtwEventView view)
{
bool highRisk = IsHighRiskIoctlAccess(view.DesiredAccess, (view.Flags & HandleFlagThreadObject) != 0);
if ((view.Flags & HandleFlagSyscallExportMismatch) != 0)
{
return 6;
}
if (highRisk || (view.Flags & HandleFlagStackSpoofSuspect) != 0)
{
return 5;
}
if ((view.Flags & HandleFlagExecProtect) != 0 && (view.Flags & HandleFlagFromNtdll) == 0)
{
return 4;
}
return 3;
}
private static string BuildDirectSyscallDetectionName(BrokerEtwEventView view)
{
string syscallName = EventDetailFormatting.ResolveDirectSyscallApi(view.DesiredAccess, view.Flags);
return string.IsNullOrWhiteSpace(syscallName) ? "DIRECT_SYSCALL_SUSPECT_HANDLE_OPERATION"
: $"DIRECT_SYSCALL_SUSPECT_HANDLE_OPERATION [{syscallName}]";
}
private static string BuildEtwDirectSyscallEvidenceText(BrokerEtwEventView view)
{
string syscallName = EventDetailFormatting.ResolveDirectSyscallApi(view.DesiredAccess, view.Flags);
string syscallLabel = EventDetailFormatting.BuildDirectSyscallLabel(
view.DesiredAccess, view.Flags, view.DeepSample, (int)view.DeepSampleSize);
string accessDecoded = EventDetailFormatting.DescribeHandleAccess(view.DesiredAccess);
string flagsDecoded = EventDetailFormatting.DescribeHandleFlags(view.Flags);
string originModule = EventDetailFormatting.ModuleNameFromPath(view.OriginPath);
string sampleHex = EventDetailFormatting.FormatSampleHex(view.DeepSample, (int)view.DeepSampleSize);
string sampleDisasm =
EventDetailFormatting.InferSampleDisassembly(view.DeepSample, (int)view.DeepSampleSize);
string stack0 = view.StackCount > 0 && view.Stack.Length > 0 ? $"0x{view.Stack[0]:X}" : "n/a";
string stack1 = view.StackCount > 1 && view.Stack.Length > 1 ? $"0x{view.Stack[1]:X}" : "n/a";
return $"etwEvidence class={view.ClassName} syscallName={syscallName} syscallLabel={syscallLabel.Replace(' ', '_')} " +
$"access=0x{view.DesiredAccess:X8} ({accessDecoded}) flags=0x{view.Flags:X8} ({flagsDecoded}) handleFlags=0x{view.Flags:X8} " +
$"origin=0x{view.OriginAddress:X} protect=0x{view.OriginProtect:X8} module={originModule} " +
$"path={view.OriginPath} allocationBase=0x{view.DeepAllocationBase:X} regionSize=0x{view.DeepRegionSize:X} " +
$"regionProtect=0x{view.DeepRegionProtect:X8} ({EventDetailFormatting.DescribeMemoryProtection(view.DeepRegionProtect)}) " +
$"stack0={stack0} stack1={stack1} deepSampleSize={view.DeepSampleSize} deepSample={sampleHex} sampleDisasmHint={sampleDisasm}";
}
private HeuristicEventView? CreatePromotedHeuristic(BrokerEtwEventView view)
{
/* Never promote BK's own instrumentation pages as heuristics */
if (IsBlackbirdOwnEvent(view))
return null;
string detection = view.DetectionName;
if (string.IsNullOrWhiteSpace(detection) && IsDirectSyscallDetection(view))
{
detection = BuildDirectSyscallDetectionName(view);
}
if (string.IsNullOrWhiteSpace(detection) || !ShouldPromoteHeuristic(view))
{
return null;
}
uint actor = view.ActorPid;
uint target = view.TargetPid;
string reasonText = string.IsNullOrWhiteSpace(view.Reason) ? "<none>" : view.Reason;
uint sanitizedCorrFlags = view.CorrelationFlags & CorrelationIntentMask;
string corrFlagsDecoded = EventDetailFormatting.DescribeCorrelationFlags(sanitizedCorrFlags);
string corrAccessDecoded = EventDetailFormatting.DescribeHandleAccess(view.CorrelationAccessMask);
string heuristicEvidence = "<none>";
bool hasEvidence = TryGetHandleEvidence(actor, target, out IoctlParsedEvent evidence);
if (hasEvidence)
{
heuristicEvidence = BuildHandleEvidenceText(evidence);
}
if (IsDirectSyscallDetection(view))
{
if (hasEvidence && !ShouldKeepDirectSyscallHeuristicFromEvidence(evidence))
{
return null;
}
if (!hasEvidence && view.Family == BlackbirdNative.IpcEtwFamilyHandle)
{
heuristicEvidence = BuildEtwDirectSyscallEvidenceText(view);
}
}
string rawCorrFlagsSuffix = view.CorrelationFlags == sanitizedCorrFlags
? string.Empty
: $"; rawCorrFlags=0x{view.CorrelationFlags:X8}";
uint severity = IsDirectSyscallDetection(view) ? Math.Max(view.Severity, DirectSyscallSeverityFloor(view))
: view.Severity;
return new HeuristicEventView {
TimestampUtc = view.TimestampUtc,
LastSeenUtc = view.TimestampUtc,
Severity = severity,
DetectionName = detection,
ActorPid = actor,
TargetPid = target,
Source = view.Source,
EventName = view.EventName ?? string.Empty,
CorrelationFlags = sanitizedCorrFlags,
CorrelationAccessMask = view.CorrelationAccessMask,
CorrelationAgeMs = view.CorrelationAgeMs,
Reason =
$"reason={reasonText}; corrFlags={corrFlagsDecoded}; corrAccess={corrAccessDecoded}; corrAgeMs={view.CorrelationAgeMs}{rawCorrFlagsSuffix}",
Evidence = heuristicEvidence,
RepeatCount = 1
};
}
private static string BuildFallbackDetectionLabel(string detectionName, string eventName, ushort task,
ushort opcode, ushort eventId, uint correlationFlags)
{
if (!string.IsNullOrWhiteSpace(detectionName) &&
!detectionName.Equals("UNKNOWN", StringComparison.OrdinalIgnoreCase))
{
return detectionName;
}
string name = eventName?.Trim() ?? string.Empty;
if (name.Equals("ThreadTelemetry", StringComparison.OrdinalIgnoreCase))
{
if (correlationFlags != 0)
{
return $"THREAD_ACTIVITY[{EventDetailFormatting.DescribeCorrelationFlags(correlationFlags)}]";
}
return "THREAD_ACTIVITY";
}
if (name.Equals("HandleTelemetry", StringComparison.OrdinalIgnoreCase))
{
return "HANDLE_ACTIVITY";
}
if (name.Equals("ApcTelemetry", StringComparison.OrdinalIgnoreCase))
{
return "APC_ACTIVITY";
}
if (name.Equals("DetectionTelemetry", StringComparison.OrdinalIgnoreCase))
{
return "DETECTION_UNSPECIFIED";
}
if (!string.IsNullOrWhiteSpace(name) && name.EndsWith("Telemetry", StringComparison.OrdinalIgnoreCase))
{
string baseName = name[..^ "Telemetry".Length].Trim();
if (!string.IsNullOrWhiteSpace(baseName))
{
return $"{baseName.ToUpperInvariant()}_ACTIVITY";
}
}
if (!string.IsNullOrWhiteSpace(detectionName))
{
return detectionName;
}
if (task == 0 && opcode == 0 && eventId == 0)
{
return "TELEMETRY";
}
if (!string.IsNullOrWhiteSpace(name))
{
return name;
}
return "UNCLASSIFIED_EVENT";
}
private TelemetryEvent? HandleApiHookEvent(BrokerEtwEventView view)
{
if (!ShouldIncludeApiGraphView(view))
{
return null;
}
string apiName = !string.IsNullOrWhiteSpace(view.EventName)
? view.EventName
: (!string.IsNullOrWhiteSpace(view.Operation) ? view.Operation : "unknown");
string sensorOrigin = EventDetailFormatting.ClassifyHookSensorOrigin(view);
uint sourcePid = view.ActorPid != 0 ? view.ActorPid : view.ProcessPid;
if (sourcePid == 0)
{
sourcePid = view.EventProcessId;
}
uint targetPid = view.TargetPid != 0 ? view.TargetPid : sourcePid;
uint threadId = view.ThreadId != 0 ? view.ThreadId : view.EventThreadId;
if (sourcePid == 0)
{
return null;
}
string callerOrigin = NormalizeApiCallerOrigin(view.CallerOriginLabel);
Dictionary<string, string> hookFields = BuildHookFieldMap(view);
string originModule = NormalizeApiOriginModule(ResolveHookOriginModule(view, hookFields));
string key =
BuildApiGraphKey(sourcePid, targetPid, threadId, apiName, sensorOrigin, callerOrigin, originModule);
int currentHits;
if (_apiGraphRowsByKey.TryGetValue(key, out ApiCallGraphRowSnapshot? existing))
{
existing.Hits = Math.Max(1, existing.Hits + 1);
existing.LastSeenUtc = view.TimestampUtc;
existing.SensorOrigin = sensorOrigin;
existing.CallerOrigin = callerOrigin;
existing.OriginModule = originModule;
currentHits = existing.Hits;
}
else
{
_apiGraphRowsByKey[key] = new ApiCallGraphRowSnapshot { ApiName = apiName,
SensorOrigin = sensorOrigin,
CallerOrigin = callerOrigin,
OriginModule = originModule,
SourcePid = sourcePid,
TargetPid = targetPid,
ThreadId = threadId,
Hits = 1,
FirstSeenUtc = view.TimestampUtc,
LastSeenUtc = view.TimestampUtc };
currentHits = 1;
}
string rawReason = view.Reason ?? string.Empty;
_apiGraphReasonByKey[key] = rawReason;
(string decodedAction, string decodedDetail) = BuildApiDecodedAction(view, rawReason);
_apiGraphActionByKey[key] = decodedAction;
_apiGraphDecodedByKey[key] = decodedDetail;
string frameSummary = BuildHookFrameSummary(view, hookFields);
_apiGraphFramesByKey[key] = frameSummary;
_apiGraphSensorByKey[key] = sensorOrigin;
ApiCallStructuredFields structured = BuildApiCallStructuredFields(apiName, rawReason, decodedAction, view);
ApiCallGraphRowSnapshot snapshot = _apiGraphRowsByKey[key];
snapshot.ActionLabel = decodedAction;
snapshot.DetailFull = decodedDetail;
snapshot.CallChainLabel = frameSummary;
snapshot.ContextLabel = structured.Field2Value;
snapshot.FlagsLabel = structured.Field4Value;
ScheduleApiGraphSnapshot();
if (string.IsNullOrWhiteSpace(decodedDetail))
{
return null;
}
if (!ShouldEmitApiTimelineEvent(key, currentHits, view.TimestampUtc))
{
return null;
}
return new TelemetryEvent { TimestampUtc = view.TimestampUtc,
PID = unchecked((int)sourcePid),
TID = unchecked((int)threadId),
Group = EventDetailFormatting.HookTimelineGroup(view),
SubType = apiName,
Summary =
$"{apiName} [caller {sourcePid} target {targetPid} hits {currentHits}]",
Details = decodedDetail };
}
private bool ShouldIncludeApiGraphView(BrokerEtwEventView view)
{
return EventDetailFormatting.IsApiGraphCandidate(view);
}
private bool ShouldEmitApiTimelineEvent(string key, int hits, DateTime timestampUtc)
{
if (hits <= 1)
{
_apiGraphTimelineLastEmitByKey[key] = timestampUtc;
return true;
}
if (!_apiGraphTimelineLastEmitByKey.TryGetValue(key, out DateTime lastEmitUtc))
{
_apiGraphTimelineLastEmitByKey[key] = timestampUtc;
return true;
}
bool milestone = (hits & (hits - 1)) == 0 || (hits % 32) == 0;
bool elapsed = (timestampUtc - lastEmitUtc) >= ApiTimelineEmissionWindow;
if (!milestone && !elapsed)
{
return false;
}
_apiGraphTimelineLastEmitByKey[key] = timestampUtc;
return true;
}
private void PublishApiGraphSnapshot()
{
BackfillApiGraphFromEtwHistoryIfNeeded();
var snapshot = _apiGraphRowsByKey.Values.Select(static x => x.Clone())
.OrderByDescending(x => x.Hits)
.ThenByDescending(x => x.LastSeenUtc)
.Take(800)
.ToList();
_apiGraphSnapshotRows.Clear();
_apiGraphSnapshotRows.AddRange(snapshot);
RefreshApiViewPresentation();
}
private void BackfillApiGraphFromEtwHistoryIfNeeded()
{
if (_apiGraphRowsByKey.Count != 0)
{
return;
}
IEnumerable<GroupedEventRow> sourceGroups =
EtwPaneHost.ItemCount > 0
? EtwPaneHost.SnapshotItems()
: (_currentSession != null && _etwHistoryByPid.TryGetValue(_currentSession.Pid, out var history)
? history
: Array.Empty<GroupedEventRow>());
foreach (GroupedEventDetailRow detail in sourceGroups.SelectMany(x => x.Details))
{
ObserveApiGraphDetailFallback(detail);
}
}
private void ObserveApiGraphDetailFallback(GroupedEventDetailRow detail)
{
if (detail == null || string.IsNullOrWhiteSpace(detail.Event) || !IsLikelyApiHookDetail(detail))
{
return;
}
string apiName = detail.Event;
string sensorOrigin = detail.Source.IndexOf("kernel", StringComparison.OrdinalIgnoreCase) >= 0
? "Kernel Hook"
: detail.Source.IndexOf("hook", StringComparison.OrdinalIgnoreCase) >= 0 ||
detail.Detection.StartsWith("USERMODE_", StringComparison.OrdinalIgnoreCase)
? "Usermode Hook"
: "Unclassified";
string callerOrigin = "unknown";
string originModule = "unknown";
uint sourcePid = detail.ActorPid;
uint targetPid = detail.TargetPid != 0 ? detail.TargetPid : detail.ActorPid;
uint threadId = 0;
_ = uint.TryParse(detail.EventTid, NumberStyles.Integer, CultureInfo.InvariantCulture, out threadId);
string key =
BuildApiGraphKey(sourcePid, targetPid, threadId, apiName, sensorOrigin, callerOrigin, originModule);
if (_apiGraphRowsByKey.TryGetValue(key, out ApiCallGraphRowSnapshot? existing))
{
existing.Hits = Math.Max(1, existing.Hits + Math.Max(1, detail.HitCount));
existing.LastSeenUtc = detail.TimestampUtc;
return;
}
_apiGraphRowsByKey[key] = new ApiCallGraphRowSnapshot {
ApiName = apiName,
SensorOrigin = sensorOrigin,
CallerOrigin = callerOrigin,
OriginModule = originModule,
ActionLabel = string.IsNullOrWhiteSpace(detail.Detection) ? apiName : detail.Detection,
DetailFull = string.IsNullOrWhiteSpace(detail.Details) ? detail.ArgumentSummary : detail.Details,
CallChainLabel = string.Empty,
ContextLabel = detail.ArgumentSummary,
FlagsLabel = string.IsNullOrWhiteSpace(detail.Flags) ? detail.Access : detail.Flags,
SourcePid = sourcePid,
TargetPid = targetPid,
ThreadId = threadId,
Hits = Math.Max(1, detail.HitCount),
FirstSeenUtc = detail.TimestampUtc,
LastSeenUtc = detail.TimestampUtc
};
_apiGraphSensorByKey[key] = sensorOrigin;
}
private static bool IsLikelyApiHookDetail(GroupedEventDetailRow detail)
{
if (detail.Source.IndexOf("hook", StringComparison.OrdinalIgnoreCase) >= 0)
{
return true;
}
if (detail.Detection.StartsWith("USERMODE_", StringComparison.OrdinalIgnoreCase))
{
return !detail.Detection.Contains("INTEGRITY", StringComparison.OrdinalIgnoreCase);
}
return detail.Event.StartsWith("Nt", StringComparison.OrdinalIgnoreCase) ||
detail.Event.StartsWith("Zw", StringComparison.OrdinalIgnoreCase);
}
private bool ObserveExtendedActivity(BrokerEtwEventView view)
{
if (!TryBuildExtendedActivityRow(view, out ExtendedActivityRowSnapshot? row) || row == null)
{
return false;
}
string key = BuildExtendedActivityKey(row.TypeLabel, row.ActorLabel, row.TargetLabel, row.SubjectLabel,
row.OperationLabel);
if (_extendedRowsByKey.TryGetValue(key, out ExtendedActivityRowSnapshot? existing))
{
existing.Hits = Math.Max(1, existing.Hits + 1);
existing.LastSeenUtc = row.LastSeenUtc;
existing.LastSeenLabel = row.LastSeenLabel;
existing.DetailLabel = row.DetailLabel;
return true;
}
_extendedRowsByKey[key] = row;
return true;
}
private void ScheduleExtendedActivitySnapshot()
{
_extendedViewSnapshotDirty = true;
_extendedViewRefreshTimer.Start();
}
private void FlushExtendedActivitySnapshot()
{
if (!_extendedViewSnapshotDirty)
{
_extendedViewRefreshTimer.Stop();
return;
}
_extendedViewSnapshotDirty = false;
PublishExtendedActivitySnapshot();
}
private void PublishExtendedActivitySnapshot()
{
List<ExtendedActivityRowSnapshot> snapshot = _extendedRowsByKey.Values.Select(static x => x.Clone())
.OrderByDescending(x => x.LastSeenUtc)
.ThenByDescending(x => x.Hits)
.Take(800)
.ToList();
_extendedViewRows.ReplaceAll(snapshot);
_extendedComRows.ReplaceAll(snapshot.Where(IsExtendedComRow).ToList());
_extendedEtwRows.ReplaceAll(snapshot.Where(IsExtendedEtwRow).ToList());
_extendedJobRows.ReplaceAll(snapshot.Where(IsExtendedJobRow).ToList());
_extendedYaraRows.ReplaceAll(snapshot.Where(IsExtendedYaraRow).ToList());
if (ExtendedViewSummaryBlock != null)
{
ExtendedViewSummaryBlock.Text =
snapshot.Count == 0 ? "No extended activity yet"
: $"Activities: {snapshot.Count} / Hits: {snapshot.Sum(x => x.Hits)}";
}
}
private static bool IsExtendedComRow(ExtendedActivityRowSnapshot row)
{
return row.TypeLabel.Contains("COM", StringComparison.OrdinalIgnoreCase) ||
row.TypeLabel.Contains("WMI", StringComparison.OrdinalIgnoreCase);
}
private static bool IsExtendedEtwRow(ExtendedActivityRowSnapshot row)
{
return row.TypeLabel.Contains("ETW", StringComparison.OrdinalIgnoreCase);
}
private static bool IsExtendedJobRow(ExtendedActivityRowSnapshot row)
{
return row.TypeLabel.Contains("Job", StringComparison.OrdinalIgnoreCase);
}
private static bool IsExtendedYaraRow(ExtendedActivityRowSnapshot row)
{
return row.TypeLabel.Contains("YARA", StringComparison.OrdinalIgnoreCase) ||
row.TypeLabel.Contains("SIGMA", StringComparison.OrdinalIgnoreCase) ||
row.TypeLabel.Contains("Rules", StringComparison.OrdinalIgnoreCase);
}
private bool TryBuildExtendedActivityRow(BrokerEtwEventView view, out ExtendedActivityRowSnapshot? row)
{
row = null;
string detection = view.DetectionName ?? string.Empty;
string type;
string operation;
switch (detection)
{
case "USERMODE_COM_INIT":
type = "COM Init";
operation = "Initialize";
break;
case "USERMODE_COM_SECURITY_INIT":
type = "COM Security";
operation = "InitializeSecurity";
break;
case "USERMODE_COM_INSTANCE_CREATE":
type = "COM Activation";
operation = "CreateInstance";
break;
case "USERMODE_WMI_ACTIVITY":
type = "WMI";
operation = "Locator Activation";
break;
case "USERMODE_ETW_PROVIDER_REGISTER":
type = "ETW Provider";
operation = "Register";
break;
case "USERMODE_ETW_PROVIDER_UNREGISTER":
type = "ETW Provider";
operation = "Unregister";
break;
case "USERMODE_ETW_SESSION_CONTROL":
type = "ETW Session";
operation = "StartTrace";
break;
case "USERMODE_ETW_SUBSCRIPTION":
type = "ETW Subscription";
operation = "EnableTrace";
break;
case "USERMODE_JOB_OBJECT_ACTIVITY":
type = "Job Object";
operation = !string.IsNullOrWhiteSpace(view.EventName) ? view.EventName : "Activity";
break;
default:
if (!TryBuildGenericExtendedActivityLabels(view, out type, out operation))
{
return false;
}
break;
}
uint actorPid = ResolveExtendedActorPid(view);
uint targetPid = ResolveExtendedTargetPid(view, actorPid);
string subject = ExtractExtendedSubject(view);
row = new ExtendedActivityRowSnapshot { TypeLabel = type,
ActorLabel = FormatApiProcessLabel(actorPid),
TargetLabel = FormatApiProcessLabel(targetPid),
SubjectLabel = subject,
OperationLabel = operation,
DetailLabel =
FirstNonBlank(view.Reason, view.ArgumentSummary, view.Details),
LastSeenUtc = view.TimestampUtc,
LastSeenLabel = FormatApiRelativeAge(view.TimestampUtc),
Hits = 1 };
return true;
}
private static bool TryBuildGenericExtendedActivityLabels(BrokerEtwEventView view, out string type,
out string operation)
{
type = view.Family switch { BlackbirdNative.IpcEtwFamilyHandle => "Handle",
BlackbirdNative.IpcEtwFamilyThread => "Thread",
BlackbirdNative.IpcEtwFamilyProcess => "Process",
BlackbirdNative.IpcEtwFamilyImage => "Image",
BlackbirdNative.IpcEtwFamilyRegistry => "Registry",
BlackbirdNative.IpcEtwFamilyApc => "APC",
BlackbirdNative.IpcEtwFamilyDetection => "Detection",
BlackbirdNative.IpcEtwFamilyThreatIntel => "Threat Intel",
BlackbirdNative.IpcEtwFamilySocket => "Socket",
BlackbirdNative.IpcEtwFamilyUserHook => "API",
_ => string.IsNullOrWhiteSpace(view.Source) ? string.Empty : view.Source };
operation = FirstNonBlank(view.Operation, view.EventName, view.DetectionName, "Activity");
if (string.IsNullOrWhiteSpace(type))
{
return false;
}
return view.Family == BlackbirdNative.IpcEtwFamilyUserHook ||
view.Family == BlackbirdNative.IpcEtwFamilySocket ||
view.Family == BlackbirdNative.IpcEtwFamilyRegistry ||
view.Family == BlackbirdNative.IpcEtwFamilyImage ||
view.Family == BlackbirdNative.IpcEtwFamilyProcess ||
view.Family == BlackbirdNative.IpcEtwFamilyThread ||
view.Family == BlackbirdNative.IpcEtwFamilyHandle ||
!string.IsNullOrWhiteSpace(view.DetectionName) || view.Severity >= 2;
}
private static uint ResolveExtendedActorPid(BrokerEtwEventView view) =>
FirstNonZero(view.ActorPid, view.CallerPid, view.CreatorPid, view.ProcessPid, view.EventProcessId);
private static uint ResolveExtendedTargetPid(BrokerEtwEventView view, uint actorPid) =>
FirstNonZero(view.TargetPid, view.ExplicitTargetPid, view.ProcessPid, view.EventProcessId, actorPid);
private static string ExtractExtendedSubject(BrokerEtwEventView view)
{
string reason = view.Reason ?? string.Empty;
string[] tokens = new[] { "class=", "provider=", "name=", "mode=", "class=" };
foreach (string token in tokens)
{
int start = reason.IndexOf(token, StringComparison.OrdinalIgnoreCase);
if (start < 0)
{
continue;
}
start += token.Length;
int end = reason.IndexOf(' ', start);
if (end < 0)
{
end = reason.Length;
}
string value = reason.Substring(start, end - start).Trim();
if (!string.IsNullOrWhiteSpace(value))
{
return value;
}
}
return FirstNonBlank(view.KeyPath, view.ValueName, view.ImagePath, view.OriginPath, view.CommandLine,
view.ClassName, view.ArgumentSummary, view.EventName, view.DetectionName);
}
private static uint FirstNonZero(params uint[] values)
{
foreach (uint value in values)
{
if (value != 0)
{
return value;
}
}
return 0;
}
private static string FirstNonBlank(params string?[] values)
{
foreach (string? value in values)
{
if (!string.IsNullOrWhiteSpace(value))
{
return value.Trim();
}
}
return string.Empty;
}
private static string BuildExtendedActivityKey(string type, string actor, string target, string subject,
string operation)
{
return string.Join("|", type, actor, target, subject, operation);
}
private void RefreshApiViewPresentation()
{
string? selectedKey = (ApiViewDataGrid?.SelectedItem as ApiCallGraphMainRowView)?.GraphKey;
bool apiViewVisible = _mainViewMode == MainInterfaceViewMode.Api && ApiViewBorder != null &&
ApiViewBorder.Visibility == Visibility.Visible;
List<ApiCallGraphMainRowView> sourceRows =
_apiViewPresentationMode == ApiViewPresentationMode.ThreadTimeline
? BuildApiThreadTimelineRows(_apiGraphSnapshotRows)
: BuildApiCallGraphRows(_apiGraphSnapshotRows);
_apiViewSnapshotRows.Clear();
_apiViewSnapshotRows.AddRange(sourceRows);
List<ApiCallGraphMainRowView> filteredRows = ApplyApiViewFilters(sourceRows);
_apiViewRows.ReplaceAll(filteredRows);
if (ApiViewSummaryBlock != null)
{
string noun =
_apiViewPresentationMode == ApiViewPresentationMode.ThreadTimeline ? "Thread/API Rows" : "Patterns";
ApiViewSummaryBlock.Text =
sourceRows.Count == 0 ? "No API hook data yet"
: filteredRows.Count == sourceRows.Count
? $"{noun}: {filteredRows.Count} / Calls: {filteredRows.Sum(x => x.Hits)}"
: $"{noun}: {filteredRows.Count}/{sourceRows.Count} / Calls: {filteredRows.Sum(x => x.Hits)}";
}
if (apiViewVisible && ApiViewGraphCanvas != null)
{
RenderApiPresentationCanvas(filteredRows, selectedKey);
}
DiagnosticsState.SetValue(
"API Graph",
$"{(_apiViewPresentationMode == ApiViewPresentationMode.ThreadTimeline ? "threads" : "patterns")}={filteredRows.Count}/{sourceRows.Count} visible={apiViewVisible}");
if (ApiViewDataGrid != null)
{
ApiCallGraphMainRowView? selected = null;
if (!string.IsNullOrWhiteSpace(selectedKey))
{
selected = _apiViewRows.FirstOrDefault(
x => string.Equals(x.GraphKey, selectedKey, StringComparison.Ordinal));
}
if (selected == null && _apiViewRows.Count > 0)
{
selected = _apiViewRows[0];
}
ApiViewDataGrid.SelectedItem = selected;
UpdateApiViewSelection(selected);
}
}
private void RefreshApiGraphSelectionVisual()
{
if (_mainViewMode != MainInterfaceViewMode.Api || ApiViewBorder == null ||
ApiViewBorder.Visibility != Visibility.Visible || ApiViewGraphCanvas == null)
{
return;
}
string? selectedKey = (ApiViewDataGrid?.SelectedItem as ApiCallGraphMainRowView)?.GraphKey;
List<ApiCallGraphMainRowView> filteredRows = ApplyApiViewFilters(_apiViewSnapshotRows);
RenderApiPresentationCanvas(filteredRows, selectedKey);
}
private List<ApiCallGraphMainRowView> BuildApiCallGraphRows(IReadOnlyList<ApiCallGraphRowSnapshot> snapshot)
{
int maxHits = Math.Max(1, snapshot.Count == 0 ? 1 : snapshot.Max(x => Math.Max(1, x.Hits)));
var rows = new List<ApiCallGraphMainRowView>(snapshot.Count);
foreach (ApiCallGraphRowSnapshot row in snapshot)
{
uint target = row.TargetPid != 0 ? row.TargetPid : row.SourcePid;
string sensor = string.IsNullOrWhiteSpace(row.SensorOrigin) ? "Unclassified" : row.SensorOrigin;
string callerOrigin = NormalizeApiCallerOrigin(row.CallerOrigin);
string originModule = NormalizeApiOriginModule(row.OriginModule);
string key = BuildApiGraphKey(row.SourcePid, row.TargetPid, row.ThreadId, row.ApiName, sensor,
callerOrigin, originModule);
double heatPercent = Math.Clamp((row.Hits / (double)maxHits) * 100.0, 0.0, 100.0);
rows.Add(new ApiCallGraphMainRowView {
GraphKey = key,
ThreadGroupKey = $"{row.SourcePid}|{row.ThreadId}",
ViewModeKey = "call",
ApiName = string.IsNullOrWhiteSpace(row.ApiName) ? "unknown" : row.ApiName,
OriginModule = originModule,
ActionLabel = row.ActionLabel,
SensorLabel = sensor,
CallerOriginKey = callerOrigin,
CallerOriginLabel = GetApiCallerOriginDisplayLabel(callerOrigin, sensor),
CallChainLabel = row.CallChainLabel,
CallerOriginBackground = BuildApiCallerOriginBackground(callerOrigin),
CallerOriginForeground = BuildApiCallerOriginForeground(callerOrigin),
SensorBackground = BuildApiSensorBackground(sensor),
SensorForeground = BuildApiSensorForeground(sensor),
HeatTrackBackground = BuildApiHeatTrackBackground(sensor, callerOrigin),
HeatFillBackground = BuildApiHeatFillBackground(sensor, callerOrigin),
RowBackground = BuildApiRowBackground(sensor, callerOrigin),
RowBorderBrush = BuildApiRowBorder(sensor, callerOrigin),
SourceLabel = FormatApiProcessLabel(row.SourcePid),
TargetLabel = FormatApiProcessLabel(target),
ThreadLabel =
row.ThreadId == 0 ? string.Empty : row.ThreadId.ToString(CultureInfo.InvariantCulture),
SizeLabel = row.ContextLabel,
ProtectLabel = row.FlagsLabel,
Field2Label = "Context",
Field4Label = "Flags",
Hits = Math.Max(1, row.Hits),
HeatPercent = heatPercent,
ActivityFillWidth = Math.Round((heatPercent / 100.0) * 110.0),
FirstSeen = FormatApiRelativeAge(row.FirstSeenUtc),
AbsoluteFirstSeen = row.FirstSeenUtc == default
? string.Empty
: row.FirstSeenUtc.ToLocalTime().ToString("yyyy-MM-dd HH:mm:ss.fff",
CultureInfo.InvariantCulture),
FirstSeenUtc = row.FirstSeenUtc,
LastSeen = FormatApiRelativeAge(row.LastSeenUtc),
AbsoluteLastSeen = row.LastSeenUtc == default
? string.Empty
: row.LastSeenUtc.ToLocalTime().ToString("yyyy-MM-dd HH:mm:ss.fff",
CultureInfo.InvariantCulture),
LastSeenUtc = row.LastSeenUtc,
DetailFull = row.DetailFull
});
}
return rows;
}
private List<ApiCallGraphMainRowView>
BuildApiThreadTimelineRows(IReadOnlyList<ApiCallGraphRowSnapshot> snapshot)
{
var groups =
snapshot
.GroupBy(
row =>
$"{row.SourcePid}|{row.TargetPid}|{row.ThreadId}|{NormalizeApiOriginModule(row.OriginModule)}|{row.ApiName}",
StringComparer.Ordinal)
.Select(
group =>
{
ApiCallGraphRowSnapshot latest = group.OrderByDescending(x => x.LastSeenUtc).First();
int hits = group.Sum(x => Math.Max(1, x.Hits));
DateTime firstSeenUtc = group.Where(x => x.FirstSeenUtc != default)
.Select(x => x.FirstSeenUtc)
.DefaultIfEmpty(latest.LastSeenUtc)
.Min();
DateTime lastSeenUtc = group.Max(x => x.LastSeenUtc);
string sensor =
group.Select(x => x.SensorOrigin).FirstOrDefault(x => !string.IsNullOrWhiteSpace(x)) ??
"Unclassified";
string callerOrigin = NormalizeApiCallerOrigin(latest.CallerOrigin);
string originModule = NormalizeApiOriginModule(latest.OriginModule);
return new {
Key =
$"thread|{latest.SourcePid}|{latest.TargetPid}|{latest.ThreadId}|{originModule}|{latest.ApiName}",
ThreadGroupKey = $"{latest.SourcePid}|{latest.ThreadId}",
Latest = latest,
Hits = hits,
FirstSeenUtc = firstSeenUtc,
LastSeenUtc = lastSeenUtc,
Sensor = sensor,
CallerOrigin = callerOrigin,
OriginModule = originModule,
OperationSummary = BuildApiOperationSummary(group)
};
})
.OrderBy(x => x.ThreadGroupKey, StringComparer.Ordinal)
.ThenBy(x => x.FirstSeenUtc)
.ThenBy(x => x.LastSeenUtc)
.Take(600)
.ToList();
int maxHits = Math.Max(1, groups.Count == 0 ? 1 : groups.Max(x => Math.Max(1, x.Hits)));
var rows = new List<ApiCallGraphMainRowView>(groups.Count);
foreach (var group in groups)
{
ApiCallGraphRowSnapshot row = group.Latest;
uint target = row.TargetPid != 0 ? row.TargetPid : row.SourcePid;
double heatPercent = Math.Clamp((group.Hits / (double)maxHits) * 100.0, 0.0, 100.0);
string threadLabel =
BuildThreadTimelineLabel(row.SourcePid, row.ThreadId, group.FirstSeenUtc, group.LastSeenUtc);
rows.Add(new ApiCallGraphMainRowView {
GraphKey = group.Key,
ThreadGroupKey = group.ThreadGroupKey,
ViewModeKey = "thread",
ApiName = string.IsNullOrWhiteSpace(row.ApiName) ? "unknown" : row.ApiName,
OriginModule = group.OriginModule,
ActionLabel = string.IsNullOrWhiteSpace(row.ActionLabel) ? "Call activity" : row.ActionLabel,
SensorLabel = group.Sensor,
CallerOriginKey = group.CallerOrigin,
CallerOriginLabel = GetApiCallerOriginDisplayLabel(group.CallerOrigin, group.Sensor),
CallChainLabel = BuildThreadTimelineCallChain(row, group.FirstSeenUtc, group.LastSeenUtc),
CallerOriginBackground = BuildApiCallerOriginBackground(group.CallerOrigin),
CallerOriginForeground = BuildApiCallerOriginForeground(group.CallerOrigin),
SensorBackground = BuildApiSensorBackground(group.Sensor),
SensorForeground = BuildApiSensorForeground(group.Sensor),
HeatTrackBackground = BuildApiHeatTrackBackground(group.Sensor, group.CallerOrigin),
HeatFillBackground = BuildApiHeatFillBackground(group.Sensor, group.CallerOrigin),
RowBackground = BuildApiRowBackground(group.Sensor, group.CallerOrigin),
RowBorderBrush = BuildApiRowBorder(group.Sensor, group.CallerOrigin),
SourceLabel = FormatApiProcessLabel(row.SourcePid),
TargetLabel = FormatApiProcessLabel(target),
ThreadLabel = threadLabel,
SizeLabel = group.OriginModule,
ProtectLabel = group.OperationSummary,
Field2Label = "Module",
Field4Label = "Ops",
Hits = group.Hits,
HeatPercent = heatPercent,
ActivityFillWidth = Math.Round((heatPercent / 100.0) * 110.0),
FirstSeen = FormatApiRelativeAge(group.FirstSeenUtc),
AbsoluteFirstSeen = group.FirstSeenUtc == default
? string.Empty
: group.FirstSeenUtc.ToLocalTime().ToString("yyyy-MM-dd HH:mm:ss.fff",
CultureInfo.InvariantCulture),
FirstSeenUtc = group.FirstSeenUtc,
LastSeen = FormatApiRelativeAge(group.LastSeenUtc),
AbsoluteLastSeen = group.LastSeenUtc == default
? string.Empty
: group.LastSeenUtc.ToLocalTime().ToString("yyyy-MM-dd HH:mm:ss.fff",
CultureInfo.InvariantCulture),
LastSeenUtc = group.LastSeenUtc,
DetailFull = BuildThreadTimelineDetail(row, group.FirstSeenUtc, group.LastSeenUtc, group.Hits,
group.OriginModule, group.OperationSummary)
});
}
return rows;
}
private void RenderApiPresentationCanvas(IReadOnlyList<ApiCallGraphMainRowView> rows, string? selectedKey)
{
if (_apiViewPresentationMode == ApiViewPresentationMode.ThreadTimeline)
{
RenderApiThreadTimelineCanvas(rows, selectedKey);
return;
}
var byKey = rows.ToDictionary(x => x.GraphKey, StringComparer.Ordinal);
List<ApiCallGraphRowSnapshot> snapshot =
_apiGraphSnapshotRows
.Where(x => byKey.ContainsKey(BuildApiGraphKey(
x.SourcePid, x.TargetPid, x.ThreadId, x.ApiName,
string.IsNullOrWhiteSpace(x.SensorOrigin) ? "Unclassified" : x.SensorOrigin,
NormalizeApiCallerOrigin(x.CallerOrigin), NormalizeApiOriginModule(x.OriginModule))))
.OrderByDescending(x => x.Hits)
.ThenByDescending(x => x.LastSeenUtc)
.ToList();
RenderApiGraphCanvas(snapshot, selectedKey);
}
private string BuildThreadTimelineLabel(uint pid, uint threadId, DateTime firstSeenUtc, DateTime lastSeenUtc)
{
string tid = threadId == 0 ? "T?" : $"T{threadId}";
string lifetime = BuildThreadLifetimeSummary(pid, threadId, firstSeenUtc, lastSeenUtc);
return string.IsNullOrWhiteSpace(lifetime) ? tid : $"{tid} · {lifetime}";
}
private string BuildThreadLifetimeSummary(uint pid, uint threadId, DateTime firstSeenUtc, DateTime lastSeenUtc)
{
if (_currentSession == null || threadId == 0)
{
return firstSeenUtc != default && lastSeenUtc > firstSeenUtc
? $"{(lastSeenUtc - firstSeenUtc).TotalSeconds:0.0}s"
: string.Empty;
}
IEnumerable<ThreadLifecycleEventSample> history =
_currentSession.ThreadLifecycleHistory.Where(x => x.ProcessPid == pid && x.ThreadId == threadId)
.OrderBy(x => x.TimestampUtc);
ThreadLifecycleEventSample? start =
history.FirstOrDefault(x => x.EventKind.Equals("Start", StringComparison.OrdinalIgnoreCase));
ThreadLifecycleEventSample? exit =
history.LastOrDefault(x => x.EventKind.Equals("Exit", StringComparison.OrdinalIgnoreCase));
DateTime startUtc = start?.TimestampUtc ?? firstSeenUtc;
DateTime endUtc = exit?.TimestampUtc ?? lastSeenUtc;
if (startUtc == default || endUtc == default || endUtc < startUtc)
{
return string.Empty;
}
string state = exit == null ? "live" : "exited";
return $"{(endUtc - startUtc).TotalSeconds:0.0}s {state}";
}
private static string BuildApiOperationSummary(IEnumerable<ApiCallGraphRowSnapshot> rows)
{
int query = 0, write = 0, exec = 0, map = 0, open = 0;
foreach (ApiCallGraphRowSnapshot row in rows)
{
string text = $"{row.ApiName} {row.ActionLabel} {row.DetailFull}".ToLowerInvariant();
int weight = Math.Max(1, row.Hits);
if (text.Contains("query") || text.Contains("read"))
query += weight;
if (text.Contains("write") || text.Contains("patch") || text.Contains("protect"))
write += weight;
if (text.Contains("thread") || text.Contains("apc") || text.Contains("execute"))
exec += weight;
if (text.Contains("map") || text.Contains("section") || text.Contains("image"))
map += weight;
if (text.Contains("open") || text.Contains("handle") || text.Contains("token"))
open += weight;
}
var parts = new List<string>(5);
if (query != 0)
parts.Add($"query:{query}");
if (write != 0)
parts.Add($"write:{write}");
if (exec != 0)
parts.Add($"exec:{exec}");
if (map != 0)
parts.Add($"map:{map}");
if (open != 0)
parts.Add($"open:{open}");
return parts.Count == 0 ? "mixed" : string.Join(" ", parts);
}
private string BuildThreadTimelineCallChain(ApiCallGraphRowSnapshot row, DateTime firstSeenUtc,
DateTime lastSeenUtc)
{
string module = NormalizeApiOriginModule(row.OriginModule);
string first = firstSeenUtc == default
? string.Empty
: firstSeenUtc.ToLocalTime().ToString("HH:mm:ss.fff", CultureInfo.InvariantCulture);
string last = lastSeenUtc == default
? string.Empty
: lastSeenUtc.ToLocalTime().ToString("HH:mm:ss.fff", CultureInfo.InvariantCulture);
string summary = $"Module {module}";
if (first.Length != 0 || last.Length != 0)
{
summary += $"{Environment.NewLine}Window {first} -> {last}";
}
if (!string.IsNullOrWhiteSpace(row.CallChainLabel))
{
summary += $"{Environment.NewLine}{Environment.NewLine}{row.CallChainLabel}";
}
return summary.Trim();
}
private string BuildThreadTimelineDetail(ApiCallGraphRowSnapshot row, DateTime firstSeenUtc,
DateTime lastSeenUtc, int hits, string originModule,
string operationSummary)
{
var sb = new StringBuilder(512);
sb.AppendLine($"API: {row.ApiName}");
sb.AppendLine($"Module: {originModule}");
sb.AppendLine($"Hits: {hits.ToString(CultureInfo.InvariantCulture)}");
if (firstSeenUtc != default)
sb.AppendLine($"First Seen: {firstSeenUtc.ToLocalTime():yyyy-MM-dd HH:mm:ss.fff}");
if (lastSeenUtc != default)
sb.AppendLine($"Last Seen: {lastSeenUtc.ToLocalTime():yyyy-MM-dd HH:mm:ss.fff}");
sb.AppendLine($"Ops: {operationSummary}");
if (!string.IsNullOrWhiteSpace(row.ActionLabel))
sb.AppendLine().AppendLine(row.ActionLabel);
if (!string.IsNullOrWhiteSpace(row.DetailFull))
sb.AppendLine().Append(row.DetailFull.Trim());
return sb.ToString().TrimEnd();
}
private void RenderApiThreadTimelineCanvas(IReadOnlyList<ApiCallGraphMainRowView> rows, string? selectedKey)
{
if (ApiViewGraphCanvas == null)
{
return;
}
ApiViewGraphCanvas.Children.Clear();
if (rows.Count == 0)
{
ApiViewGraphCanvas.Width = 540;
ApiViewGraphCanvas.Height = 240;
var empty =
new TextBlock { Text = "No thread timeline yet",
Foreground = (System.Windows.Media.Brush)FindResource("WinMutedTextBrush") };
Canvas.SetLeft(empty, 16);
Canvas.SetTop(empty, 16);
ApiViewGraphCanvas.Children.Add(empty);
return;
}
DateTime minUtc = rows.Where(x => x.FirstSeenUtc != default)
.Select(x => x.FirstSeenUtc)
.DefaultIfEmpty(rows.Min(x => x.LastSeenUtc))
.Min();
DateTime maxUtc = rows.Select(x => x.LastSeenUtc).DefaultIfEmpty(minUtc).Max();
if (maxUtc <= minUtc)
{
maxUtc = minUtc.AddSeconds(1);
}
var lanes =
rows.GroupBy(x => x.ThreadGroupKey, StringComparer.Ordinal)
.Select(g => new { ThreadGroupKey = g.Key,
Rows = g.OrderBy(x => x.FirstSeenUtc == default ? x.LastSeenUtc : x.FirstSeenUtc)
.ThenBy(x => x.LastSeenUtc)
.ThenByDescending(x => x.Hits)
.Take(14)
.ToList(),
Hits = g.Sum(x => x.Hits), Label = g.First().ThreadLabel,
First = g.Where(x => x.FirstSeenUtc != default)
.Select(x => x.FirstSeenUtc)
.DefaultIfEmpty(g.Min(x => x.LastSeenUtc))
.Min(),
Last = g.Select(x => x.LastSeenUtc).DefaultIfEmpty(minUtc).Max() })
.OrderBy(x => x.First)
.ThenBy(x => x.ThreadGroupKey, StringComparer.Ordinal)
.Take(24)
.ToList();
double left = 132;
double right = 22;
double top = 34;
double rowHeight = 22;
double laneHeaderHeight = 24;
double laneGap = 10;
double durationSeconds = Math.Max(1, (maxUtc - minUtc).TotalSeconds);
double canvasWidth = Math.Max(920, Math.Min(2400, left + right + (durationSeconds * 90)));
double width = canvasWidth - left - right;
double canvasHeight = Math.Max(
260, top + lanes.Sum(x => laneHeaderHeight + Math.Max(1, x.Rows.Count) * rowHeight + laneGap) + 24);
ApiViewGraphCanvas.Width = canvasWidth;
ApiViewGraphCanvas.Height = canvasHeight;
double ToX(DateTime utc) =>
left + ((utc - minUtc).TotalMilliseconds / (maxUtc - minUtc).TotalMilliseconds) * width;
var axis = new System.Windows.Shapes.Line { X1 = left,
X2 = left + width,
Y1 = top - 10,
Y2 = top - 10,
Stroke = (System.Windows.Media.Brush)FindResource(
"WinSubtleBorderBrush"),
StrokeThickness = 1 };
ApiViewGraphCanvas.Children.Add(axis);
int tickCount = Math.Min(6, Math.Max(2, (int)Math.Ceiling(width / 220.0)));
for (int tick = 0; tick <= tickCount; tick += 1)
{
double ratio = tick / (double)tickCount;
DateTime tickUtc = minUtc.AddMilliseconds((maxUtc - minUtc).TotalMilliseconds * ratio);
double x = left + width * ratio;
var tickLine = new System.Windows.Shapes.Line {
X1 = x,
X2 = x,
Y1 = top - 14,
Y2 = canvasHeight - 18,
Stroke = (System.Windows.Media.Brush)FindResource("WinSubtleBorderBrush"),
StrokeThickness = 1,
Opacity = tick == 0 || tick == tickCount ? 0.55 : 0.22
};
ApiViewGraphCanvas.Children.Add(tickLine);
var tickLabel =
new TextBlock { Text = tickUtc.ToLocalTime().ToString("HH:mm:ss", CultureInfo.InvariantCulture),
Foreground = (System.Windows.Media.Brush)FindResource("WinMutedTextBrush"),
FontSize = 10 };
Canvas.SetLeft(tickLabel, Math.Max(left, Math.Min(left + width - 54, x - 22)));
Canvas.SetTop(tickLabel, 4);
ApiViewGraphCanvas.Children.Add(tickLabel);
}
double yCursor = top;
for (int i = 0; i < lanes.Count; i += 1)
{
double y = yCursor;
double laneBlockHeight = laneHeaderHeight + Math.Max(1, lanes[i].Rows.Count) * rowHeight;
var label = new TextBlock { Text = lanes[i].Label, Width = left - 18,
TextTrimming = TextTrimming.CharacterEllipsis,
Foreground = (System.Windows.Media.Brush)FindResource("WinTextBrush"),
FontWeight = FontWeights.SemiBold };
Canvas.SetLeft(label, 8);
Canvas.SetTop(label, y + 2);
ApiViewGraphCanvas.Children.Add(label);
var laneBackground = new System.Windows.Shapes.Rectangle {
Width = width,
Height = laneBlockHeight,
Fill = System.Windows.Media.Brushes.Transparent,
Stroke = (System.Windows.Media.Brush)FindResource("WinSubtleBorderBrush"),
StrokeThickness = 1,
Opacity = 0.7
};
Canvas.SetLeft(laneBackground, left);
Canvas.SetTop(laneBackground, y);
ApiViewGraphCanvas.Children.Add(laneBackground);
for (int rowIndex = 0; rowIndex < lanes[i].Rows.Count; rowIndex += 1)
{
ApiCallGraphMainRowView row = lanes[i].Rows[rowIndex];
double rowY = y + laneHeaderHeight + rowIndex * rowHeight;
double x1 = ToX(row.FirstSeenUtc == default ? row.LastSeenUtc : row.FirstSeenUtc);
double x2 = ToX(row.LastSeenUtc);
if (x2 < x1)
{
(x1, x2) = (x2, x1);
}
double markerWidth = Math.Max(8, Math.Min(168, x2 - x1 + Math.Min(24, row.Hits * 1.6)));
bool selected = string.Equals(row.GraphKey, selectedKey, StringComparison.Ordinal);
var border = new Border {
Width = markerWidth,
Height = 18,
CornerRadius = new CornerRadius(4),
Background = row.HeatFillBackground,
BorderBrush = row.RowBorderBrush,
BorderThickness = new Thickness(selected ? 2 : 1),
Opacity = selected ? 1.0 : 0.88,
Child = new TextBlock { Text = $"{row.ApiName} [{row.OriginModule}]",
Margin = new Thickness(6, 1, 6, 0),
Foreground = (System.Windows.Media.Brush)FindResource("WinTextBrush"),
FontSize = 11, TextTrimming = TextTrimming.CharacterEllipsis }
};
Canvas.SetLeft(border, x1);
Canvas.SetTop(border, rowY + 1);
ApiViewGraphCanvas.Children.Add(border);
}
yCursor += laneBlockHeight + laneGap;
}
}
private void EnsureEtwDisplayDetails(BrokerEtwEventView view)
{
if (!string.IsNullOrWhiteSpace(view.DisplayDetails))
{
return;
}
view.DisplayDetails = BuildEtwDisplayDetail(view);
}
private List<ApiCallGraphMainRowView> ApplyApiViewFilters(IEnumerable<ApiCallGraphMainRowView> rows)
{
string callFilter = (ApiFilterCallBox?.Text ?? string.Empty).Trim();
string actionFilter = (ApiFilterActionBox?.Text ?? string.Empty).Trim();
string sensorFilter =
((ApiFilterSensorBox?.SelectedItem as ComboBoxItem)?.Content as string ?? "All Sensors").Trim();
string originFilter =
((ApiFilterOriginBox?.SelectedItem as ComboBoxItem)?.Content as string ?? "All Origins").Trim();
string callerFilter = (ApiFilterCallerBox?.Text ?? string.Empty).Trim();
string targetFilter = (ApiFilterTargetBox?.Text ?? string.Empty).Trim();
string threadFilter = (ApiFilterThreadBox?.Text ?? string.Empty).Trim();
string regionFilter = (ApiFilterRegionBox?.Text ?? string.Empty).Trim();
string protectFilter = (ApiFilterProtectBox?.Text ?? string.Empty).Trim();
string minHitsFilter = (ApiFilterMinHitsBox?.Text ?? string.Empty).Trim();
int minHits = 0;
_ = int.TryParse(minHitsFilter, NumberStyles.Integer, CultureInfo.InvariantCulture, out minHits);
bool Matches(string candidate, string filter) =>
string.IsNullOrWhiteSpace(filter) || (!string.IsNullOrWhiteSpace(candidate) &&
candidate.Contains(filter, StringComparison.OrdinalIgnoreCase));
bool MatchesSensor(string candidate) =>
string.IsNullOrWhiteSpace(sensorFilter) ||
sensorFilter.Equals("All Sensors", StringComparison.OrdinalIgnoreCase) ||
string.Equals(candidate, sensorFilter, StringComparison.OrdinalIgnoreCase);
bool MatchesOrigin(string candidate) =>
string.IsNullOrWhiteSpace(originFilter) ||
originFilter.Equals("All Origins", StringComparison.OrdinalIgnoreCase) ||
string.Equals(candidate, originFilter, StringComparison.OrdinalIgnoreCase);
return rows
.Where(row =>
Matches(row.ApiName, callFilter) && Matches(row.ActionLabel, actionFilter) &&
MatchesSensor(row.SensorLabel) && MatchesOrigin(row.CallerOriginLabel) &&
Matches(row.SourceLabel, callerFilter) && Matches(row.TargetLabel, targetFilter) &&
Matches(row.ThreadLabel, threadFilter) &&
(Matches(row.BaseLabel, regionFilter) || Matches(row.SizeLabel, regionFilter) ||
Matches(row.AllocTypeLabel, regionFilter) || Matches(row.ProtectLabel, regionFilter)) &&
(Matches(row.ProtectLabel, protectFilter) || Matches(row.AllocTypeLabel, protectFilter)) &&
row.Hits >= Math.Max(0, minHits))
.OrderByDescending(x => x.Hits)
.ThenByDescending(x => x.LastSeen, StringComparer.Ordinal)
.ToList();
}
private ApiCallStructuredFields BuildApiCallStructuredFields(string apiName, string rawReason,
string decodedAction, BrokerEtwEventView? view)
{
Dictionary<string, string> fields = ParseReasonFields(rawReason);
string action = SummarizeApiReason(decodedAction);
string field1Label = "Base";
string field2Label = "Context";
string field3Label = "Alloc Type";
string field4Label = "Flags";
string field1Value = string.Empty;
string field2Value = string.Empty;
string field3Value = string.Empty;
string field4Value = string.Empty;
if (apiName.Equals("NtAllocateVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
ulong baseAddress = FirstU64(fields, "base", "c0", "a1");
ulong regionSize = FirstU64(fields, "size", "c1", "a3");
uint allocationType = (uint)FirstU64(fields, "allocType", "c2", "a4");
uint protect = (uint)FirstU64(fields, "protect", "c3", "a5");
field1Value = FormatObservedPointer(view, baseAddress);
field2Value =
regionSize == 0
? string.Empty
: $"base={(baseAddress == 0 ? "?" : FormatObservedPointer(view, baseAddress))} size=0x{regionSize:X}";
field3Value = allocationType == 0
? string.Empty
: $"0x{allocationType:X} {DescribeMemoryAllocationType(allocationType)}";
field4Value = protect == 0 ? string.Empty : $"0x{protect:X} {DescribeMemoryProtect(protect)}";
}
else if (apiName.Equals("NtProtectVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
ulong baseAddress = FirstU64(fields, "base", "c0", "a1");
ulong regionSize = FirstU64(fields, "size", "c1", "a2");
uint protect = (uint)FirstU64(fields, "newProtect", "c2", "a3");
field1Value = FormatObservedPointer(view, baseAddress);
field2Value =
regionSize == 0
? string.Empty
: $"base={(baseAddress == 0 ? "?" : FormatObservedPointer(view, baseAddress))} size=0x{regionSize:X}";
field4Value = protect == 0 ? string.Empty : $"0x{protect:X} {DescribeMemoryProtect(protect)}";
}
else if (apiName.Equals("NtWriteVirtualMemory", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("NtReadVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
ulong baseAddress = FirstU64(fields, "base", "c0", "a1");
ulong regionSize = FirstU64(fields, "size", "c1", "a3");
field1Value = FormatObservedPointer(view, baseAddress);
field2Value =
regionSize == 0
? string.Empty
: $"base={(baseAddress == 0 ? "?" : FormatObservedPointer(view, baseAddress))} size=0x{regionSize:X}";
}
else if (apiName.Equals("LdrLoadDll", StringComparison.OrdinalIgnoreCase) ||
apiName.StartsWith("LoadLibrary", StringComparison.OrdinalIgnoreCase))
{
field1Label = "Module";
field2Label = "Context";
field3Label = "Flags";
field4Label = "Result";
field1Value = DecodeModuleHookName(apiName, view);
ulong handle = FirstU64(fields, "handle");
ulong flags = FirstU64(fields, "flags");
ulong status = FirstU64(fields, "status");
field2Value = handle == 0 ? (string.IsNullOrWhiteSpace(field1Value) ? string.Empty : field1Value)
: $"{field1Value} handle=0x{handle:X}".Trim();
field3Value = flags == 0 ? "0x0" : $"0x{flags:X}";
field4Value =
apiName.Equals("LdrLoadDll", StringComparison.OrdinalIgnoreCase) ? $"0x{status:X8}" : string.Empty;
}
else if (apiName.Equals("RtlAddFunctionTable", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("RtlInstallFunctionTableCallback", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("RtlDeleteFunctionTable", StringComparison.OrdinalIgnoreCase))
{
field1Label = "Base";
field2Label = "Context";
field3Label = "Length";
field4Label = "Callback";
ulong baseAddress = FirstU64(fields, "baseAddress", "a2", "a1");
ulong length = FirstU64(fields, "length", "a2");
ulong callback = FirstU64(fields, "callback", "a3");
field1Value = FormatObservedPointer(view, baseAddress);
field2Value = apiName.Equals("RtlDeleteFunctionTable", StringComparison.OrdinalIgnoreCase)
? $"table={FormatObservedPointer(view, FirstU64(fields, "table", "a0"))}"
: $"table={FormatObservedPointer(view, FirstU64(fields, "tableId", "table", "a0"))}";
field3Value = length == 0 ? string.Empty : $"0x{length:X}";
field4Value = FormatObservedPointer(view, callback);
}
return new ApiCallStructuredFields { Action = string.IsNullOrWhiteSpace(action) ? apiName : action,
Field1Label = field1Label,
Field2Label = field2Label,
Field3Label = field3Label,
Field4Label = field4Label,
Field1Value = field1Value,
Field2Value = field2Value,
Field3Value = field3Value,
Field4Value = field4Value };
}
private static string DecodeModuleHookName(string apiName, BrokerEtwEventView? view)
{
if (view == null || view.DeepSample == null || view.DeepSample.Length == 0 || view.DeepSampleSize == 0)
{
return string.Empty;
}
int sampleSize = Math.Min(view.DeepSample.Length, (int)view.DeepSampleSize);
if (sampleSize <= 0)
{
return string.Empty;
}
if (apiName.Equals("LoadLibraryA", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("LoadLibraryExA", StringComparison.OrdinalIgnoreCase))
{
int zeroIndex = Array.IndexOf(view.DeepSample, (byte)0, 0, sampleSize);
int length = zeroIndex >= 0 ? zeroIndex : sampleSize;
return length > 0 ? Encoding.ASCII.GetString(view.DeepSample, 0, length).Trim() : string.Empty;
}
int byteLength = sampleSize & ~1;
if (byteLength <= 0)
{
return string.Empty;
}
string decoded = Encoding.Unicode.GetString(view.DeepSample, 0, byteLength);
int nul = decoded.IndexOf('\0');
if (nul >= 0)
{
decoded = decoded[..nul];
}
return decoded.Trim();
}
private void RenderApiGraphCanvas(IReadOnlyList<ApiCallGraphRowSnapshot> rows, string? selectedKey)
{
if (ApiViewGraphCanvas == null)
{
return;
}
ApiViewGraphCanvas.Children.Clear();
if (rows.Count == 0)
{
ApiViewGraphCanvas.Width = 540;
ApiViewGraphCanvas.Height = 240;
var empty = new System.Windows.Controls.TextBlock {
Text = "No live call graph yet",
Foreground = (System.Windows.Media.Brush)FindResource("WinMutedTextBrush")
};
System.Windows.Controls.Canvas.SetLeft(empty, 16);
System.Windows.Controls.Canvas.SetTop(empty, 16);
ApiViewGraphCanvas.Children.Add(empty);
return;
}
ApiCallGraphRowSnapshot? selectedRow = rows.FirstOrDefault(
row =>
{
string sensor = string.IsNullOrWhiteSpace(row.SensorOrigin) ? "Unclassified" : row.SensorOrigin;
string callerOrigin = NormalizeApiCallerOrigin(row.CallerOrigin);
string originModule = NormalizeApiOriginModule(row.OriginModule);
string key = BuildApiGraphKey(row.SourcePid, row.TargetPid, row.ThreadId, row.ApiName, sensor,
callerOrigin, originModule);
return string.Equals(key, selectedKey, StringComparison.Ordinal);
});
List<ApiCallGraphRowSnapshot> visible =
rows.OrderByDescending(x => x.Hits).ThenByDescending(x => x.LastSeenUtc).Take(12).ToList();
if (selectedRow != null && !visible.Contains(selectedRow))
{
visible.Add(selectedRow);
}
var sourceNodes = visible.GroupBy(x => x.SourcePid)
.Select(x => new { Pid = x.Key, Hits = x.Sum(y => Math.Max(1, y.Hits)),
Selected = selectedRow != null &&
x.Any(y => y.SourcePid == selectedRow.SourcePid) })
.Where(x => x.Pid != 0)
.OrderByDescending(x => x.Hits)
.Take(6)
.ToList();
var apiNodes =
visible.GroupBy(x => string.IsNullOrWhiteSpace(x.ApiName) ? "unknown" : x.ApiName)
.Select(x => new { Api = x.Key, Hits = x.Sum(y => Math.Max(1, y.Hits)),
Selected = selectedRow != null &&
x.Any(y => string.Equals(y.ApiName, selectedRow.ApiName,
StringComparison.OrdinalIgnoreCase)) })
.OrderByDescending(x => x.Hits)
.Take(8)
.ToList();
var targetNodes =
visible.GroupBy(x => x.TargetPid != 0 ? x.TargetPid : x.SourcePid)
.Select(x => new { Pid = x.Key, Hits = x.Sum(y => Math.Max(1, y.Hits)),
Selected = selectedRow != null &&
x.Any(y => (y.TargetPid != 0 ? y.TargetPid : y.SourcePid) ==
(selectedRow.TargetPid != 0 ? selectedRow.TargetPid
: selectedRow.SourcePid)) })
.Where(x => x.Pid != 0)
.OrderByDescending(x => x.Hits)
.Take(6)
.ToList();
double canvasWidth = 920;
double nodeWidth = 170;
double apiNodeWidth = 188;
double nodeHeight = 40;
double leftX = 26;
double middleX = 364;
double rightX = canvasWidth - nodeWidth - 26;
double topY = 42;
double verticalSpacing = 56;
double canvasHeight = Math.Max(
264,
topY + Math.Max(sourceNodes.Count, Math.Max(apiNodes.Count, targetNodes.Count)) * verticalSpacing + 40);
ApiViewGraphCanvas.Width = canvasWidth;
ApiViewGraphCanvas.Height = canvasHeight;
var sourcePositions = new Dictionary<uint, System.Windows.Point>();
var apiPositions = new Dictionary<string, System.Windows.Point>(StringComparer.OrdinalIgnoreCase);
var targetPositions = new Dictionary<uint, System.Windows.Point>();
AddColumnLabel(leftX + (nodeWidth / 2.0), 14, "CALLERS");
AddColumnLabel(middleX + (apiNodeWidth / 2.0), 14, "APIS");
AddColumnLabel(rightX + (nodeWidth / 2.0), 14, "TARGETS");
for (int i = 0; i < sourceNodes.Count; i += 1)
{
double y = topY + (i * verticalSpacing);
sourcePositions[sourceNodes[i].Pid] =
new System.Windows.Point(leftX + nodeWidth, y + (nodeHeight / 2.0));
AddApiGraphProcessNode(leftX, y, nodeWidth, nodeHeight, sourceNodes[i].Pid, true,
sourceNodes[i].Selected);
}
for (int i = 0; i < apiNodes.Count; i += 1)
{
double y = topY + (i * verticalSpacing);
apiPositions[apiNodes[i].Api] =
new System.Windows.Point(middleX + apiNodeWidth / 2.0, y + (nodeHeight / 2.0));
AddApiGraphApiNode(middleX, y, apiNodeWidth, nodeHeight, apiNodes[i].Api, apiNodes[i].Selected);
}
for (int i = 0; i < targetNodes.Count; i += 1)
{
double y = topY + (i * verticalSpacing);
targetPositions[targetNodes[i].Pid] = new System.Windows.Point(rightX, y + (nodeHeight / 2.0));
AddApiGraphProcessNode(rightX, y, nodeWidth, nodeHeight, targetNodes[i].Pid, false,
targetNodes[i].Selected);
}
int maxHits = Math.Max(1, visible.Max(x => Math.Max(1, x.Hits)));
foreach (ApiCallGraphRowSnapshot row in visible)
{
uint sourcePid = row.SourcePid;
uint targetPid = row.TargetPid != 0 ? row.TargetPid : row.SourcePid;
string apiName = string.IsNullOrWhiteSpace(row.ApiName) ? "unknown" : row.ApiName;
string sensor = string.IsNullOrWhiteSpace(row.SensorOrigin) ? "Unclassified" : row.SensorOrigin;
string callerOrigin = NormalizeApiCallerOrigin(row.CallerOrigin);
string originModule = NormalizeApiOriginModule(row.OriginModule);
string rowKey = BuildApiGraphKey(row.SourcePid, row.TargetPid, row.ThreadId, row.ApiName, sensor,
callerOrigin, originModule);
bool isSelected = !string.IsNullOrWhiteSpace(selectedKey) &&
string.Equals(rowKey, selectedKey, StringComparison.Ordinal);
if (!sourcePositions.TryGetValue(sourcePid, out System.Windows.Point sourcePoint) ||
!apiPositions.TryGetValue(apiName, out System.Windows.Point apiPoint) ||
!targetPositions.TryGetValue(targetPid, out System.Windows.Point end))
{
continue;
}
double heat = Math.Clamp(row.Hits / (double)maxHits, 0.0, 1.0);
var lineBrush = BuildApiGraphEdgeBrush(sensor, callerOrigin, heat);
bool selfLoop = sourcePid == targetPid;
DrawCurve(sourcePoint, new System.Windows.Point(middleX, apiPoint.Y), lineBrush, heat, isSelected,
forward: true, selfLoop: false);
DrawCurve(new System.Windows.Point(middleX + apiNodeWidth, apiPoint.Y), end, lineBrush, heat,
isSelected, forward: true, selfLoop: selfLoop);
}
void AddColumnLabel(double centerX, double y, string label)
{
var block = new System.Windows.Controls.TextBlock {
Text = label, FontSize = 10, FontWeight = FontWeights.SemiBold,
Foreground = (System.Windows.Media.Brush)FindResource("WinMutedTextBrush")
};
block.Measure(new Size(double.PositiveInfinity, double.PositiveInfinity));
System.Windows.Controls.Canvas.SetLeft(block, centerX - (block.DesiredSize.Width / 2.0));
System.Windows.Controls.Canvas.SetTop(block, y);
ApiViewGraphCanvas.Children.Add(block);
}
void DrawCurve(System.Windows.Point start, System.Windows.Point end, System.Windows.Media.Brush stroke,
double heat, bool selected, bool forward, bool selfLoop)
{
var figure = new System.Windows.Media.PathFigure { StartPoint = start };
System.Windows.Point arrowBase;
System.Windows.Vector direction;
if (selfLoop)
{
double loopWidth = 64;
double loopHeight = 28;
var first = new System.Windows.Point(start.X + loopWidth * 0.35, start.Y - loopHeight);
var second = new System.Windows.Point(end.X - loopWidth * 0.35, end.Y - loopHeight);
figure.Segments.Add(new System.Windows.Media.BezierSegment(first, second, end, true));
arrowBase = second;
direction = end - second;
}
else
{
double controlOffset = Math.Max(48, Math.Abs(end.X - start.X) * 0.32);
var first = new System.Windows.Point(start.X + controlOffset, start.Y);
var second = new System.Windows.Point(end.X - controlOffset, end.Y);
figure.Segments.Add(new System.Windows.Media.BezierSegment(first, second, end, true));
arrowBase = second;
direction = end - second;
}
var geometry = new System.Windows.Media.PathGeometry();
geometry.Figures.Add(figure);
ApiViewGraphCanvas.Children.Add(
new System.Windows.Shapes.Path { Data = geometry, Stroke = stroke,
StrokeThickness = (selected ? 2.1 : 1.0) + (2.9 * heat),
Opacity = selected ? 0.98 : 0.28 });
if (forward)
{
DrawArrowHead(end, direction, stroke, selected ? 0.98 : 0.45);
}
}
void DrawArrowHead(System.Windows.Point tip, System.Windows.Vector direction,
System.Windows.Media.Brush stroke, double opacity)
{
if (direction.LengthSquared < 1)
{
direction = new System.Windows.Vector(1, 0);
}
direction.Normalize();
System.Windows.Vector normal = new(-direction.Y, direction.X);
const double arrowLength = 9;
const double arrowWidth = 4.5;
System.Windows.Point p1 = tip - (direction * arrowLength) + (normal * arrowWidth);
System.Windows.Point p2 = tip - (direction * arrowLength) - (normal * arrowWidth);
var geometry = new System.Windows.Media.PathGeometry();
var figure = new System.Windows.Media.PathFigure { StartPoint = tip, IsClosed = true, IsFilled = true };
figure.Segments.Add(new System.Windows.Media.LineSegment(p1, true));
figure.Segments.Add(new System.Windows.Media.LineSegment(p2, true));
geometry.Figures.Add(figure);
ApiViewGraphCanvas.Children.Add(new System.Windows.Shapes.Path { Data = geometry, Fill = stroke,
Stroke = stroke, Opacity = opacity });
}
void AddApiGraphProcessNode(double x, double y, double width, double height, uint pid, bool sourceSide,
bool selected)
{
string processName = GetApiGraphProcessName(pid);
string title = string.IsNullOrWhiteSpace(processName) ? "Process" : processName;
var border = new System.Windows.Controls.Border {
Width = width,
Height = height,
CornerRadius = new CornerRadius(8),
Background = new System.Windows.Media.SolidColorBrush(
sourceSide ? (selected ? System.Windows.Media.Color.FromArgb(235, 22, 86, 140)
: System.Windows.Media.Color.FromArgb(220, 17, 63, 103))
: (selected ? System.Windows.Media.Color.FromArgb(235, 140, 34, 38)
: System.Windows.Media.Color.FromArgb(220, 110, 25, 28))),
BorderBrush = new System.Windows.Media.SolidColorBrush(
sourceSide ? (selected ? System.Windows.Media.Color.FromRgb(118, 203, 255)
: System.Windows.Media.Color.FromRgb(80, 172, 255))
: (selected ? System.Windows.Media.Color.FromRgb(255, 139, 139)
: System.Windows.Media.Color.FromRgb(255, 109, 109))),
BorderThickness = new Thickness(selected ? 2 : 1),
Opacity = selected ? 1.0 : 0.78,
Child =
new System.Windows.Controls
.StackPanel {
VerticalAlignment = VerticalAlignment.Center, Margin = new Thickness(10, 3, 10, 3),
Children = { new System.Windows.Controls.TextBlock {
Text = title, TextAlignment = TextAlignment.Center,
TextTrimming = TextTrimming.CharacterEllipsis,
FontWeight = FontWeights.SemiBold,
Foreground = new System.Windows.Media
.SolidColorBrush(System.Windows.Media.Colors.White)
},
new System.Windows.Controls.TextBlock { Text = $"PID {pid}",
Margin = new Thickness(0, 1, 0, 0),
TextAlignment =
TextAlignment.Center,
Foreground =
new System.Windows.Media.SolidColorBrush(System
.Windows
.Media
.Color
.FromRgb(
220, 225, 230)) } }
}
};
System.Windows.Controls.Canvas.SetLeft(border, x);
System.Windows.Controls.Canvas.SetTop(border, y);
ApiViewGraphCanvas.Children.Add(border);
}
void AddApiGraphApiNode(double x, double y, double width, double height, string label, bool selected)
{
var border =
new System.Windows.Controls.Border {
Width = width,
Height = height,
CornerRadius = new CornerRadius(8),
Background = new System.Windows.Media.SolidColorBrush(
selected ? System.Windows.Media.Color.FromArgb(236, 42, 49, 58)
: System.Windows.Media.Color.FromArgb(225, 32, 36, 43)),
BorderBrush = new System.Windows.Media.SolidColorBrush(
selected ? System.Windows.Media.Color.FromRgb(195, 205, 216)
: System.Windows.Media.Color.FromRgb(128, 140, 154)),
BorderThickness = new Thickness(selected ? 2 : 1),
Opacity = selected ? 1.0 : 0.82,
Child =
new System.Windows.Controls.TextBlock {
Text = label, Margin = new Thickness(10, 0, 10, 0),
VerticalAlignment = VerticalAlignment.Center, TextAlignment = TextAlignment.Center,
TextTrimming = TextTrimming.CharacterEllipsis, FontWeight = FontWeights.SemiBold,
Foreground = new System.Windows.Media.SolidColorBrush(System.Windows.Media.Colors.White)
},
Cursor = System.Windows.Input.Cursors.Hand
};
border.MouseLeftButtonDown += (_, e) =>
{
SelectApiViewRowByApiName(label);
if (e.ClickCount >= 2)
{
OpenApiInspector(label);
}
e.Handled = true;
};
System.Windows.Controls.Canvas.SetLeft(border, x);
System.Windows.Controls.Canvas.SetTop(border, y);
ApiViewGraphCanvas.Children.Add(border);
}
}
private static string SummarizeApiReason(string? reason)
{
if (string.IsNullOrWhiteSpace(reason))
{
return string.Empty;
}
string compact = reason.Replace('\r', ' ').Replace('\n', ' ').Trim();
if (compact.Length <= 260)
{
return compact;
}
return compact[..260] + "...";
}
private static string BuildApiGraphKey(uint sourcePid, uint targetPid, uint threadId, string apiName,
string sensorOrigin, string callerOrigin, string originModule) =>
$"{sourcePid}|{targetPid}|{threadId}|{apiName}|{sensorOrigin}|{callerOrigin}|{originModule}";
private static string NormalizeApiCallerOrigin(string? callerOrigin)
{
string normalized = (callerOrigin ?? string.Empty).Trim().ToLowerInvariant();
return normalized.Length == 0 ? "unknown" : normalized;
}
private static string NormalizeApiOriginModule(string? originModule)
{
string normalized = (originModule ?? string.Empty).Trim();
return normalized.Length == 0 ? "unknown" : normalized;
}
private static string GetApiCallerOriginDisplayLabel(string callerOrigin, string? sensor = null)
{
return NormalizeApiCallerOrigin(
callerOrigin) switch { "process-image" => "Process Image", "non-system-dll" => "Other DLL",
"unbacked" => "Unbacked / Shellcode", "system" => "System DLL Chain",
_ => !string.IsNullOrWhiteSpace(sensor) &&
sensor.StartsWith("Kernel", StringComparison.OrdinalIgnoreCase)
? "Kernel / Driver"
: "Unknown" };
}
private static bool IsInternalHookFrame(string? modulePath, string? frameText = null)
{
if (EventDetailFormatting.IsBlackbirdInternalPath(modulePath) ||
EventDetailFormatting.IsBlackbirdInternalModule(modulePath))
{
return true;
}
string candidate = (frameText ?? string.Empty).Trim();
return candidate.StartsWith("SR71", StringComparison.OrdinalIgnoreCase) ||
candidate.StartsWith("J58", StringComparison.OrdinalIgnoreCase) ||
candidate.StartsWith("BlackbirdController", StringComparison.OrdinalIgnoreCase) ||
candidate.StartsWith("BlackbirdInterface", StringComparison.OrdinalIgnoreCase);
}
private static List<string> BuildHookFrameList(BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields)
{
ulong[] stack = view.Stack ?? Array.Empty<ulong>();
var frames = new List<string>(BlackbirdNative.MaxIpcStackFrames);
void AddFrameText(string frame)
{
if (string.IsNullOrWhiteSpace(frame))
{
return;
}
frame = frame.Trim();
if (frames.Count == 0 || !string.Equals(frames[^1], frame, StringComparison.OrdinalIgnoreCase))
{
frames.Add(frame);
}
}
for (int i = 0; i < Math.Min((int)view.StackCount, BlackbirdNative.MaxIpcStackFrames); i += 1)
{
string symbolKey = $"stack{i}Symbol";
string pathKey = $"stack{i}Path";
if (fields.TryGetValue(symbolKey, out string? symbolValue) && !string.IsNullOrWhiteSpace(symbolValue))
{
string frameText = symbolValue.Trim();
string? pathValue = null;
if (fields.TryGetValue(pathKey, out string? resolvedPath) && !string.IsNullOrWhiteSpace(resolvedPath))
{
pathValue = resolvedPath.Trim();
}
if (IsInternalHookFrame(pathValue, frameText))
{
continue;
}
if (!string.IsNullOrWhiteSpace(pathValue))
{
string moduleName = EventDetailFormatting.ModuleNameFromPath(pathValue);
if (!string.IsNullOrWhiteSpace(moduleName) &&
!moduleName.Equals("unknown", StringComparison.OrdinalIgnoreCase) &&
frameText.IndexOf(moduleName, StringComparison.OrdinalIgnoreCase) < 0)
{
frameText = $"{moduleName}!{frameText}";
}
}
AddFrameText(frameText);
continue;
}
ulong rawIp = i < stack.Length ? stack[i] : 0;
if (rawIp != 0)
{
AddFrameText($"0x{rawIp:X}");
}
}
if (frames.Count == 0 &&
fields.TryGetValue("originSymbol", out string? originSymbol) &&
!string.IsNullOrWhiteSpace(originSymbol) &&
!IsInternalHookFrame(null, originSymbol))
{
AddFrameText(originSymbol);
}
return frames;
}
private static string BuildHookCallChainText(BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields)
{
List<string> frames = BuildHookFrameList(view, fields);
return frames.Count == 0 ? string.Empty : "CallChain: " + string.Join(" -> ", frames);
}
private string FormatObservedPointer(BrokerEtwEventView? view, ulong address, string? modulePath = null,
ulong moduleBase = 0, ulong moduleSize = 0)
{
if (address == 0)
{
return string.Empty;
}
string directModuleText =
EventDetailFormatting.FormatModuleRelativeAddress(modulePath, moduleBase, moduleSize, address);
if (!string.IsNullOrWhiteSpace(directModuleText) &&
!string.Equals(directModuleText, $"0x{address:X}", StringComparison.OrdinalIgnoreCase))
{
return directModuleText;
}
if (view != null)
{
uint targetPid =
view.TargetPid != 0 ? view.TargetPid : (view.ProcessPid != 0 ? view.ProcessPid : view.ActorPid);
ulong processStartKey = ResolveObservedProcessStartKey(targetPid, view.ProcessStartKey);
if (TryResolveKnownRegionForAddress(targetPid, processStartKey, address, out _, out ulong regionBase,
out ulong regionSize, out string regionKind,
out uint currentProtection))
{
ulong pageBase = address & ~0xFFFUL;
string regionText =
$"{regionKind.ToLowerInvariant()}+0x{address - regionBase:X} [0x{address:X}; page 0x{pageBase:X}; region 0x{regionBase:X}+0x{regionSize:X}; {EventDetailFormatting.DescribeMemoryProtection(currentProtection)}]";
if (string.Equals(regionKind, "Image", StringComparison.OrdinalIgnoreCase))
{
string imageText = EventDetailFormatting.FormatModuleRelativeAddress(
view.ImagePath, view.ImageBase != 0 ? view.ImageBase : regionBase,
view.ImageSize != 0 ? view.ImageSize : regionSize, address);
if (!string.IsNullOrWhiteSpace(imageText) &&
!string.Equals(imageText, $"0x{address:X}", StringComparison.OrdinalIgnoreCase))
{
return $"{imageText}; page 0x{pageBase:X}";
}
}
return regionText;
}
string viewImageText = EventDetailFormatting.FormatModuleRelativeAddress(view.ImagePath, view.ImageBase,
view.ImageSize, address);
if (!string.IsNullOrWhiteSpace(viewImageText) &&
!string.Equals(viewImageText, $"0x{address:X}", StringComparison.OrdinalIgnoreCase))
{
return viewImageText;
}
}
return $"0x{address:X}";
}
private string BuildHookFrameSummary(BrokerEtwEventView view, IReadOnlyDictionary<string, string> fields) =>
AppendThreadStackFallbackSummary(view, BuildHookFrameSummaryCore(view, fields));
private static string BuildHookFrameSummaryCore(BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields)
{
var sb = new StringBuilder(512);
string sensor = EventDetailFormatting.ClassifyHookSensorOrigin(view);
string origin = GetApiCallerOriginDisplayLabel(NormalizeApiCallerOrigin(view.CallerOriginLabel), sensor);
string immediate = EventDetailFormatting.HookImmediateCallerLabel(view.Flags);
string deepOrigin = EventDetailFormatting.HookDeepOriginLabel(view.Flags);
string sr71Component = EventDetailFormatting.HookComponentLabel(view.Flags);
string originModule = ResolveHookOriginModule(view, fields);
string resolvedReturnAddress = ResolveHookReturnAddressLabel(view, fields, originModule);
bool kernelCaller = (view.Flags & BlackbirdNative.IpcEtwFlagHookKernelCaller) != 0;
bool userCaller = (view.Flags & BlackbirdNative.IpcEtwFlagHookUserCaller) != 0;
bool currentTarget = IsHookCurrentProcessTarget(view);
bool imageSection = IsHookImageSection(view);
bool containsOwnModule = EventDetailFormatting.HookTraceContainsOwnModule(view.Flags);
bool returnAddressResolved = !string.IsNullOrWhiteSpace(resolvedReturnAddress);
bool returnAddressPresentInStack = false;
ulong[] stack = view.Stack ?? Array.Empty<ulong>();
int compareFrames = Math.Min((int)view.StackCount, stack.Length);
for (int i = 0; i < compareFrames; i += 1)
{
if (stack[i] == view.OriginAddress && view.OriginAddress != 0)
{
returnAddressPresentInStack = true;
break;
}
}
sb.Append("Origin: ").AppendLine(origin);
if (kernelCaller || userCaller)
{
sb.Append("Caller Mode: ").AppendLine(kernelCaller ? "Kernel" : "User");
}
sb.Append("Target Scope: ").AppendLine(currentTarget ? "Current Process" : "External / Cross-Process");
sb.Append("Memory Backing: ").AppendLine(imageSection ? "Image-backed" : "Private / Non-image");
if (!string.IsNullOrWhiteSpace(sr71Component))
{
sb.Append("SR71 Component: ").AppendLine(sr71Component);
}
sb.Append("SR71 Frames Present: ").AppendLine(containsOwnModule ? "yes" : "no");
if (!string.IsNullOrWhiteSpace(immediate) &&
!immediate.Equals("Unknown", StringComparison.OrdinalIgnoreCase))
{
sb.Append("Immediate Caller: ").AppendLine(immediate);
}
if (!string.IsNullOrWhiteSpace(deepOrigin) &&
!deepOrigin.Equals("Unknown", StringComparison.OrdinalIgnoreCase))
{
sb.Append("Deep Origin: ").AppendLine(deepOrigin);
}
if (!string.IsNullOrWhiteSpace(originModule))
{
sb.Append("Origin Module: ").AppendLine(originModule);
}
if (view.OriginAddress != 0)
{
sb.Append("Return Address: ")
.AppendLine(!string.IsNullOrWhiteSpace(resolvedReturnAddress)
? resolvedReturnAddress
: $"0x{view.OriginAddress.ToString("X", CultureInfo.InvariantCulture)}");
sb.Append("Return Address Resolved: ").AppendLine(returnAddressResolved ? "yes" : "no");
sb.Append("Return Address In Stack: ").AppendLine(returnAddressPresentInStack ? "yes" : "no");
}
sb.Append("Stack Frames Captured: ")
.Append(view.StackCount.ToString(CultureInfo.InvariantCulture))
.AppendLine();
if (fields.TryGetValue("startSymbol", out string? startSymbol) && !string.IsNullOrWhiteSpace(startSymbol))
{
sb.Append("Start Routine: ").AppendLine(startSymbol);
}
List<string> frames = BuildHookFrameList(view, fields);
if (frames.Count > 0)
{
sb.AppendLine("Frames:");
for (int i = 0; i < frames.Count; i += 1)
{
sb.Append(" ").Append(i + 1).Append(". ").AppendLine(frames[i]);
string pathKey = $"stack{i}Path";
if (fields.TryGetValue(pathKey, out string? framePath) && !string.IsNullOrWhiteSpace(framePath))
{
sb.Append(" ").AppendLine(framePath.Trim());
}
}
}
if (!string.IsNullOrWhiteSpace(view.OriginPath))
{
sb.Append("Origin Path: ").AppendLine(view.OriginPath.Trim());
}
return sb.ToString().TrimEnd();
}
private string AppendThreadStackFallbackSummary(BrokerEtwEventView view, string summary)
{
if (view.StackCount != 0)
{
return summary;
}
string fallback = BuildThreadStackFallbackSummary(view);
if (string.IsNullOrWhiteSpace(fallback))
{
string source = EventDetailFormatting.IsKernelHookTelemetry(view) ||
view.SourceId == BlackbirdNative.IpcEtwSourceBlackbird
? "kernel/driver telemetry did not include user frames"
: "hook telemetry did not include frames";
string note = $"Thread Stack Fallback: pending or unavailable ({source})";
return string.IsNullOrWhiteSpace(summary) ? note : $"{summary}{Environment.NewLine}{note}";
}
return string.IsNullOrWhiteSpace(summary) ? fallback : $"{summary}{Environment.NewLine}{fallback}";
}
private string BuildThreadStackFallbackSummary(BrokerEtwEventView view)
{
uint pid = view.ProcessPid != 0 ? view.ProcessPid
: view.ActorPid != 0 ? view.ActorPid
: view.EventProcessId;
uint tid = view.EventThreadId != 0 ? view.EventThreadId : view.ThreadId;
if (pid == 0 || tid == 0 || pid > int.MaxValue || tid > int.MaxValue)
{
return string.Empty;
}
DateTime observedUtc = view.TimestampUtc == default ? DateTime.UtcNow : view.TimestampUtc;
IReadOnlyList<ThreadStackSessionSnapshot> history =
GetThreadStackHistory(unchecked((int)pid), unchecked((int)tid), string.Empty);
ThreadStackSessionSnapshot? snapshot =
history.Where(x => x.Frames.Count > 0)
.OrderBy(x => Math.Abs((x.CapturedAtUtc - observedUtc).TotalMilliseconds))
.FirstOrDefault();
if (snapshot == null)
{
return string.Empty;
}
double deltaMs = Math.Abs((snapshot.CapturedAtUtc - observedUtc).TotalMilliseconds);
if (deltaMs > 5000)
{
return string.Empty;
}
var sb = new StringBuilder(512);
sb.Append("Thread Stack Fallback: ")
.Append(snapshot.Frames.Count.ToString(CultureInfo.InvariantCulture))
.Append(" frames from Thread Stack window history, deltaMs=")
.Append(deltaMs.ToString("0", CultureInfo.InvariantCulture))
.AppendLine();
int frameCount = Math.Min(12, snapshot.Frames.Count);
for (int i = 0; i < frameCount; i += 1)
{
StackFrameRow frame = snapshot.Frames[i];
string label = !string.IsNullOrWhiteSpace(frame.Symbol) ? frame.Symbol
: !string.IsNullOrWhiteSpace(frame.Address) ? frame.Address
: $"0x{frame.InstructionPointerRaw:X}";
if (!string.IsNullOrWhiteSpace(frame.Module) &&
label.IndexOf(frame.Module, StringComparison.OrdinalIgnoreCase) < 0)
{
label = $"{frame.Module}!{label}";
}
sb.Append(" ").Append(i + 1).Append(". ").AppendLine(label);
}
return sb.ToString().TrimEnd();
}
private static string ResolveHookOriginModule(BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields)
{
string originModule = EventDetailFormatting.ModuleNameFromPath(view.OriginPath);
if (!string.Equals(originModule, "unknown", StringComparison.OrdinalIgnoreCase) &&
!EventDetailFormatting.IsBlackbirdInternalModule(originModule) &&
!EventDetailFormatting.IsBlackbirdInternalPath(view.OriginPath))
{
return originModule;
}
if (fields.TryGetValue("originSymbol", out string? originSymbol) && !string.IsNullOrWhiteSpace(originSymbol))
{
string trimmed = originSymbol.Trim();
int plus = trimmed.IndexOf('+');
if (plus > 0)
{
trimmed = trimmed[..plus].Trim();
}
if (!IsInternalHookFrame(null, trimmed))
{
return trimmed;
}
}
for (int i = 0; i < Math.Min((int)view.StackCount, BlackbirdNative.MaxIpcStackFrames); i += 1)
{
string pathKey = $"stack{i}Path";
string symbolKey = $"stack{i}Symbol";
string? pathValue = null;
if (fields.TryGetValue(pathKey, out string? resolvedPath) && !string.IsNullOrWhiteSpace(resolvedPath))
{
pathValue = resolvedPath.Trim();
if (!IsInternalHookFrame(pathValue))
{
string moduleFromPath = EventDetailFormatting.ModuleNameFromPath(pathValue);
if (!string.Equals(moduleFromPath, "unknown", StringComparison.OrdinalIgnoreCase))
{
return moduleFromPath;
}
}
}
if (fields.TryGetValue(symbolKey, out string? symbolValue) &&
!string.IsNullOrWhiteSpace(symbolValue) &&
!IsInternalHookFrame(pathValue, symbolValue))
{
string trimmed = symbolValue.Trim();
int plus = trimmed.IndexOf('+');
if (plus > 0)
{
trimmed = trimmed[..plus].Trim();
}
if (!string.IsNullOrWhiteSpace(trimmed))
{
return trimmed;
}
}
}
return originModule;
}
private static string ResolveHookReturnAddressLabel(BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields,
string originModule)
{
ulong[] stack = view.Stack ?? Array.Empty<ulong>();
if (fields.TryGetValue("originSymbol", out string? originSymbol) && !string.IsNullOrWhiteSpace(originSymbol))
{
string trimmed = originSymbol.Trim();
if (!IsInternalHookFrame(null, trimmed))
{
return trimmed;
}
}
for (int i = 0; i < Math.Min((int)view.StackCount, BlackbirdNative.MaxIpcStackFrames); i += 1)
{
if (stack.Length <= i || stack[i] != view.OriginAddress)
{
continue;
}
string symbolKey = $"stack{i}Symbol";
if (fields.TryGetValue(symbolKey, out string? stackSymbol) && !string.IsNullOrWhiteSpace(stackSymbol))
{
return stackSymbol.Trim();
}
}
if (!string.IsNullOrWhiteSpace(originModule) &&
!originModule.Equals("unknown", StringComparison.OrdinalIgnoreCase) && view.OriginAddress != 0)
{
return $"{originModule}!0x{view.OriginAddress:X}";
}
return string.Empty;
}
private static string BuildHookFrameSummary(IReadOnlyDictionary<string, string> fields)
{
var view = new BrokerEtwEventView();
if (fields.TryGetValue("originPath", out string? originPath))
{
view.OriginPath = originPath;
}
if (fields.TryGetValue("kind", out string? kind) &&
string.Equals(kind, "kernel_ntapi", StringComparison.OrdinalIgnoreCase))
{
view.Source = "BK";
view.SourceId = BlackbirdNative.IpcEtwSourceBlackbird;
view.Family = BlackbirdNative.IpcEtwFamilyUserHook;
}
return BuildHookFrameSummaryCore(view, fields);
}
private string FormatApiProcessLabel(uint pid)
{
if (pid == 0)
{
return string.Empty;
}
string processName = GetApiGraphProcessName(pid);
return string.IsNullOrWhiteSpace(processName)
? pid.ToString(CultureInfo.InvariantCulture)
: $"{processName} ({pid.ToString(CultureInfo.InvariantCulture)})";
}
private static string FormatApiRelativeAge(DateTime lastSeenUtc)
{
if (lastSeenUtc == default)
{
return string.Empty;
}
TimeSpan age = DateTime.UtcNow - lastSeenUtc;
if (age < TimeSpan.Zero)
{
age = TimeSpan.Zero;
}
if (age.TotalSeconds >= 1)
{
return $"{age.TotalSeconds:0.0}s ago";
}
return $"{Math.Max(0, age.TotalMilliseconds):0} ms ago";
}
private (string Action, string Detail) BuildApiDecodedAction(BrokerEtwEventView view, string rawReason)
{
string apiName = !string.IsNullOrWhiteSpace(view.Operation) ? view.Operation : view.EventName;
if (string.IsNullOrWhiteSpace(apiName))
{
apiName = "unknown";
}
Dictionary<string, string> fields = BuildHookFieldMap(view);
string action = BuildGenericApiActionLabel(apiName, fields);
string detail;
string argumentText = BuildResolvedHookArgumentsText(apiName, view, fields);
bool hasExecutionContext =
TryDescribeHookExecutionContext(view, fields, out string contextHeadline, out string contextDetail);
if (TryBuildMemoryAction(apiName, view, fields, out string memoryAction, out string memoryDetail))
{
action = memoryAction;
string frameSummary = BuildHookFrameSummary(view, fields);
var detailBuilder = new StringBuilder(memoryDetail.TrimEnd());
if (!string.IsNullOrWhiteSpace(frameSummary))
{
detailBuilder.AppendLine().AppendLine().Append(frameSummary);
}
if (!string.IsNullOrWhiteSpace(argumentText))
{
detailBuilder.AppendLine().AppendLine().Append(argumentText);
}
detail = detailBuilder.ToString();
if (hasExecutionContext)
{
if (contextHeadline.Equals("Loader / Image Mapping", StringComparison.OrdinalIgnoreCase))
{
action += " [loader]";
}
else if (contextHeadline.Equals("Kernel Caller", StringComparison.OrdinalIgnoreCase))
{
action += " [kernel]";
}
detail =
$"{contextHeadline}{Environment.NewLine}{contextDetail}{Environment.NewLine}{Environment.NewLine}{detail}";
}
}
else
{
var sb = new StringBuilder(512);
sb.AppendLine(action);
if (hasExecutionContext)
{
if (contextHeadline.Equals("Loader / Image Mapping", StringComparison.OrdinalIgnoreCase))
{
action += " [loader]";
}
else if (contextHeadline.Equals("Kernel Caller", StringComparison.OrdinalIgnoreCase))
{
action += " [kernel]";
}
else if (contextHeadline.Contains("Startup", StringComparison.OrdinalIgnoreCase))
{
action += " [startup]";
}
sb.AppendLine().AppendLine(contextHeadline);
sb.AppendLine(contextDetail);
}
string frameSummary = BuildHookFrameSummary(view, fields);
if (!string.IsNullOrWhiteSpace(frameSummary))
{
sb.AppendLine().AppendLine(frameSummary);
}
if (!string.IsNullOrWhiteSpace(argumentText))
{
sb.AppendLine().AppendLine(argumentText);
}
string contextText = BuildGenericEtwDisplayDetail(view, fields, includeHeadline: false);
if (!string.IsNullOrWhiteSpace(contextText))
{
sb.AppendLine().Append(contextText);
}
detail = sb.ToString().Trim();
}
return (action, detail);
}
private bool TryBuildMemoryAction(string apiName, BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields, out string action,
out string detail)
{
action = string.Empty;
detail = string.Empty;
DateTime now = view.TimestampUtc == default ? DateTime.UtcNow : view.TimestampUtc;
if (apiName.Equals("NtAllocateVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
ulong baseAddress = FirstU64(fields, "base", "c0", "a1");
ulong regionSize = FirstU64(fields, "size", "c1", "a3");
ulong allocationType = FirstU64(fields, "allocType", "c2", "a4");
uint protect = (uint)FirstU64(fields, "protect", "c3", "a5");
ulong page = baseAddress & ~0xFFFUL;
if (page != 0)
{
ApiMemoryPageSignal state = GetOrCreateApiMemoryPageSignal(page);
if (protect != 0)
{
state.Protect = protect;
state.LastProtectChangeUtc = now;
}
}
string protectLabel = DescribeMemoryProtect(protect);
(string contextActionSuffix, string contextDetail) =
DescribeMemoryRegionContext(view, baseAddress, regionSize);
action = $"Allocates 0x{regionSize:X} bytes at 0x{baseAddress:X} ({protectLabel}){contextActionSuffix}";
detail = $"Action: memory.alloc\n" + $"API: {apiName}\n" + $"Base: 0x{baseAddress:X}\n" +
$"Size: 0x{regionSize:X}\n" +
$"AllocType: 0x{allocationType:X} ({DescribeMemoryAllocationType((uint)allocationType)})\n" +
$"Protect: 0x{protect:X} ({protectLabel})\n" + contextDetail.TrimEnd();
return true;
}
if (apiName.Equals("NtProtectVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
ulong baseAddress = FirstU64(fields, "base", "c0", "a1");
ulong regionSize = FirstU64(fields, "size", "c1", "a2");
uint newProtect = (uint)FirstU64(fields, "newProtect", "c2", "a3");
ulong page = baseAddress & ~0xFFFUL;
ApiMemoryPageSignal state = GetOrCreateApiMemoryPageSignal(page);
bool protectChanged = state.Protect != 0 && newProtect != 0 && state.Protect != newProtect;
bool rapidFlip = false;
if (protectChanged)
{
state.ProtectFlipCount += 1;
rapidFlip = state.LastProtectChangeUtc != default &&
(now - state.LastProtectChangeUtc).TotalMilliseconds <= 900;
}
if (newProtect != 0)
{
state.Protect = newProtect;
}
state.LastProtectChangeUtc = now;
string protectLabel = DescribeMemoryProtect(newProtect);
(string contextActionSuffix, string contextDetail) =
DescribeMemoryRegionContext(view, baseAddress, regionSize);
action = $"Changes protection to {protectLabel} at 0x{baseAddress:X}{contextActionSuffix}";
detail = $"Action: memory.protect\n" + $"API: {apiName}\n" + $"Base: 0x{baseAddress:X}\n" +
$"Size: 0x{regionSize:X}\n" + $"NewProtect: 0x{newProtect:X} ({protectLabel})\n" +
$"ProtectFlips: {state.ProtectFlipCount}\n" + $"RapidFlip: {(rapidFlip ? "yes" : "no")}\n" +
contextDetail.TrimEnd();
return true;
}
if (apiName.Equals("NtWriteVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
ulong baseAddress = FirstU64(fields, "base", "c0", "a1");
ulong size = FirstU64(fields, "size", "c1", "a3");
ulong page = baseAddress & ~0xFFFUL;
ApiMemoryPageSignal state = GetOrCreateApiMemoryPageSignal(page);
int sampleLen = (int)Math.Min(view.DeepSampleSize, (uint)(view.DeepSample?.Length ?? 0));
double entropy = ComputeSampleEntropyBits(view.DeepSample, sampleLen);
if (entropy < 0 && TryReadDouble(fields, out double parsedEntropy, "entropy"))
{
entropy = parsedEntropy;
}
bool entropyChanged = !double.IsNaN(state.LastEntropyBits) && entropy >= 0 &&
Math.Abs(state.LastEntropyBits - entropy) >= MemoryEntropyFlipDeltaBits;
bool rapidEntropyFlip = false;
if (entropyChanged)
{
state.EntropyFlipCount += 1;
rapidEntropyFlip = state.LastEntropyChangeUtc != default &&
(now - state.LastEntropyChangeUtc).TotalMilliseconds <= 900;
}
if (entropy >= 0)
{
state.LastEntropyBits = entropy;
state.LastEntropyChangeUtc = now;
}
string entropyText = entropy >= 0 ? entropy.ToString("F2", CultureInfo.InvariantCulture) : "n/a";
(string contextActionSuffix, string contextDetail) =
DescribeMemoryRegionContext(view, baseAddress, size);
action = $"Writes 0x{size:X} bytes at 0x{baseAddress:X} (entropy {entropyText}){contextActionSuffix}";
detail = $"Action: memory.write\n" + $"API: {apiName}\n" + $"Base: 0x{baseAddress:X}\n" +
$"Size: 0x{size:X}\n" + $"Entropy(bits/byte): {entropyText}\n" +
$"EntropyFlips: {state.EntropyFlipCount}\n" + $"ProtectFlips: {state.ProtectFlipCount}\n" +
$"RapidEntropyFlip: {(rapidEntropyFlip ? "yes" : "no")}\n" + $"SampleBytes: {sampleLen}\n" +
contextDetail.TrimEnd();
return true;
}
return false;
}
private MemoryRegionAttributionSample? CreateMemoryRegionAttributionSample(BrokerEtwEventView view)
{
string apiName =
string.IsNullOrWhiteSpace(view.EventName) ? view.Operation ?? string.Empty : view.EventName;
Dictionary<string, string> fields = BuildHookFieldMap(view);
string eventKind = string.Empty;
string regionKind = string.Empty;
ulong allocationBase = 0;
ulong baseAddress = 0;
ulong regionSize = 0;
ulong threadStartAddress = 0;
uint initialProtection = 0;
uint currentProtection = 0;
uint previousProtection = 0;
uint protectFlipCount = 0;
uint sampleBytes = 0;
bool threadStartObserved = false;
bool functionTableRegistered = false;
ulong functionTablePointer = 0;
double entropyBits = -1;
switch (view.Family)
{
case BlackbirdNative.IpcEtwFamilyImage:
eventKind = "ImageMap";
regionKind = "Image";
allocationBase = view.ImageBase;
baseAddress = view.ImageBase;
regionSize = view.ImageSize;
currentProtection = view.StartRegionProtect;
initialProtection = currentProtection;
break;
case BlackbirdNative.IpcEtwFamilyThread:
eventKind = "ThreadStart";
regionKind = view.ImageBase != 0 ? "Image" : "Unknown";
allocationBase = view.ImageBase != 0 ? view.ImageBase : NormalizeRegionAddress(view.StartAddress);
baseAddress = allocationBase;
regionSize = view.ImageSize != 0 ? view.ImageSize : 1;
currentProtection = view.StartRegionProtect;
initialProtection = currentProtection;
threadStartObserved = true;
threadStartAddress = view.StartAddress;
break;
case BlackbirdNative.IpcEtwFamilyUserHook:
if (string.IsNullOrWhiteSpace(apiName))
{
return null;
}
if (apiName.Equals("NtAllocateVirtualMemory", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("NtAllocateVirtualMemoryEx", StringComparison.OrdinalIgnoreCase))
{
eventKind = "PrivateAllocate";
regionKind = "Private";
allocationBase = FirstU64(fields, "base", "c1", "a1");
baseAddress = allocationBase;
regionSize = FirstU64(fields, "size", "c3", "a3");
currentProtection = (uint)FirstU64(fields, "protect", "c3", "a5", "c5");
initialProtection = currentProtection;
}
else if (apiName.Equals("NtProtectVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
eventKind = "ProtectChange";
allocationBase = FirstU64(fields, "base", "c1", "a1");
baseAddress = allocationBase;
regionSize = FirstU64(fields, "size", "c2", "a2");
currentProtection = (uint)FirstU64(fields, "newProtect", "c2", "a3", "c3");
previousProtection = (uint)FirstU64(fields, "oldProtect", "a4", "c4");
protectFlipCount = (uint)FirstU64(fields, "protectFlips");
sampleBytes = (uint)FirstU64(fields, "sampleBytes");
}
else if (apiName.Equals("NtWriteVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
eventKind = "MemoryWrite";
allocationBase = FirstU64(fields, "base", "c1", "a1");
baseAddress = allocationBase;
regionSize = Math.Max(1UL, FirstU64(fields, "size", "c3", "a3"));
protectFlipCount = (uint)FirstU64(fields, "protectFlips");
sampleBytes = (uint)FirstU64(fields, "sampleBytes");
if (TryReadDouble(fields, out double parsedEntropy, "entropy"))
{
entropyBits = parsedEntropy;
}
}
else if (apiName.Equals("NtMapViewOfSection", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("NtMapViewOfSectionEx", StringComparison.OrdinalIgnoreCase))
{
eventKind = "SectionMap";
regionKind = IsHookImageSection(view) ? "Image" : "Mapped";
allocationBase = FirstU64(fields, "baseAddress", "base", "c2", "a2");
baseAddress = allocationBase;
regionSize = FirstU64(fields, "viewSize", "size", "c3", "a4", "a6");
currentProtection = (uint)FirstU64(fields, "win32Protect", "a6", "c6", "c5");
initialProtection = currentProtection;
}
else if (apiName.Equals("RtlAddFunctionTable", StringComparison.OrdinalIgnoreCase))
{
eventKind = "FunctionTableRegister";
functionTablePointer = FirstU64(fields, "table", "a0");
allocationBase = FirstU64(fields, "baseAddress", "a2");
baseAddress = allocationBase;
regionSize = 1;
functionTableRegistered = true;
}
else if (apiName.Equals("RtlInstallFunctionTableCallback", StringComparison.OrdinalIgnoreCase))
{
eventKind = "FunctionTableCallback";
functionTablePointer = FirstU64(fields, "tableId", "a0");
allocationBase = FirstU64(fields, "baseAddress", "a1");
baseAddress = allocationBase;
regionSize = Math.Max(1UL, FirstU64(fields, "length", "a2"));
functionTableRegistered = true;
}
else if (apiName.Equals("RtlDeleteFunctionTable", StringComparison.OrdinalIgnoreCase))
{
functionTablePointer = FirstU64(fields, "table", "a0");
eventKind = "FunctionTableDelete";
allocationBase = ResolveFunctionTableBase(view, functionTablePointer);
baseAddress = allocationBase;
regionSize = 1;
functionTableRegistered = false;
}
else
{
return null;
}
break;
default:
return null;
}
if (sampleBytes == 0 && view.DeepSampleSize != 0)
{
sampleBytes = view.DeepSampleSize;
}
if (entropyBits < 0 && view.DeepSample.Length > 1)
{
int sampleLength = sampleBytes == 0 ? view.DeepSample.Length
: (int)Math.Min(sampleBytes, (uint)view.DeepSample.Length);
entropyBits = ComputeSampleEntropyBits(view.DeepSample, sampleLength);
}
uint targetPid = ResolveMemoryRegionTargetPid(view);
if (targetPid == 0)
{
return null;
}
if (allocationBase == 0)
{
allocationBase = NormalizeRegionAddress(baseAddress != 0 ? baseAddress : threadStartAddress);
}
if (baseAddress == 0)
{
baseAddress = allocationBase;
}
if (allocationBase == 0 || baseAddress == 0)
{
return null;
}
if (regionSize == 0)
{
if (threadStartObserved || eventKind.StartsWith("FunctionTable", StringComparison.OrdinalIgnoreCase))
{
regionSize = 1;
}
else
{
return null;
}
}
ulong processStartKey = ResolveObservedProcessStartKey(targetPid, view.ProcessStartKey);
if (view.Family == BlackbirdNative.IpcEtwFamilyThread && threadStartAddress != 0 &&
TryResolveKnownRegionForAddress(targetPid, processStartKey, threadStartAddress, out _,
out ulong existingBaseAddress, out ulong existingRegionSize,
out string existingRegionKind, out uint existingProtection))
{
allocationBase = existingBaseAddress;
baseAddress = existingBaseAddress;
regionSize = existingRegionSize;
regionKind = existingRegionKind;
if (currentProtection == 0)
{
currentProtection = existingProtection;
}
if (initialProtection == 0)
{
initialProtection = existingProtection;
}
}
string regionIdentity = BuildRegionIdentity(processStartKey, targetPid, allocationBase);
string firstUserFrameModule = ResolveHookOriginModule(view, fields);
bool hookFamily = view.Family == BlackbirdNative.IpcEtwFamilyUserHook;
string frameSummary = view.Family == BlackbirdNative.IpcEtwFamilyUserHook
? BuildHookFrameSummary(view, fields)
: string.Empty;
ProcessIdentityResolver.Prime(view.ActorPid);
ProcessIdentityResolver.Prime(targetPid);
string executionContext = string.Empty;
if (TryDescribeHookExecutionContext(view, fields, out string contextHeadline, out _))
{
executionContext = contextHeadline;
}
var sample = new MemoryRegionAttributionSample {
TimestampUtc = view.TimestampUtc == default ? DateTime.UtcNow : view.TimestampUtc,
ProcessStartKey = processStartKey,
TargetPid = targetPid,
ActorPid = view.ActorPid != 0 ? view.ActorPid : targetPid,
ActorTid = view.ThreadId != 0 ? view.ThreadId : view.EventThreadId,
AllocationBase = allocationBase,
BaseAddress = baseAddress,
RegionSize = regionSize,
ApiName = apiName,
EventKind = eventKind,
RegionKind =
string.IsNullOrWhiteSpace(regionKind) ? InferRegionKind(view, currentProtection) : regionKind,
RegionIdentity = regionIdentity,
OriginPath = view.OriginPath ?? view.ImagePath ?? string.Empty,
SourceFamily = view.Family == BlackbirdNative.IpcEtwFamilyUserHook ? "Hook"
: view.Family == BlackbirdNative.IpcEtwFamilyImage ? "ImageLoad"
: view.Family == BlackbirdNative.IpcEtwFamilyThread ? "Thread"
: "ETW",
ExecutionContext = executionContext,
CallerOrigin = view.CallerOriginLabel,
FirstUserFrame = view.OriginAddress,
FirstUserFrameModule = firstUserFrameModule,
FrameSummary = frameSummary,
UnwindClean = hookFamily && IsHookUnwindClean(view.Flags),
FrameChainHadGaps = hookFamily && HookFrameChainHasGaps(view.Flags),
ObservedByKernel = hookFamily && view.SourceId == BlackbirdNative.IpcEtwSourceBlackbird,
ObservedByUserHook = hookFamily && view.SourceId == BlackbirdNative.IpcEtwSourceUserHook,
BlackbirdOwned = IsBlackbirdOwnEvent(view),
CrossProcess = targetPid != 0 && view.ActorPid != 0 && targetPid != view.ActorPid,
ImageBacked = string.Equals(regionKind, "Image", StringComparison.OrdinalIgnoreCase) ||
IsHookImageSection(view) || view.Family == BlackbirdNative.IpcEtwFamilyImage,
InitialProtection = initialProtection,
CurrentProtection = currentProtection,
PreviousProtection = previousProtection,
ProtectFlipCount = protectFlipCount,
EntropyBits = entropyBits,
SampleBytes = sampleBytes,
ThreadStartObserved = threadStartObserved,
ThreadId = threadStartObserved ? (view.ThreadId != 0 ? view.ThreadId : view.EventThreadId) : 0,
ThreadStartAddress = threadStartAddress,
FunctionTableRegistered = functionTableRegistered,
FunctionTablePointer = functionTablePointer,
SignatureLevel = view.SignatureLevel,
SignatureType = view.SignatureType
};
return FinalizeMemoryRegionAttribution(sample);
}
private MemoryRegionAttributionSample FinalizeMemoryRegionAttribution(MemoryRegionAttributionSample sample)
{
if (string.IsNullOrWhiteSpace(sample.RegionIdentity))
{
return sample;
}
if (!_regionLifecycleByIdentity.TryGetValue(sample.RegionIdentity, out RegionLifecycleState? state))
{
state = new RegionLifecycleState();
_regionLifecycleByIdentity[sample.RegionIdentity] = state;
}
if (state.TargetPid == 0)
{
state.TargetPid = sample.TargetPid;
}
if (state.ProcessStartKey == 0)
{
state.ProcessStartKey = sample.ProcessStartKey;
}
if (state.BaseAddress == 0)
{
state.BaseAddress = sample.AllocationBase != 0 ? sample.AllocationBase : sample.BaseAddress;
}
if (string.IsNullOrWhiteSpace(state.ExecutionContext) &&
!string.IsNullOrWhiteSpace(sample.ExecutionContext))
{
state.ExecutionContext = sample.ExecutionContext;
}
if (state.RegionSize == 0 && sample.RegionSize != 0)
{
state.RegionSize = sample.RegionSize;
}
else if (sample.RegionSize > state.RegionSize)
{
state.RegionSize = sample.RegionSize;
}
if (string.IsNullOrWhiteSpace(state.RegionKind) && !string.IsNullOrWhiteSpace(sample.RegionKind))
{
state.RegionKind = sample.RegionKind;
}
if (!state.ObservedByKernel && sample.ObservedByKernel)
{
state.ObservedByKernel = true;
}
if (!state.ObservedByUserHook && sample.ObservedByUserHook)
{
state.ObservedByUserHook = true;
}
if (!state.BlackbirdOwned && sample.BlackbirdOwned)
{
state.BlackbirdOwned = true;
}
if (!state.CrossProcess && sample.CrossProcess)
{
state.CrossProcess = true;
}
if (!state.ImageBacked && sample.ImageBacked)
{
state.ImageBacked = true;
}
if (sample.InitialProtection != 0 && state.InitialProtection == 0)
{
state.InitialProtection = sample.InitialProtection;
}
if (sample.CurrentProtection == 0 && state.CurrentProtection != 0)
{
sample.CurrentProtection = state.CurrentProtection;
}
if (sample.InitialProtection == 0 && state.InitialProtection != 0)
{
sample.InitialProtection = state.InitialProtection;
}
uint reportedProtectFlipCount = sample.ProtectFlipCount;
DateTime observedUtc = sample.TimestampUtc == default ? DateTime.UtcNow : sample.TimestampUtc;
if (sample.CurrentProtection != 0)
{
uint previousProtection =
sample.PreviousProtection != 0 ? sample.PreviousProtection : state.CurrentProtection;
if (sample.PreviousProtection == 0 && previousProtection != 0 &&
(sample.EventKind.Equals("ProtectChange", StringComparison.OrdinalIgnoreCase) ||
sample.EventKind.Equals("SectionMap", StringComparison.OrdinalIgnoreCase) ||
sample.EventKind.Equals("ImageMap", StringComparison.OrdinalIgnoreCase)))
{
sample.PreviousProtection = previousProtection;
}
bool executableNow = IsExecutableProtection(sample.CurrentProtection);
bool executableBefore = IsExecutableProtection(previousProtection);
if (!state.FirstExecutableTransitionSeen && executableNow && !executableBefore)
{
sample.FirstExecutableTransition = true;
state.FirstExecutableTransitionSeen = true;
}
bool protectionChanged = previousProtection != 0 &&
!ProtectionValuesEquivalent(previousProtection, sample.CurrentProtection);
bool protectSignalEvent =
sample.EventKind.Equals("ProtectChange", StringComparison.OrdinalIgnoreCase) ||
reportedProtectFlipCount > state.ProtectFlipCount;
if (protectionChanged && protectSignalEvent)
{
string transition = BuildProtectionTransitionLabel(previousProtection, sample.CurrentProtection);
sample.ProtectionTransition = transition;
state.LastProtectionTransition = transition;
if (reportedProtectFlipCount > state.ProtectFlipCount)
{
state.ProtectFlipCount = reportedProtectFlipCount;
}
else
{
state.ProtectFlipCount += 1;
}
double protectDeltaMs = state.LastProtectChangeUtc == default
? double.MaxValue
: (observedUtc - state.LastProtectChangeUtc).TotalMilliseconds;
if (protectDeltaMs >= 0 && protectDeltaMs <= 1000)
{
state.RapidProtectFlipCount += 1;
}
state.LastProtectChangeUtc = observedUtc;
if (executableNow != executableBefore)
{
state.ExecutableFlipCount += 1;
}
if (IsGuardNoAccessProtectionTransition(previousProtection, sample.CurrentProtection))
{
state.GuardNoAccessFlipCount += 1;
}
if (IsWritableExecutableProtectionTransition(previousProtection, sample.CurrentProtection))
{
state.WritableExecutableFlipCount += 1;
}
}
else if (string.IsNullOrWhiteSpace(sample.ProtectionTransition))
{
sample.ProtectionTransition = state.LastProtectionTransition;
}
if (state.InitialProtection == 0)
{
state.InitialProtection = sample.CurrentProtection;
}
state.PreviousProtection = previousProtection;
state.CurrentProtection = sample.CurrentProtection;
}
if (sample.EventKind.Equals("SectionMap", StringComparison.OrdinalIgnoreCase) ||
sample.EventKind.Equals("ImageMap", StringComparison.OrdinalIgnoreCase))
{
state.MapCount += 1;
}
else if (sample.EventKind.Equals("MemoryWrite", StringComparison.OrdinalIgnoreCase))
{
state.WriteCount += 1;
}
else if (sample.EventKind.Equals("ProtectChange", StringComparison.OrdinalIgnoreCase))
{
state.ProtectCount += 1;
}
if (sample.ThreadStartObserved)
{
state.ThreadStartCount += 1;
if (!state.FirstThreadStartSeen)
{
state.FirstThreadStartSeen = true;
state.FirstThreadStartAddress = sample.ThreadStartAddress;
}
else
{
sample.ThreadStartObserved = false;
}
}
if (sample.EventKind.Equals("FunctionTableRegister", StringComparison.OrdinalIgnoreCase) ||
sample.EventKind.Equals("FunctionTableCallback", StringComparison.OrdinalIgnoreCase))
{
state.FunctionTableRegistered = true;
}
else if (sample.EventKind.Equals("FunctionTableDelete", StringComparison.OrdinalIgnoreCase))
{
state.FunctionTableRegistered = false;
}
if (reportedProtectFlipCount > state.ProtectFlipCount)
{
state.ProtectFlipCount = reportedProtectFlipCount;
}
if (sample.EntropyBits >= 0)
{
bool entropyChanged =
state.LastEntropyBits >= 0 &&
Math.Abs(state.LastEntropyBits - sample.EntropyBits) >= MemoryEntropyFlipDeltaBits;
if (entropyChanged)
{
state.EntropyFlipCount += 1;
double entropyDeltaMs = state.LastEntropyChangeUtc == default
? double.MaxValue
: (observedUtc - state.LastEntropyChangeUtc).TotalMilliseconds;
if (entropyDeltaMs >= 0 && entropyDeltaMs <= 1000)
{
state.RapidEntropyFlipCount += 1;
}
state.LastEntropyChangeUtc = observedUtc;
}
if (sample.EventKind.Equals("MemoryWrite", StringComparison.OrdinalIgnoreCase) &&
sample.EntropyBits >= MemoryHighEntropyBits &&
(sample.SampleBytes == 0 || sample.SampleBytes >= MemoryEntropyMinSampleBytes))
{
state.HighEntropyWriteCount += 1;
}
state.LastEntropyBits = sample.EntropyBits;
if (state.MaxEntropyBits < 0 || sample.EntropyBits > state.MaxEntropyBits)
{
state.MaxEntropyBits = sample.EntropyBits;
}
}
if (sample.SampleBytes > state.LastSampleBytes)
{
state.LastSampleBytes = sample.SampleBytes;
}
if (sample.TargetPid != 0 && sample.BaseAddress != 0)
{
if (sample.ApiName.Equals("RtlAddFunctionTable", StringComparison.OrdinalIgnoreCase) &&
sample.FunctionTablePointer != 0)
{
string tableKey = BuildFunctionTablePointerKey(sample.TargetPid, sample.FunctionTablePointer);
_functionTableBaseByPointer[tableKey] = sample.BaseAddress;
}
else if (sample.ApiName.Equals("RtlDeleteFunctionTable", StringComparison.OrdinalIgnoreCase) &&
sample.FunctionTablePointer != 0)
{
_functionTableBaseByPointer.Remove(
BuildFunctionTablePointerKey(sample.TargetPid, sample.FunctionTablePointer));
}
}
sample.FunctionTableRegistered = state.FunctionTableRegistered || sample.FunctionTableRegistered;
sample.MapCount = state.MapCount;
sample.WriteCount = state.WriteCount;
sample.ProtectCount = state.ProtectCount;
sample.ThreadStartCount = state.ThreadStartCount;
sample.ProtectFlipCount = Math.Max(sample.ProtectFlipCount, state.ProtectFlipCount);
sample.RapidProtectFlipCount = state.RapidProtectFlipCount;
sample.ExecutableFlipCount = state.ExecutableFlipCount;
sample.GuardNoAccessFlipCount = state.GuardNoAccessFlipCount;
sample.WritableExecutableFlipCount = state.WritableExecutableFlipCount;
if (string.IsNullOrWhiteSpace(sample.ProtectionTransition))
{
sample.ProtectionTransition = state.LastProtectionTransition;
}
if (sample.EntropyBits < 0)
{
sample.EntropyBits = state.LastEntropyBits;
}
sample.MaxEntropyBits = state.MaxEntropyBits;
sample.EntropyFlipCount = state.EntropyFlipCount;
sample.RapidEntropyFlipCount = state.RapidEntropyFlipCount;
sample.HighEntropyWriteCount = state.HighEntropyWriteCount;
if (sample.SampleBytes == 0)
{
sample.SampleBytes = state.LastSampleBytes;
}
sample.ObservedByKernel = sample.ObservedByKernel || state.ObservedByKernel;
sample.ObservedByUserHook = sample.ObservedByUserHook || state.ObservedByUserHook;
sample.BlackbirdOwned = sample.BlackbirdOwned || state.BlackbirdOwned;
sample.CrossProcess = sample.CrossProcess || state.CrossProcess;
sample.ImageBacked = sample.ImageBacked || state.ImageBacked;
if (string.IsNullOrWhiteSpace(sample.ExecutionContext))
{
sample.ExecutionContext = state.ExecutionContext;
}
sample.LifecycleSummary = BuildMemoryLifecycleSummary(sample);
return sample;
}
private static string BuildMemoryLifecycleSummary(MemoryRegionAttributionSample sample)
{
var parts = new List<string>(6);
if (sample.MapCount != 0)
{
parts.Add($"map:{sample.MapCount}");
}
if (sample.WriteCount != 0)
{
parts.Add($"write:{sample.WriteCount}");
}
if (sample.ProtectCount != 0)
{
parts.Add($"protect:{sample.ProtectCount}");
}
if (sample.ThreadStartCount != 0)
{
parts.Add($"thread:{sample.ThreadStartCount}");
}
if (sample.FirstExecutableTransition)
{
parts.Add("first-exec");
}
if (sample.FunctionTableRegistered)
{
parts.Add("unwind");
}
string summary = parts.Count == 0 ? sample.EventKind : string.Join(" ", parts);
if (sample.CrossProcess)
{
summary += " xproc";
}
if (sample.ImageBacked)
{
summary += " image";
}
if (sample.ProtectFlipCount != 0)
{
summary += $" pflip:{sample.ProtectFlipCount}";
}
if (sample.RapidProtectFlipCount != 0)
{
summary += $" rapid-pflip:{sample.RapidProtectFlipCount}";
}
if (!string.IsNullOrWhiteSpace(sample.ProtectionTransition))
{
summary += $" transition:{sample.ProtectionTransition}";
}
if (sample.ExecutableFlipCount != 0)
{
summary += $" xflip:{sample.ExecutableFlipCount}";
}
if (sample.GuardNoAccessFlipCount != 0)
{
summary += $" guard/noaccess:{sample.GuardNoAccessFlipCount}";
}
if (sample.WritableExecutableFlipCount != 0)
{
summary += $" wxflip:{sample.WritableExecutableFlipCount}";
}
if (sample.EntropyBits >= 0)
{
summary += $" H:{sample.EntropyBits:F1}";
}
if (sample.MaxEntropyBits >= 0 && sample.MaxEntropyBits > sample.EntropyBits + 0.05)
{
summary += $" Hmax:{sample.MaxEntropyBits:F1}";
}
if (sample.EntropyFlipCount != 0)
{
summary += $" eflip:{sample.EntropyFlipCount}";
}
if (sample.RapidEntropyFlipCount != 0)
{
summary += $" rapid-eflip:{sample.RapidEntropyFlipCount}";
}
if (sample.HighEntropyWriteCount != 0)
{
summary += $" high-H:{sample.HighEntropyWriteCount}";
}
return summary.Trim();
}
private uint ResolveMemoryRegionTargetPid(BrokerEtwEventView view)
{
return view.Family switch {
BlackbirdNative.IpcEtwFamilyImage => view.ProcessPid != 0 ? view.ProcessPid : view.EventProcessId,
BlackbirdNative.IpcEtwFamilyThread =>
view.ProcessPid != 0 ? view.ProcessPid
: (view.TargetPid != 0 ? view.TargetPid : view.EventProcessId),
BlackbirdNative.IpcEtwFamilyUserHook =>
view.TargetPid != 0 ? view.TargetPid : (view.ProcessPid != 0 ? view.ProcessPid : view.ActorPid),
_ => 0
};
}
private ulong ResolveObservedProcessStartKey(uint pid, ulong eventStartKey)
{
if (eventStartKey != 0)
{
_observedProcessStartKeyByPid[pid] = eventStartKey;
return eventStartKey;
}
return _observedProcessStartKeyByPid.TryGetValue(pid, out ulong cached) ? cached : 0;
}
private static string BuildRegionIdentity(ulong processStartKey, uint targetPid, ulong allocationBase) =>
$"{targetPid:X8}:{processStartKey:X16}:{allocationBase:X16}";
private static string BuildFunctionTablePointerKey(uint pid,
ulong functionTable) => $"{pid:X8}:{functionTable:X16}";
private ulong ResolveFunctionTableBase(BrokerEtwEventView view, ulong functionTable)
{
if (view.ProcessPid != 0 && functionTable != 0)
{
string key = BuildFunctionTablePointerKey(view.ProcessPid, functionTable);
if (_functionTableBaseByPointer.TryGetValue(key, out ulong baseAddress) && baseAddress != 0)
{
return baseAddress;
}
}
return 0;
}
private bool TryResolveKnownRegionForAddress(uint targetPid, ulong processStartKey, ulong address,
out string regionIdentity, out ulong baseAddress,
out ulong regionSize, out string regionKind,
out uint currentProtection)
{
regionIdentity = string.Empty;
baseAddress = 0;
regionSize = 0;
regionKind = string.Empty;
currentProtection = 0;
if (targetPid == 0 || address == 0 || _regionLifecycleByIdentity.Count == 0)
{
return false;
}
RegionLifecycleState? best = null;
foreach ((string candidateIdentity, RegionLifecycleState candidate) in _regionLifecycleByIdentity)
{
if (candidate.TargetPid != targetPid || candidate.BaseAddress == 0 || candidate.RegionSize == 0)
{
continue;
}
if (processStartKey != 0 && candidate.ProcessStartKey != 0 &&
candidate.ProcessStartKey != processStartKey)
{
continue;
}
ulong regionEnd = candidate.BaseAddress + candidate.RegionSize;
if (regionEnd <= candidate.BaseAddress)
{
regionEnd = ulong.MaxValue;
}
if (address < candidate.BaseAddress || address >= regionEnd)
{
continue;
}
if (best == null || candidate.BaseAddress >= best.BaseAddress)
{
best = candidate;
regionIdentity = candidateIdentity;
}
}
if (best == null)
{
return false;
}
baseAddress = best.BaseAddress;
regionSize = best.RegionSize;
regionKind = best.RegionKind;
currentProtection = best.CurrentProtection;
return true;
}
private static ulong NormalizeRegionAddress(ulong address) => address == 0 ? 0 : (address & ~0xFFFUL);
private static bool IsExecutableProtection(uint protection)
{
uint normalized = protection & 0xFFu;
return normalized == 0x10u || normalized == 0x20u || normalized == 0x40u || normalized == 0x80u;
}
private static bool IsWritableProtection(uint protection)
{
uint normalized = protection & 0xFFu;
return normalized == 0x04u || normalized == 0x08u || normalized == 0x40u || normalized == 0x80u;
}
private static bool IsNoAccessProtection(uint protection)
{
return (protection & 0xFFu) == 0x01u;
}
private static bool HasGuardProtection(uint protection)
{
return (protection & 0x100u) != 0;
}
private static bool IsWritableExecutableProtection(uint protection)
{
uint normalized = protection & 0xFFu;
return normalized == 0x40u || normalized == 0x80u;
}
private static uint NormalizeProtectionForFlip(uint protection)
{
return protection & 0x1FFu;
}
private static bool ProtectionValuesEquivalent(uint left, uint right)
{
return NormalizeProtectionForFlip(left) == NormalizeProtectionForFlip(right);
}
private static bool IsGuardNoAccessProtectionTransition(uint previousProtection, uint currentProtection)
{
return IsNoAccessProtection(previousProtection) || IsNoAccessProtection(currentProtection) ||
HasGuardProtection(previousProtection) || HasGuardProtection(currentProtection);
}
private static bool IsWritableExecutableProtectionTransition(uint previousProtection, uint currentProtection)
{
return IsWritableExecutableProtection(previousProtection) ||
IsWritableExecutableProtection(currentProtection) ||
(IsWritableProtection(previousProtection) && IsExecutableProtection(currentProtection)) ||
(IsExecutableProtection(previousProtection) && IsWritableProtection(currentProtection));
}
private static string BuildProtectionTransitionLabel(uint previousProtection, uint currentProtection)
{
return $"{CompactMemoryProtectionLabel(previousProtection)}->{CompactMemoryProtectionLabel(currentProtection)}";
}
private static string CompactMemoryProtectionLabel(uint protection)
{
string baseLabel = (protection & 0xFFu) switch {
0x01u => "NO_ACCESS",
0x02u => "R",
0x04u => "RW",
0x08u => "WC",
0x10u => "X",
0x20u => "RX",
0x40u => "RWX",
0x80u => "XWC",
_ => protection == 0 ? "UNKNOWN" : $"0x{protection & 0xFFu:X}"
};
return HasGuardProtection(protection) ? $"GUARD|{baseLabel}" : baseLabel;
}
private static bool IsMemoryPatternMilestone(uint count)
{
return count == 2 || count == 3 || count == 5 || count == 10 || count == 25 || count == 50 ||
(count >= 100 && count % 100 == 0);
}
private static bool IsHighEntropyWriteMilestone(uint count)
{
return count == 1 || count == 3 || count == 10 || count == 25 || count == 50 ||
(count >= 100 && count % 100 == 0);
}
private static bool HasUsableEntropySample(MemoryRegionAttributionSample sample)
{
return sample.EntropyBits >= 0 &&
(sample.SampleBytes == 0 || sample.SampleBytes >= MemoryEntropyMinSampleBytes);
}
private static uint ComputeMemoryLifecycleSeverity(MemoryRegionAttributionSample sample, bool protectSignal,
bool entropySignal)
{
uint severity = protectSignal ? 5u : 4u;
if (protectSignal)
{
if (sample.ProtectFlipCount >= 50 || sample.RapidProtectFlipCount >= 10)
{
severity = Math.Max(severity, 9u);
}
else if (sample.ProtectFlipCount >= 10 || sample.RapidProtectFlipCount >= 4)
{
severity = Math.Max(severity, 8u);
}
else if (sample.ProtectFlipCount >= 5 || sample.GuardNoAccessFlipCount != 0 ||
sample.WritableExecutableFlipCount != 0)
{
severity = Math.Max(severity, 7u);
}
else if (sample.ProtectFlipCount >= 2 || sample.RapidProtectFlipCount != 0 ||
sample.ExecutableFlipCount != 0)
{
severity = Math.Max(severity, 6u);
}
}
if (entropySignal)
{
if (sample.MaxEntropyBits >= 7.7 || sample.HighEntropyWriteCount >= 10)
{
severity = Math.Max(severity, 7u);
}
else if (sample.EntropyBits >= MemoryHighEntropyBits || sample.EntropyFlipCount >= 3)
{
severity = Math.Max(severity, 5u);
}
}
if (sample.CrossProcess)
{
severity = Math.Max(severity, 7u);
}
if (sample.FunctionTableRegistered && sample.ProtectFlipCount != 0)
{
severity = Math.Max(severity, 7u);
}
return Math.Min(severity, 9u);
}
private static bool IsHookUnwindClean(uint flags)
{
return (flags & BlackbirdNative.IpcEtwFlagModuleChainSane) != 0 &&
(flags & BlackbirdNative.IpcEtwFlagUnwindMetadataValid) != 0 &&
(flags & BlackbirdNative.IpcEtwFlagTebStackBoundsValid) != 0 &&
(flags & BlackbirdNative.IpcEtwFlagFramesOutsideTebStack) == 0;
}
private static bool HookFrameChainHasGaps(uint flags)
{
return (flags & BlackbirdNative.IpcEtwFlagModuleChainSane) == 0 ||
(flags & BlackbirdNative.IpcEtwFlagFramesOutsideTebStack) != 0;
}
private static string InferRegionKind(BrokerEtwEventView view, uint protection)
{
if (view.Family == BlackbirdNative.IpcEtwFamilyImage)
{
return "Image";
}
if (view.EventName.Equals("NtAllocateVirtualMemory", StringComparison.OrdinalIgnoreCase) ||
view.EventName.Equals("NtAllocateVirtualMemoryEx", StringComparison.OrdinalIgnoreCase))
{
return "Private";
}
if (view.EventName.Equals("NtMapViewOfSection", StringComparison.OrdinalIgnoreCase) ||
view.EventName.Equals("NtMapViewOfSectionEx", StringComparison.OrdinalIgnoreCase))
{
return IsExecutableProtection(protection) ? "Mapped-Executable" : "Mapped";
}
return "Unknown";
}
private bool ShouldTrackRawIoctlRecord(IoctlParsedEvent record)
{
return record.Type switch { BlackbirdNative.EventTypeHandle => ShouldTrackRawHandleIoctl(record),
BlackbirdNative.EventTypeThread => ShouldTrackRawThreadIoctl(record),
BlackbirdNative.EventTypeFileSystem =>
record.FileProcessPid == 0 || IsTrackedPid(record.FileProcessPid),
BlackbirdNative.EventTypeRegistry =>
record.RegistryProcessPid == 0 || IsTrackedPid(record.RegistryProcessPid),
BlackbirdNative.EventTypeEnterprise =>
record.EnterpriseProcessPid == 0 ||
IsTrackedPid(record.EnterpriseProcessPid),
_ => false };
}
private bool ShouldTrackRawHandleIoctl(IoctlParsedEvent record)
{
if (record.CallerPid == 0 || record.TargetPid == 0)
{
return false;
}
if (!IsTrackedPid(record.CallerPid))
{
return false;
}
string originModule = EventDetailFormatting.ModuleNameFromPath(record.OriginPath);
return !EventDetailFormatting.IsSr71Module(originModule);
}
private bool ShouldTrackRawThreadIoctl(IoctlParsedEvent record)
{
if (record.ProcessPid == 0)
{
return false;
}
if (record.CreatorPid != 0 && record.CreatorPid != record.ProcessPid && !IsTrackedPid(record.CreatorPid))
{
return false;
}
return true;
}
private static bool ShouldAdmitIoctlRecord(IoctlParsedEvent record, long pendingCount)
{
if (pendingCount >= MaxPendingIoctlEvents)
{
return false;
}
if (pendingCount < IoctlPressureSoftLimit)
{
return true;
}
return pendingCount >= IoctlPressureCriticalLimit ? IsCriticalIoctlRecord(record)
: IsImportantIoctlRecord(record);
}
private static bool IsImportantIoctlRecord(IoctlParsedEvent record)
{
return record.Type switch { BlackbirdNative.EventTypeHandle => IsImportantHandleIoctl(record),
BlackbirdNative.EventTypeThread => IsImportantThreadIoctl(record),
BlackbirdNative.EventTypeFileSystem => IsImportantFilesystemIoctl(record),
BlackbirdNative.EventTypeEnterprise => true,
_ => false };
}
private static bool IsCriticalIoctlRecord(IoctlParsedEvent record)
{
return record.Type switch { BlackbirdNative.EventTypeHandle => IsCriticalHandleIoctl(record),
BlackbirdNative.EventTypeThread => IsCriticalThreadIoctl(record),
BlackbirdNative.EventTypeFileSystem => IsCriticalFilesystemIoctl(record),
BlackbirdNative.EventTypeEnterprise =>
(record.EnterpriseFlags & BlackbirdNative.EnterpriseFlagCritical) != 0,
_ => false };
}
private static bool IsImportantHandleIoctl(IoctlParsedEvent record)
{
bool isThreadObject = (record.HandleFlags & 0x00000010u) != 0;
return record.HandleClass == 2 || (record.HandleFlags & (HighSignalHandleMask | 0x00000080u)) != 0 ||
IsHighRiskIoctlAccess(record.DesiredAccess, isThreadObject);
}
private static bool IsCriticalHandleIoctl(IoctlParsedEvent record)
{
bool isThreadObject = (record.HandleFlags & 0x00000010u) != 0;
return record.HandleClass == 2 || (record.HandleFlags & HighSignalHandleMask) != 0 ||
((record.HandleFlags & 0x00000080u) != 0 &&
IsHighRiskIoctlAccess(record.DesiredAccess, isThreadObject));
}
private static bool IsImportantThreadIoctl(IoctlParsedEvent record)
{
string kind = DetermineThreadLifecycleKind(record.ThreadFlags, record.StartAddress, record.ImageSize);
return kind != "Update" || (record.ThreadFlags & ThreadHighSignalMask) != 0 ||
(record.CreatorPid != 0 && record.ProcessPid != 0 && record.CreatorPid != record.ProcessPid);
}
private static bool IsCriticalThreadIoctl(IoctlParsedEvent record)
{
return (record.ThreadFlags & ThreadHighSignalMask) != 0 ||
(record.CreatorPid != 0 && record.ProcessPid != 0 && record.CreatorPid != record.ProcessPid);
}
private static bool IsImportantFilesystemIoctl(IoctlParsedEvent record)
{
return record.FileOperation switch {
BlackbirdNative.FileOperationCreate or BlackbirdNative.FileOperationWrite or
BlackbirdNative.FileOperationSetInformation or
BlackbirdNative.FileOperationDirectoryControl or BlackbirdNative.FileOperationFsControl => true,
_ => record.FileStatus != 0
};
}
private static bool IsCriticalFilesystemIoctl(IoctlParsedEvent record)
{
return record.FileOperation switch {
BlackbirdNative.FileOperationCreate or BlackbirdNative.FileOperationWrite or
BlackbirdNative.FileOperationSetInformation or BlackbirdNative.FileOperationFsControl => true,
_ => record.FileStatus != 0
};
}
private static bool ShouldPersistIoctlRecord(IoctlParsedEvent record, TelemetryEvent? telemetry,
ProcessRelationView? relation, HeuristicEventView? heuristic,
IoctlParsedEvent? filesystem)
{
if (filesystem != null || heuristic != null || relation != null)
{
return true;
}
if (telemetry == null)
{
return false;
}
return record.Type switch { BlackbirdNative.EventTypeHandle => IsImportantHandleIoctl(record),
BlackbirdNative.EventTypeThread => IsImportantThreadIoctl(record),
BlackbirdNative.EventTypeEnterprise => true,
_ => false };
}
private bool IsTrackedPid(uint pid)
{
return pid == 0 || _filterTrackedPids.IsEmpty || _filterTrackedPids.ContainsKey(pid);
}
private static bool ShouldTrackRawEtwEvent(BlackbirdNative.BkIpcEtwEvent etw)
{
byte[] detectionName = etw.DetectionName ?? Array.Empty<byte>();
if (detectionName.Length > 0 && detectionName[0] != 0)
{
return true;
}
if (IsRawDirectSyscallEtwEvent(etw))
{
return true;
}
if (etw.Severity >= 4)
{
return true;
}
if (etw.Source == BlackbirdNative.IpcEtwSourceThreatIntel)
{
return etw.Task == 1 || etw.Task == 2 || etw.Task == 7;
}
return etw.Family switch {
BlackbirdNative.IpcEtwFamilyProcess => (etw.Flags & BlackbirdNative.IpcEtwFlagProcessIsCreate) != 0,
BlackbirdNative.IpcEtwFamilyThread or BlackbirdNative.IpcEtwFamilyApc or
BlackbirdNative.IpcEtwFamilyUserHook or BlackbirdNative.IpcEtwFamilySocket => true,
BlackbirdNative.IpcEtwFamilyRegistry => (etw.Flags & BlackbirdNative.IpcEtwFlagRegistryHighValue) != 0,
_ => false
};
}
private static bool IsRawDirectSyscallEtwEvent(BlackbirdNative.BkIpcEtwEvent etw)
{
if ((etw.DetectionTraits & BlackbirdNative.IpcEtwTraitDirectSyscall) != 0)
{
return true;
}
if (etw.Family != BlackbirdNative.IpcEtwFamilyHandle)
{
return false;
}
string className = BlackbirdNative.AnsiBufferToString(etw.ClassName);
if (className.Equals("DIRECT-SYSCALL-SUSPECT", StringComparison.OrdinalIgnoreCase))
{
return true;
}
bool exportMismatch = (etw.Flags & HandleFlagSyscallExportMismatch) != 0;
bool stackSpoof = (etw.Flags & HandleFlagStackSpoofSuspect) != 0;
bool execOutsideNtdll = (etw.Flags & HandleFlagExecProtect) != 0 && (etw.Flags & HandleFlagFromNtdll) == 0;
return exportMismatch || stackSpoof || execOutsideNtdll;
}
private static bool ShouldAdmitEtwEvent(BlackbirdNative.BkIpcEtwEvent etw, long pendingCount)
{
byte[] detectionName = etw.DetectionName ?? Array.Empty<byte>();
if (pendingCount >= MaxPendingEtwEvents)
{
return false;
}
if (pendingCount < EtwPressureSoftLimit)
{
return true;
}
bool critical = (detectionName.Length > 0 && detectionName[0] != 0) || etw.Severity >= 6 ||
IsRawDirectSyscallEtwEvent(etw) ||
(etw.Family == BlackbirdNative.IpcEtwFamilyProcess &&
(etw.Flags & BlackbirdNative.IpcEtwFlagProcessIsCreate) != 0) ||
etw.Family == BlackbirdNative.IpcEtwFamilyUserHook;
if (pendingCount >= EtwPressureCriticalLimit)
{
return critical;
}
return critical || etw.Family == BlackbirdNative.IpcEtwFamilyThread ||
etw.Family == BlackbirdNative.IpcEtwFamilyApc ||
etw.Source == BlackbirdNative.IpcEtwSourceThreatIntel;
}
private string BuildEtwDisplayDetail(BrokerEtwEventView view)
{
string rawReason = view.Reason ?? string.Empty;
if (EventDetailFormatting.IsApiGraphCandidate(view))
{
return BuildApiDecodedAction(view, rawReason).Detail;
}
return BuildGenericEtwDisplayDetail(view, BuildHookFieldMap(view), includeHeadline: true);
}
private string BuildFallbackApiDetail(string apiName, BrokerEtwEventView view, string rawReason, string action)
{
Dictionary<string, string> fields = BuildHookFieldMap(rawReason, Array.Empty<ulong>(), 0);
string argumentText = BuildResolvedHookArgumentsText(apiName, view, fields);
if (string.IsNullOrWhiteSpace(argumentText))
{
return action;
}
return $"{action}{Environment.NewLine}{Environment.NewLine}{argumentText}";
}
private string BuildGenericEtwDisplayDetail(BrokerEtwEventView view, IReadOnlyDictionary<string, string> fields,
bool includeHeadline)
{
var sb = new StringBuilder(512);
string eventName = string.IsNullOrWhiteSpace(view.EventName) ? "unknown" : view.EventName.Trim();
string detection = view.DetectionName?.Trim() ?? string.Empty;
string operation = view.Operation?.Trim() ?? string.Empty;
string actor = ProcessIdentityResolver.Describe(view.ActorPid);
string target = ProcessIdentityResolver.Describe(view.TargetPid);
if (includeHeadline)
{
sb.AppendLine(!string.IsNullOrWhiteSpace(detection) ? detection : eventName);
}
if (!string.IsNullOrWhiteSpace(view.Source))
{
sb.Append("Source: ").AppendLine(view.Source);
}
sb.Append("Event: ").AppendLine(eventName);
if (!string.IsNullOrWhiteSpace(operation) &&
!operation.Equals(eventName, StringComparison.OrdinalIgnoreCase))
{
sb.Append("Operation: ").AppendLine(operation);
}
if (!string.IsNullOrWhiteSpace(detection))
{
sb.Append("Detection: ").AppendLine(detection);
}
if (view.ActorPid != 0)
{
sb.Append("Actor: ").AppendLine(actor);
}
if (view.TargetPid != 0)
{
sb.Append("Target: ").AppendLine(target);
}
if (!string.IsNullOrWhiteSpace(view.ArgumentSummary))
{
sb.Append("Arguments: ").AppendLine(view.ArgumentSummary);
}
string frameSummary = BuildHookFrameSummary(view, fields);
if (!string.IsNullOrWhiteSpace(frameSummary))
{
sb.AppendLine(frameSummary);
}
if (includeHeadline &&
TryDescribeHookExecutionContext(view, fields, out string executionHeadline, out string executionDetail))
{
sb.Append(executionHeadline).Append(": ").AppendLine(executionDetail);
}
if (!string.IsNullOrWhiteSpace(view.ClassName))
{
sb.Append("Class: ").AppendLine(view.ClassName);
}
if (view.DesiredAccess != 0)
{
sb.Append("DesiredAccess: 0x")
.Append(view.DesiredAccess.ToString("X8", CultureInfo.InvariantCulture))
.AppendLine();
}
if (view.CorrelationFlags != 0)
{
sb.Append("CorrelationFlags: ")
.Append(EventDetailFormatting.DescribeCorrelationFlags(view.CorrelationFlags))
.Append(" (0x")
.Append(view.CorrelationFlags.ToString("X8", CultureInfo.InvariantCulture))
.AppendLine(")");
}
if (view.CorrelationAccessMask != 0)
{
sb.Append("CorrelationAccess: ")
.Append(EventDetailFormatting.DescribeHandleAccess(view.CorrelationAccessMask))
.Append(" (0x")
.Append(view.CorrelationAccessMask.ToString("X8", CultureInfo.InvariantCulture))
.AppendLine(")");
}
if (view.CorrelationAgeMs != 0)
{
sb.Append("CorrelationAgeMs: ")
.Append(view.CorrelationAgeMs.ToString(CultureInfo.InvariantCulture))
.AppendLine();
}
if (!string.IsNullOrWhiteSpace(view.ImagePath))
{
sb.Append("ImagePath: ").AppendLine(view.ImagePath);
}
if (!string.IsNullOrWhiteSpace(view.OriginPath))
{
sb.Append("OriginPath: ").AppendLine(view.OriginPath);
}
if (!string.IsNullOrWhiteSpace(view.KeyPath))
{
sb.Append("KeyPath: ").AppendLine(view.KeyPath);
}
if (!string.IsNullOrWhiteSpace(view.ValueName))
{
sb.Append("ValueName: ").AppendLine(view.ValueName);
}
if (fields.TryGetValue("status", out string? status) && !string.IsNullOrWhiteSpace(status))
{
sb.Append("Status: ").AppendLine(status);
}
return sb.ToString().Trim();
}
private string GetApiGraphProcessName(uint pid)
{
if (pid == 0)
{
return string.Empty;
}
if (_currentSession != null && _currentSession.Pid == unchecked((int)pid))
{
return ExtractProcessName(_currentSession.Title);
}
ProcessSessionTab? knownTab = _processTabs.FirstOrDefault(x => x.Pid == unchecked((int)pid));
if (knownTab != null)
{
string knownName = ExtractProcessName(knownTab.Title);
if (!string.IsNullOrWhiteSpace(knownName))
{
return knownName;
}
}
try
{
using Process process = Process.GetProcessById(unchecked((int)pid));
return process.ProcessName;
}
catch
{
return string.Empty;
}
}
private static string ExtractProcessName(string? title)
{
if (string.IsNullOrWhiteSpace(title))
{
return string.Empty;
}
string trimmed = title.Trim();
int suffixIndex = trimmed.LastIndexOf(" (", StringComparison.Ordinal);
if (suffixIndex > 0 && trimmed.EndsWith(")", StringComparison.Ordinal))
{
return trimmed[..suffixIndex].Trim();
}
return trimmed;
}
private (string ActionSuffix, string DetailText) DescribeMemoryContextFromPages(ulong baseAddress)
{
PerformanceSample? latestSample =
_currentSession?.PerformanceHistory.Count > 0 ? _currentSession.PerformanceHistory[^1] : null;
MemoryPageSample? page = latestSample?.MemoryPages.FirstOrDefault(
x => baseAddress >= x.BaseAddress && baseAddress < (x.BaseAddress + x.RegionSize));
if (page == null)
{
return (string.Empty, string.Empty);
}
string suffix = string.IsNullOrWhiteSpace(page.Category) ? string.Empty
: $" in {page.Category.ToLowerInvariant()} region";
string detail = $"Region: {page.Category} | Protect: {page.ProtectLabel} | Type: {page.TypeLabel}\n";
return (suffix, detail);
}
private string DescribeMemoryImageContext(BrokerEtwEventView view, ulong baseAddress)
{
if (view.ImageBase == 0 || view.ImageSize == 0)
{
return string.Empty;
}
ulong imageEnd = view.ImageBase + view.ImageSize;
if (baseAddress < view.ImageBase || baseAddress >= imageEnd)
{
return string.Empty;
}
string moduleName = EventDetailFormatting.ModuleNameFromPath(view.ImagePath);
if (string.IsNullOrWhiteSpace(moduleName))
{
moduleName = "image";
}
string imagePathLine =
string.IsNullOrWhiteSpace(view.ImagePath) ? string.Empty : $"ImagePath: {view.ImagePath}\n";
return $"Image: {moduleName}\n" + imagePathLine + $"ImageBase: 0x{view.ImageBase:X}\n" +
$"ImageSize: 0x{view.ImageSize:X}\n";
}
private (string ActionSuffix, string DetailText)
DescribeMemoryRegionContext(BrokerEtwEventView view, ulong baseAddress, ulong regionSize)
{
if (baseAddress == 0)
{
return (string.Empty, string.Empty);
}
string imageContext = DescribeMemoryImageContext(view, baseAddress);
if (!string.IsNullOrWhiteSpace(imageContext))
{
string moduleName = EventDetailFormatting.ModuleNameFromPath(view.ImagePath);
string suffix = string.IsNullOrWhiteSpace(moduleName) ? string.Empty : $" in image {moduleName}";
return (suffix, imageContext);
}
(string pageActionSuffix, string pageContext) = DescribeMemoryContextFromPages(baseAddress);
if (!string.IsNullOrWhiteSpace(pageContext))
{
return (pageActionSuffix, pageContext);
}
if (view.DeepRegionType != 0 || view.DeepRegionProtect != 0 || regionSize != 0)
{
string typeLabel = EventDetailFormatting.DescribeMemoryType(
view.DeepRegionType != 0 ? view.DeepRegionType : view.StartRegionType);
string protectLabel = EventDetailFormatting.DescribeMemoryProtection(
view.DeepRegionProtect != 0 ? view.DeepRegionProtect : view.StartRegionProtect);
string detailText = string.Empty;
if (!string.IsNullOrWhiteSpace(typeLabel))
{
detailText += $"RegionType: {typeLabel}\n";
}
if (!string.IsNullOrWhiteSpace(protectLabel))
{
detailText += $"RegionProtect: {protectLabel}\n";
}
return (string.Empty, detailText);
}
return (string.Empty, string.Empty);
}
private ApiMemoryPageSignal GetOrCreateApiMemoryPageSignal(ulong page)
{
if (!_apiMemorySignalsByPage.TryGetValue(page, out ApiMemoryPageSignal? state))
{
state = new ApiMemoryPageSignal();
_apiMemorySignalsByPage[page] = state;
}
return state;
}
private static Dictionary<string, string> ParseReasonFields(string rawReason)
{
return EventDetailsParsing.ParseRawFields(rawReason);
}
private static Dictionary<string, string> BuildHookFieldMap(string rawReason, IReadOnlyList<ulong>? hookArgs,
uint hookArgCount)
{
Dictionary<string, string> fields = ParseReasonFields(rawReason);
int count = Math.Min((int)hookArgCount, hookArgs?.Count ?? 0);
for (int i = 0; i < count; i += 1)
{
string key = $"a{i}";
if (!fields.ContainsKey(key))
{
fields[key] = $"0x{hookArgs![i]:X}";
}
}
return fields;
}
private static Dictionary<string, string>
BuildHookFieldMap(BrokerEtwEventView view) => view.GetOrCreateHookFieldMap();
private static bool
IsHookKernelCaller(BrokerEtwEventView view) => (view.Flags & BlackbirdNative.IpcEtwFlagHookKernelCaller) != 0;
private static bool IsHookCurrentProcessTarget(BrokerEtwEventView view)
{
if ((view.Flags & BlackbirdNative.IpcEtwFlagHookTargetCurrentProcess) != 0)
{
return true;
}
uint processPid = view.ProcessPid != 0 ? view.ProcessPid : view.ActorPid;
return processPid != 0 && (view.TargetPid == 0 || view.TargetPid == processPid);
}
private static bool
IsHookImageSection(BrokerEtwEventView view) => (view.Flags & BlackbirdNative.IpcEtwFlagHookSectionImage) != 0;
private bool TryDescribeHookExecutionContext(BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields, out string headline,
out string detail)
{
headline = string.Empty;
detail = string.Empty;
if (!EventDetailFormatting.IsApiGraphCandidate(view))
{
return false;
}
string apiName = string.IsNullOrWhiteSpace(view.Operation) ? view.EventName : view.Operation;
bool kernelCaller = IsHookKernelCaller(view);
bool currentTarget = IsHookCurrentProcessTarget(view);
bool imageSection = IsHookImageSection(view);
if (kernelCaller)
{
headline = "Kernel Caller";
detail =
"ExecutionContext: this hook fired on a KernelMode caller path. Treat the call as kernel-originated activity or loader/manager plumbing, not a normal user thread directly invoking the API.";
return true;
}
if ((apiName.Equals("NtCreateSection", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("NtMapViewOfSection", StringComparison.OrdinalIgnoreCase)) &&
currentTarget && imageSection)
{
headline = "Loader / Image Mapping";
detail =
"ExecutionContext: image-backed section creation or mapping into the current process. This is commonly loader-style PE/DLL mapping and should be separated from private-memory execution or post-start runtime tampering.";
return true;
}
if (TryDescribeHookStartupContext(view, out string startupHeadline, out string startupDetail))
{
headline = startupHeadline;
detail = startupDetail;
return true;
}
if (!currentTarget && view.TargetPid != 0)
{
headline = "Cross-Process Runtime";
detail =
$"ExecutionContext: the API targets another process ({ProcessIdentityResolver.Describe(view.TargetPid)}). This is actual runtime cross-process activity, not local loader setup.";
return true;
}
headline = "User Runtime";
detail = "ExecutionContext: user-mode call path against the current process outside the startup window.";
return true;
}
private string BuildResolvedHookArgumentsText(string apiName, BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields)
{
List<(string Name, string Value)> args = ResolveHookArguments(apiName, view, fields);
if (args.Count == 0)
{
return string.Empty;
}
var sb = new StringBuilder(256);
sb.AppendLine("Arguments:");
for (int i = 0; i < args.Count; i += 1)
{
sb.Append(" ").Append(args[i].Name).Append(": ").AppendLine(args[i].Value);
}
return sb.ToString().TrimEnd();
}
private List<(string Name, string Value)> ResolveHookArguments(string apiName, BrokerEtwEventView view,
IReadOnlyDictionary<string, string> fields)
{
string name = apiName?.Trim() ?? string.Empty;
var args = new List<(string Name, string Value)>(8);
switch (name)
{
case "NtWriteVirtualMemory":
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "BaseAddress", ResolvePointer(view, fields, "a1", "c1", "base"));
AddResolvedArg(args, "Buffer", ResolvePointer(view, fields, "a2", "c2"));
AddResolvedArg(args, "BufferSize", ResolveSize(fields, "a3", "c3", "size"));
AddResolvedArg(args, "BytesWritten", ResolvePointer(view, fields, "a4", "c4"));
break;
case "NtReadVirtualMemory":
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "BaseAddress", ResolvePointer(view, fields, "a1", "c1", "base"));
AddResolvedArg(args, "Buffer", ResolvePointer(view, fields, "a2", "c2"));
AddResolvedArg(args, "BufferSize", ResolveSize(fields, "a3", "c3", "size"));
AddResolvedArg(args, "BytesRead", ResolvePointer(view, fields, "a4", "c4"));
break;
case "NtAllocateVirtualMemory":
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "BaseAddress*", ResolvePointer(view, fields, "a1", "c1", "base"));
AddResolvedArg(args, "ZeroBits", ResolveHex(fields, "a2", "c2"));
AddResolvedArg(args, "RegionSize*", ResolveSize(fields, "a3", "c3", "size"));
AddResolvedArg(args, "AllocationType", ResolveAllocationType(fields, "a4", "c4", "allocType"));
AddResolvedArg(args, "Protect", ResolveProtect(fields, "a5", "c5", "protect"));
break;
case "NtAllocateVirtualMemoryEx":
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "BaseAddress*", ResolvePointer(view, fields, "a1", "c1", "base"));
AddResolvedArg(args, "ZeroBits", ResolveHex(fields, "a2", "c2"));
AddResolvedArg(args, "RegionSize*", ResolveSize(fields, "a3", "c3", "size"));
AddResolvedArg(args, "AllocationType", ResolveAllocationType(fields, "a4", "c4", "allocType"));
AddResolvedArg(args, "ExtendedParameters", ResolvePointer(view, fields, "a5", "c5"));
AddResolvedArg(args, "ExtendedParameterCount", ResolveHex(fields, "a6", "c6"));
break;
case "NtProtectVirtualMemory":
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "BaseAddress*", ResolvePointer(view, fields, "a1", "c1", "base"));
AddResolvedArg(args, "RegionSize*", ResolveSize(fields, "a2", "c2", "size"));
AddResolvedArg(args, "NewProtect", ResolveProtect(fields, "a3", "c3", "newProtect"));
AddResolvedArg(args, "OldProtect*", ResolvePointer(view, fields, "a4", "c4"));
break;
case "NtCreateSection":
AddResolvedArg(args, "SectionHandle*", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "DesiredAccess", ResolveHex(fields, "a1", "c1"));
AddResolvedArg(args, "ObjectAttributes", ResolvePointer(view, fields, "a2", "c2"));
AddResolvedArg(args, "MaximumSize", ResolveSize(fields, "a3", "c3"));
AddResolvedArg(args, "SectionPageProtection", ResolveProtect(fields, "a4", "c4"));
AddResolvedArg(args, "AllocationAttributes", ResolveHex(fields, "a5", "c5"));
AddResolvedArg(args, "FileHandle", ResolvePointer(view, fields, "a6", "c6"));
break;
case "NtMapViewOfSection":
AddResolvedArg(args, "SectionHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a1", "c1"));
AddResolvedArg(args, "BaseAddress*", ResolvePointer(view, fields, "a2", "c2", "base"));
AddResolvedArg(args, "ViewSize*", ResolveSize(fields, "a6", "c3", "size"));
AddResolvedArg(args, "InheritDisposition", ResolveHex(fields, "a7", "c4"));
AddResolvedArg(args, "AllocationType", ResolveAllocationType(fields, "c5"));
AddResolvedArg(args, "Win32Protect", ResolveProtect(fields, "c6"));
break;
case "NtMapViewOfSectionEx":
AddResolvedArg(args, "SectionHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a1", "c1"));
AddResolvedArg(args, "BaseAddress*", ResolvePointer(view, fields, "a2", "c2", "base"));
AddResolvedArg(args, "SectionOffset*", ResolvePointer(view, fields, "a3", "c7"));
AddResolvedArg(args, "ViewSize*", ResolveSize(fields, "a4", "c3", "size"));
AddResolvedArg(args, "AllocationType", ResolveAllocationType(fields, "a5", "c4"));
AddResolvedArg(args, "Win32Protect", ResolveProtect(fields, "a6", "c5"));
AddResolvedArg(args, "ExtendedParameters", ResolvePointer(view, fields, "a7", "c6"));
break;
case "NtQueryInformationProcess":
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "ProcessInformationClass", ResolveProcessInformationClass(fields, "a1", "c1"));
AddResolvedArg(args, "ProcessInformation", ResolvePointer(view, fields, "a2", "c2"));
AddResolvedArg(args, "ProcessInformationLength", ResolveSize(fields, "a3", "c3"));
AddResolvedArg(args, "ReturnLength", ResolvePointer(view, fields, "a4", "c4"));
break;
case "NtQueryInformationThread":
AddResolvedArg(args, "ThreadHandle", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "ThreadInformationClass", ResolveHex(fields, "a1", "c1"));
AddResolvedArg(args, "ThreadInformation", ResolvePointer(view, fields, "a2", "c2"));
AddResolvedArg(args, "ThreadInformationLength", ResolveSize(fields, "a3", "c3"));
AddResolvedArg(args, "ReturnLength", ResolvePointer(view, fields, "a4", "c4"));
break;
case "NtQuerySystemInformation":
case "NtQuerySystemInformationEx":
AddResolvedArg(args, "SystemInformationClass", ResolveSystemInformationClass(fields, "a0", "c0"));
AddResolvedArg(args, "InputBuffer", ResolvePointer(view, fields, "a1", "c1"));
AddResolvedArg(args, "InputBufferLength", ResolveSize(fields, "a2", "c2"));
AddResolvedArg(args, "SystemInformation", ResolvePointer(view, fields, "a3", "c3"));
AddResolvedArg(args, "SystemInformationLength", ResolveSize(fields, "a4", "c4"));
AddResolvedArg(args, "ReturnLength", ResolvePointer(view, fields, "a5", "c5"));
break;
case "NtQueryPerformanceCounter":
AddResolvedArg(args, "RawCounter", ResolveHex(fields, "rawCounter", "a0", "c0"));
AddResolvedArg(args, "VirtualCounter", ResolveHex(fields, "virtualCounter", "a1", "c1"));
AddResolvedArg(args, "RawDelta", ResolveHex(fields, "rawDelta", "a2", "c2"));
AddResolvedArg(args, "VirtualDelta", ResolveHex(fields, "virtualDelta", "a3", "c3"));
AddResolvedArg(args, "CorrectionTicks", ResolveHex(fields, "correctionTicks", "a4", "c4"));
AddResolvedArg(args, "SourceFlags", ResolveHex(fields, "sourceFlags", "a5", "c5"));
AddResolvedArg(args, "AutoBiasTicks", ResolveHex(fields, "autoBiasTicks", "a6", "c6"));
break;
case "NtCreateThreadEx":
AddResolvedArg(args, "ThreadHandle*", ResolvePointer(view, fields, "a0", "c0"));
AddResolvedArg(args, "DesiredAccess", ResolveHex(fields, "a1", "c1"));
AddResolvedArg(args, "ProcessHandle", ResolvePointer(view, fields, "a2", "c2"));
AddResolvedArg(args, "StartRoutine", ResolvePointer(view, fields, "a3", "c3"));
AddResolvedArg(args, "Argument", ResolvePointer(view, fields, "a4", "c4"));
AddResolvedArg(args, "CreateFlags", ResolveHex(fields, "a5", "c5"));
AddResolvedArg(args, "StackSize", ResolveSize(fields, "a6", "c6"));
AddResolvedArg(args, "MaximumStackSize", ResolveSize(fields, "a7", "c7"));
break;
case "RtlAddFunctionTable":
AddResolvedArg(args, "FunctionTable", ResolvePointer(view, fields, "a0"));
AddResolvedArg(args, "EntryCount", ResolveHex(fields, "a1"));
AddResolvedArg(args, "BaseAddress", ResolvePointer(view, fields, "a2", "baseAddress"));
break;
case "RtlInstallFunctionTableCallback":
AddResolvedArg(args, "TableIdentifier", ResolvePointer(view, fields, "a0"));
AddResolvedArg(args, "BaseAddress", ResolvePointer(view, fields, "a1", "baseAddress"));
AddResolvedArg(args, "Length", ResolveSize(fields, "a2", "length"));
AddResolvedArg(args, "Callback", ResolvePointer(view, fields, "a3", "callback"));
break;
case "RtlDeleteFunctionTable":
AddResolvedArg(args, "FunctionTable", ResolvePointer(view, fields, "a0", "table"));
break;
default:
for (int i = 0; i < 8; i += 1)
{
string value = ResolvePointer(view, fields, $"a{i}", $"c{i}");
AddResolvedArg(args, $"Arg{i}", value);
}
break;
}
return args;
}
private static void AddResolvedArg(List<(string Name, string Value)> args, string name, string? value)
{
if (!string.IsNullOrWhiteSpace(value))
{
args.Add((name, value));
}
}
private string ResolvePointer(BrokerEtwEventView view, IReadOnlyDictionary<string, string> fields,
params string[] keys)
{
ulong value = FirstU64(fields, keys);
return value == 0 ? string.Empty : FormatObservedPointer(view, value);
}
private static string ResolveSize(IReadOnlyDictionary<string, string> fields, params string[] keys)
{
ulong value = FirstU64(fields, keys);
return value == 0 ? string.Empty : $"0x{value:X}";
}
private static string ResolveHex(IReadOnlyDictionary<string, string> fields, params string[] keys)
{
ulong value = FirstU64(fields, keys);
return value == 0 ? string.Empty : $"0x{value:X}";
}
private static string ResolveProtect(IReadOnlyDictionary<string, string> fields, params string[] keys)
{
uint value = (uint)FirstU64(fields, keys);
return value == 0 ? string.Empty : $"0x{value:X} ({DescribeMemoryProtect(value)})";
}
private static string ResolveAllocationType(IReadOnlyDictionary<string, string> fields, params string[] keys)
{
uint value = (uint)FirstU64(fields, keys);
return value == 0 ? string.Empty : $"0x{value:X} ({DescribeMemoryAllocationType(value)})";
}
private static string ResolveProcessInformationClass(IReadOnlyDictionary<string, string> fields,
params string[] keys)
{
uint value = (uint)FirstU64(fields, keys);
if (value == 0)
{
return string.Empty;
}
string label = value switch {
0 => "ProcessBasicInformation",
7 => "ProcessDebugPort",
26 => "ProcessWow64Information",
27 => "ProcessImageFileName",
29 => "ProcessBreakOnTermination",
30 => "ProcessDebugObjectHandle",
31 => "ProcessDebugFlags",
43 => "ProcessImageFileNameWin32",
_ => "Unknown"
};
return $"0x{value:X} ({label})";
}
private static string ResolveSystemInformationClass(IReadOnlyDictionary<string, string> fields,
params string[] keys)
{
uint value = (uint)FirstU64(fields, keys);
if (value == 0)
{
return string.Empty;
}
string label = value switch {
5 => "SystemProcessInformation",
11 => "SystemModuleInformation",
35 => "SystemKernelDebuggerInformation",
76 => "SystemFirmwareTableInformation",
103 => "SystemCodeIntegrityInformation",
_ => "Unknown"
};
return $"0x{value:X} ({label})";
}
private static string BuildGenericApiActionLabel(string apiName, IReadOnlyDictionary<string, string> fields)
{
if (apiName.Equals("NtCreateThreadEx", StringComparison.OrdinalIgnoreCase))
{
ulong startAddress = FirstU64(fields, "a3", "c3");
ulong targetHandle = FirstU64(fields, "a2", "c0");
return $"Creates thread (start 0x{startAddress:X}) via target handle 0x{targetHandle:X}";
}
if (apiName.Equals("NtWriteVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
ulong address = FirstU64(fields, "a1", "c0");
ulong size = FirstU64(fields, "a3", "c1");
return $"Writes 0x{size:X} bytes into virtual memory at 0x{address:X}";
}
if (apiName.Equals("NtReadVirtualMemory", StringComparison.OrdinalIgnoreCase))
{
ulong address = FirstU64(fields, "a1", "c0");
ulong size = FirstU64(fields, "a3", "c1");
return $"Reads 0x{size:X} bytes from virtual memory at 0x{address:X}";
}
if (apiName.Equals("RtlAddFunctionTable", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("RtlInstallFunctionTableCallback", StringComparison.OrdinalIgnoreCase))
{
ulong baseAddress = FirstU64(fields, "baseAddress", "a2", "a1");
return $"Registers unwind metadata for region near 0x{baseAddress:X}";
}
if (apiName.Equals("RtlDeleteFunctionTable", StringComparison.OrdinalIgnoreCase))
{
ulong table = FirstU64(fields, "table", "a0");
return $"Deletes dynamic unwind metadata table 0x{table:X}";
}
if (apiName.Equals("WSASend", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("send", StringComparison.OrdinalIgnoreCase))
{
return "Sends network payload";
}
if (apiName.Equals("WSARecv", StringComparison.OrdinalIgnoreCase) ||
apiName.Equals("recv", StringComparison.OrdinalIgnoreCase))
{
return "Receives network payload";
}
if (fields.TryGetValue("kind", out string? kind) && !string.IsNullOrWhiteSpace(kind))
{
return $"{kind} call: {apiName}";
}
return apiName;
}
private static ulong FirstU64(IReadOnlyDictionary<string, string> fields, params string[] keys)
{
foreach (string key in keys)
{
if (fields.TryGetValue(key, out string? value) && TryReadU64(value, out ulong parsed))
{
return parsed;
}
}
return 0;
}
private static bool TryReadU64(string? text, out ulong value)
{
value = 0;
if (string.IsNullOrWhiteSpace(text))
{
return false;
}
string compact = text.Trim();
if (compact.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
{
return ulong.TryParse(compact[2..], NumberStyles.HexNumber, CultureInfo.InvariantCulture, out value);
}
return ulong.TryParse(compact, NumberStyles.Integer, CultureInfo.InvariantCulture, out value);
}
private static bool TryReadDouble(IReadOnlyDictionary<string, string> fields, out double value,
params string[] keys)
{
foreach (string key in keys)
{
if (fields.TryGetValue(key, out string? text) &&
double.TryParse(text, NumberStyles.Float, CultureInfo.InvariantCulture, out value))
{
return true;
}
}
value = 0;
return false;
}
private static string DescribeMemoryProtect(uint protect)
{
return EventDetailFormatting.DescribeMemoryProtection(protect);
}
private static string DescribeMemoryAllocationType(uint allocType)
{
var labels = new List<string>(4);
if ((allocType & 0x1000) != 0)
{
labels.Add("MEM_COMMIT");
}
if ((allocType & 0x2000) != 0)
{
labels.Add("MEM_RESERVE");
}
if ((allocType & 0x1000000) != 0)
{
labels.Add("MEM_LARGE_PAGES");
}
if ((allocType & 0x20000) != 0)
{
labels.Add("MEM_PHYSICAL");
}
return labels.Count == 0 ? "<none>" : string.Join(" | ", labels);
}
private static double ComputeSampleEntropyBits(byte[]? data, int length)
{
if (data == null || data.Length == 0 || length <= 1)
{
return -1;
}
int sampleLength = Math.Min(length, data.Length);
Span<int> counts = stackalloc int[256];
for (int i = 0; i < sampleLength; i += 1)
{
counts[data[i]] += 1;
}
double entropy = 0;
for (int i = 0; i < counts.Length; i += 1)
{
int count = counts[i];
if (count == 0)
{
continue;
}
double p = count / (double)sampleLength;
entropy -= p * Math.Log(p, 2.0);
}
return entropy;
}
private sealed class ApiMemoryPageSignal
{
public uint Protect { get; set; }
public int ProtectFlipCount { get; set; }
public double LastEntropyBits { get; set; } = double.NaN;
public int EntropyFlipCount { get; set; }
public DateTime LastProtectChangeUtc { get; set; }
public DateTime LastEntropyChangeUtc { get; set; }
}
private sealed class RecentImageFileAccess
{
public DateTime TimestampUtc { get; init; }
public uint Pid { get; init; }
public uint Tid { get; init; }
public uint Operation { get; init; }
public string Path { get; init; } = string.Empty;
public string FileName { get; init; } = string.Empty;
}
private sealed class RecentImageMapState
{
public DateTime FirstSeenUtc { get; set; }
public DateTime LastSeenUtc { get; set; }
public string Path { get; set; } = string.Empty;
public string LastApi { get; set; } = string.Empty;
public int Count { get; set; }
public RecentImageFileAccess? LastLinkedFileAccess { get; set; }
public RecentImageMapState Clone() => new() { FirstSeenUtc = FirstSeenUtc,
LastSeenUtc = LastSeenUtc,
Path = Path,
LastApi = LastApi,
Count = Count,
LastLinkedFileAccess = LastLinkedFileAccess };
}
private readonly struct ApiCallStructuredFields
{
internal string Action { get; init; }
internal string Field1Label { get; init; }
internal string Field2Label { get; init; }
internal string Field3Label { get; init; }
internal string Field4Label { get; init; }
internal string Field1Value { get; init; }
internal string Field2Value { get; init; }
internal string Field3Value { get; init; }
internal string Field4Value { get; init; }
}
private enum BackendUiWorkKind
{
Ioctl,
Etw,
Status
}
private readonly struct BackendUiWorkItem
{
internal BackendUiWorkKind Kind { get; }
internal TelemetryEvent? Telemetry { get; }
internal ProcessRelationView? Relation { get; }
internal HeuristicEventView? Heuristic { get; }
internal ThreadLifecycleEventSample? ThreadLifecycle { get; }
internal IoctlParsedEvent? Filesystem { get; }
internal IoctlParsedEvent? Registry { get; }
internal BrokerEtwEventView? EtwView { get; }
internal string? StatusLine { get; }
private BackendUiWorkItem(BackendUiWorkKind kind, TelemetryEvent? telemetry, ProcessRelationView? relation,
HeuristicEventView? heuristic, ThreadLifecycleEventSample? threadLifecycle,
IoctlParsedEvent? filesystem, IoctlParsedEvent? registry,
BrokerEtwEventView? etwView, string? statusLine)
{
Kind = kind;
Telemetry = telemetry;
Relation = relation;
Heuristic = heuristic;
ThreadLifecycle = threadLifecycle;
Filesystem = filesystem;
Registry = registry;
EtwView = etwView;
StatusLine = statusLine;
}
internal static BackendUiWorkItem
FromIoctl(TelemetryEvent? telemetry, ProcessRelationView? relation, HeuristicEventView? heuristic,
ThreadLifecycleEventSample? threadLifecycle, IoctlParsedEvent? filesystem,
IoctlParsedEvent? registry = null) => new(BackendUiWorkKind.Ioctl, telemetry, relation,
heuristic, threadLifecycle, filesystem, registry,
null, null);
internal static BackendUiWorkItem FromEtw(BrokerEtwEventView etwView) => new(BackendUiWorkKind.Etw, null,
null, null, null, null, null,
etwView, null);
internal static BackendUiWorkItem FromStatus(string statusLine) => new(BackendUiWorkKind.Status, null, null,
null, null, null, null, null,
statusLine);
}
private void SaveIntelSessionState(int pid)
{
if (pid <= 0)
{
return;
}
_etwHistoryByPid[pid] = EtwPaneHost.SnapshotItems().Select(x => x.Clone()).ToList();
_heuristicsHistoryByPid[pid] = HeuristicsPaneHost.SnapshotItems().Select(x => x.Clone()).ToList();
_filesystemHistoryByPid[pid] = FilesystemPaneHost.SnapshotItems().Select(x => x.Clone()).ToList();
_registryHistoryByPid[pid] = RegistryPaneHost.SnapshotItems().Select(x => x.Clone()).ToList();
_relationsHistoryByPid[pid] = ProcessRelationsPaneHost.SnapshotItems().Select(x => x.Clone()).ToList();
_apiGraphHistoryByPid[pid] = _apiGraphRowsByKey.Values.Select(static x => x.Clone()).ToList();
_extendedHistoryByPid[pid] = _extendedRowsByKey.Values.Select(static x => x.Clone()).ToList();
}
private void RestoreIntelSessionState(int pid)
{
IEnumerable<GroupedEventRow> etw =
_etwHistoryByPid.TryGetValue(pid, out var a) ? a : Array.Empty<GroupedEventRow>();
IEnumerable<GroupedEventRow> heur =
_heuristicsHistoryByPid.TryGetValue(pid, out var c) ? c : Array.Empty<GroupedEventRow>();
IEnumerable<GroupedEventRow> fs =
_filesystemHistoryByPid.TryGetValue(pid, out var d) ? d : Array.Empty<GroupedEventRow>();
IEnumerable<GroupedEventRow> reg =
_registryHistoryByPid.TryGetValue(pid, out var dr) ? dr : Array.Empty<GroupedEventRow>();
IEnumerable<GroupedEventRow> rel =
_relationsHistoryByPid.TryGetValue(pid, out var e) ? e : Array.Empty<GroupedEventRow>();
IEnumerable<ApiCallGraphRowSnapshot> apiGraph =
_apiGraphHistoryByPid.TryGetValue(pid, out var f) ? f : Array.Empty<ApiCallGraphRowSnapshot>();
IEnumerable<ExtendedActivityRowSnapshot> extended =
_extendedHistoryByPid.TryGetValue(pid, out var g) ? g : Array.Empty<ExtendedActivityRowSnapshot>();
EtwPaneHost.LoadHistory(etw.Select(x => x.Clone()).ToList());
HeuristicsPaneHost.LoadHistory(heur.Select(x => x.Clone()).ToList());
FilesystemPaneHost.LoadHistory(fs.Select(x => x.Clone()).ToList());
RegistryPaneHost.LoadHistory(reg.Select(x => x.Clone()).ToList());
ProcessRelationsPaneHost.SetRootPid(pid);
ProcessRelationsPaneHost.LoadHistory(rel.Select(x => x.Clone()).ToList());
_apiGraphRowsByKey.Clear();
_extendedRowsByKey.Clear();
_apiGraphReasonByKey.Clear();
_apiGraphActionByKey.Clear();
_apiGraphDecodedByKey.Clear();
_apiGraphFramesByKey.Clear();
_apiGraphSensorByKey.Clear();
_apiGraphTimelineLastEmitByKey.Clear();
_observedHookStackLastPersistByThread.Clear();
_threadStackFallbackLastCaptureByThread.Clear();
_pendingThreadStackFallbackCaptures.Clear();
_apiMemorySignalsByPage.Clear();
_crossProcWriteCountByPair.Clear();
_crossProcRwxAllocCountByPair.Clear();
_antiAnalysisCountByEvidence.Clear();
ResetImageMapCorrelationCaches();
_extendedViewRows.Clear();
foreach (ApiCallGraphRowSnapshot row in apiGraph)
{
string sensorOrigin = string.IsNullOrWhiteSpace(row.SensorOrigin) ? "Unclassified" : row.SensorOrigin;
string callerOrigin = NormalizeApiCallerOrigin(row.CallerOrigin);
string originModule = NormalizeApiOriginModule(row.OriginModule);
string key = BuildApiGraphKey(row.SourcePid, row.TargetPid, row.ThreadId, row.ApiName, sensorOrigin,
callerOrigin, originModule);
_apiGraphRowsByKey[key] = row.Clone();
_apiGraphSensorByKey[key] = sensorOrigin;
}
foreach (ExtendedActivityRowSnapshot row in extended)
{
string key = BuildExtendedActivityKey(row.TypeLabel, row.ActorLabel, row.TargetLabel, row.SubjectLabel,
row.OperationLabel);
_extendedRowsByKey[key] = row.Clone();
}
PublishApiGraphSnapshot();
PublishExtendedActivitySnapshot();
if (EtwPaneHost.ItemCount > 0)
{
FindExplorerItem("ETW")?.PushPreviewValue(EtwPaneHost.TotalRawCount);
}
if (HeuristicsPaneHost.ItemCount > 0)
{
FindExplorerItem("Heuristics")?.PushPreviewValue(HeuristicsPaneHost.TotalRawCount);
}
if (FilesystemPaneHost.ItemCount > 0)
{
FindExplorerItem("Filesystem")?.PushPreviewValue(FilesystemPaneHost.TotalRawCount);
}
if (RegistryPaneHost.ItemCount > 0)
{
FindExplorerItem("Registry")?.PushPreviewValue(RegistryPaneHost.TotalRawCount);
}
if (ProcessRelationsPaneHost.ItemCount > 0)
{
FindExplorerItem("Process Relations")?.PushPreviewValue(ProcessRelationsPaneHost.TotalRawCount);
}
RefreshExplorerDataBadges();
}
private static System.Windows.Media.Brush BuildApiSensorBackground(string sensor)
{
return sensor.StartsWith("Kernel", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x45, 0x1A, 0x1A))
: sensor.StartsWith("Usermode", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x12, 0x2D, 0x4A))
: new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x24, 0x24, 0x24));
}
private static System.Windows.Media.Brush BuildApiSensorForeground(string sensor)
{
return sensor.StartsWith("Kernel", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xFF, 0xC7, 0xC7))
: sensor.StartsWith("Usermode", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xB9, 0xE3, 0xFF))
: new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xD0, 0xD0, 0xD0));
}
private static System.Windows.Media.Brush BuildApiHeatTrackBackground(string sensor, string callerOrigin)
{
callerOrigin = NormalizeApiCallerOrigin(callerOrigin);
return callerOrigin switch {
"process-image" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x0F, 0x31, 0x2C)),
"non-system-dll" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x38, 0x28, 0x10)),
"unbacked" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x3E, 0x10, 0x22)),
"system" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x23, 0x28, 0x31)),
_ =>
sensor.StartsWith("Kernel", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x3A, 0x18, 0x18))
: sensor.StartsWith("Usermode", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x13, 0x27, 0x3D))
: new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x21, 0x26, 0x2D))
};
}
private static System.Windows.Media.Brush BuildApiHeatFillBackground(string sensor, string callerOrigin)
{
callerOrigin = NormalizeApiCallerOrigin(callerOrigin);
return callerOrigin switch {
"process-image" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x4D, 0xBF, 0xA9)),
"non-system-dll" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xD8, 0xA1, 0x45)),
"unbacked" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xD1, 0x4E, 0x75)),
"system" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x6C, 0x78, 0x88)),
_ =>
sensor.StartsWith("Kernel", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xB2, 0x4A, 0x4A))
: sensor.StartsWith("Usermode", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x3E, 0x84, 0xC6))
: new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x5C, 0x66, 0x73))
};
}
private static System.Windows.Media.Brush BuildApiRowBackground(string sensor, string callerOrigin)
{
callerOrigin = NormalizeApiCallerOrigin(callerOrigin);
return callerOrigin switch { "process-image" => new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromArgb(0x4A, 0x0E, 0x58, 0x4D)),
"non-system-dll" => new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromArgb(0x4A, 0x66, 0x43, 0x0D)),
"unbacked" => new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromArgb(0x52, 0x71, 0x18, 0x33)),
"system" => new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromArgb(0x30, 0x35, 0x3C, 0x45)),
_ => sensor.StartsWith("Kernel", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromArgb(0x44, 0x6E, 0x1D, 0x1D))
: sensor.StartsWith("Usermode", StringComparison.OrdinalIgnoreCase)
? new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromArgb(0x44, 0x16, 0x39, 0x59))
: new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromArgb(0x22, 0x36, 0x36, 0x36)) };
}
private static System.Windows.Media.Brush BuildApiRowBorder(string sensor, string callerOrigin)
{
_ = sensor;
callerOrigin = NormalizeApiCallerOrigin(callerOrigin);
return callerOrigin switch {
"process-image" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x64, 0xD9, 0xC1)),
"non-system-dll" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xE2, 0xB0, 0x5E)),
"unbacked" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xE0, 0x65, 0x8D)),
"system" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x6F, 0x7C, 0x8A)),
_ => new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x44, 0x4C, 0x56))
};
}
private static System.Windows.Media.Brush BuildApiGraphEdgeBrush(string sensor, string callerOrigin,
double heat)
{
heat = Math.Clamp(heat, 0.0, 1.0);
callerOrigin = NormalizeApiCallerOrigin(callerOrigin);
if (callerOrigin == "process-image")
{
byte red = (byte)Math.Clamp(62 + (int)Math.Round(28 * heat), 0, 255);
byte green = (byte)Math.Clamp(176 + (int)Math.Round(48 * heat), 0, 255);
byte blue = (byte)Math.Clamp(152 + (int)Math.Round(40 * heat), 0, 255);
return new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(red, green, blue));
}
if (callerOrigin == "non-system-dll")
{
byte red = (byte)Math.Clamp(180 + (int)Math.Round(48 * heat), 0, 255);
byte green = (byte)Math.Clamp(128 + (int)Math.Round(40 * heat), 0, 255);
byte blue = (byte)Math.Clamp(52 + (int)Math.Round(18 * heat), 0, 255);
return new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(red, green, blue));
}
if (callerOrigin == "unbacked")
{
byte red = (byte)Math.Clamp(194 + (int)Math.Round(38 * heat), 0, 255);
byte green = (byte)Math.Clamp(68 + (int)Math.Round(22 * heat), 0, 255);
byte blue = (byte)Math.Clamp(112 + (int)Math.Round(32 * heat), 0, 255);
return new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(red, green, blue));
}
if (callerOrigin == "system")
{
byte shade = (byte)Math.Clamp(118 + (int)Math.Round(52 * heat), 0, 255);
return new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromRgb(shade, shade, (byte)Math.Clamp(shade + 8, 0, 255)));
}
if (sensor.StartsWith("Kernel", StringComparison.OrdinalIgnoreCase))
{
byte red = (byte)Math.Clamp(150 + (int)Math.Round(80 * heat), 0, 255);
byte green = (byte)Math.Clamp(65 + (int)Math.Round(25 * heat), 0, 255);
byte blue = (byte)Math.Clamp(65 + (int)Math.Round(25 * heat), 0, 255);
return new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(red, green, blue));
}
if (sensor.StartsWith("Usermode", StringComparison.OrdinalIgnoreCase))
{
byte red = (byte)Math.Clamp(70 + (int)Math.Round(25 * heat), 0, 255);
byte green = (byte)Math.Clamp(125 + (int)Math.Round(45 * heat), 0, 255);
byte blue = (byte)Math.Clamp(178 + (int)Math.Round(50 * heat), 0, 255);
return new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(red, green, blue));
}
byte neutralShade = (byte)Math.Clamp(110 + (int)Math.Round(70 * heat), 0, 255);
return new System.Windows.Media.SolidColorBrush(
System.Windows.Media.Color.FromRgb(neutralShade, neutralShade, neutralShade));
}
private static System.Windows.Media.Brush BuildApiCallerOriginBackground(string callerOrigin)
{
return NormalizeApiCallerOrigin(callerOrigin) switch {
"process-image" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x14, 0x42, 0x39)),
"non-system-dll" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x4D, 0x34, 0x12)),
"unbacked" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x56, 0x16, 0x2D)),
"system" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x2C, 0x33, 0x3B)),
_ => new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0x26, 0x26, 0x26))
};
}
private static System.Windows.Media.Brush BuildApiCallerOriginForeground(string callerOrigin)
{
return NormalizeApiCallerOrigin(callerOrigin) switch {
"process-image" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xC0, 0xFF, 0xEE)),
"non-system-dll" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xFF, 0xE1, 0xB0)),
"unbacked" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xFF, 0xC2, 0xD4)),
"system" =>
new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xD2, 0xDA, 0xE2)),
_ => new System.Windows.Media.SolidColorBrush(System.Windows.Media.Color.FromRgb(0xD8, 0xD8, 0xD8))
};
}
private async Task RunPreflightAsync(int pid, bool userInitiated = false)
{
BlackbirdPreflightReport report;
try
{
report = await Task.Run(() => BlackbirdPreflight.Run(pid));
}
catch (Exception ex)
{
report = new BlackbirdPreflightReport { CheckedUtc = DateTime.UtcNow, DriverState = "Unknown",
ControllerState = "Unknown", Error = ex.Message };
DiagnosticsState.SetValue("Preflight", $"failed: {ex.Message}");
OutputCapture.AppendLine($"Preflight failed: {ex}");
}
_lastPreflight = report;
OutputCapture.AppendLine($"Preflight: {report.Summary}");
DiagnosticsState.SetValue("Driver Service", report.DriverDisplayState);
DiagnosticsState.SetValue("Controller Service", report.ControllerState);
DiagnosticsState.SetValue("Broker Caps", $"0x{report.BrokerCapabilities:X8}");
DiagnosticsState.SetValue("Broker TI", report.ThreatIntelEnabled ? "Enabled" : "Disabled");
DiagnosticsState.SetValue("Broker TI Enable Err", report.ThreatIntelEnableError.ToString());
DiagnosticsState.SetValue("Hook DLL", report.HookDllExists ? "Found" : $"Missing ({report.HookDllPath})");
ApplyConnectivityStatus(report, userInitiated);
}
private void ApplyConnectivityStatus(BlackbirdPreflightReport report, bool userInitiated)
{
var issues = new List<string>();
if (!string.IsNullOrWhiteSpace(report.Error))
{
issues.Add(report.Error);
}
if (!report.DriverRuntimeReady)
{
issues.Add($"driver service={report.DriverState}");
}
if (!string.Equals(report.ControllerState, "Running", StringComparison.OrdinalIgnoreCase))
{
issues.Add($"controller service={report.ControllerState}");
}
if (!report.BrokerConnectOk)
{
issues.Add("broker link down");
}
if (!report.DriverProxyOk)
{
issues.Add("driver proxy unavailable");
}
if (!report.HookDllExists)
{
issues.Add($"hook dll missing ({report.HookDllPath})");
}
if (report.EtwUplinkCapable && !report.EtwUplinkQueryOk)
{
issues.Add("ETW uplink query failed");
}
if (issues.Count == 0)
{
_lastConnectivityIssueSignature = null;
DiagnosticsState.SetValue("Connectivity", "OK");
SetBackendConnectivity(true);
return;
}
string detail = string.Join("; ", issues);
string signature = detail;
string msg = $"Could not fully connect to driver/service: {detail}";
DiagnosticsState.SetValue("Connectivity", $"FAILED: {detail}");
OutputCapture.AppendLine(msg);
SetBackendConnectivity(false);
bool shouldWarn =
userInitiated || !string.Equals(_lastConnectivityIssueSignature, signature, StringComparison.Ordinal);
if (shouldWarn)
{
ThemedMessageBox.Show(this, $"Could not fully connect to the driver/service uplink.\n\n{detail}",
"Blackbird Connectivity", MessageBoxButton.OK, MessageBoxImage.Warning);
}
_lastConnectivityIssueSignature = signature;
}
private async void Preflight_Click(object sender, RoutedEventArgs e)
{
StatusBlock.Text = "Status: Running preflight...";
await RunPreflightAsync(TryGetPid(), userInitiated: true);
if (_lastPreflight == null)
{
StatusBlock.Text = "Status: Preflight unavailable";
}
}
private void RegisterVm_Click(object sender, RoutedEventArgs e)
{
var window = new VmRegistrationWindow { Owner = this };
window.ShowDialog();
}
private async void DriverStart_Click(object sender, RoutedEventArgs e)
{
string message = "";
bool ok = await Task.Run(
() => BlackbirdServiceControl.TryStart("blackbird", TimeSpan.FromSeconds(8), out message));
OutputCapture.AppendLine(message);
if (!ok)
{
StatusBlock.Text = "Status: Failed to start blackbird";
return;
}
await RunPreflightAsync(TryGetPid(), userInitiated: true);
if (_lastConnectivityIssueSignature == null)
{
StatusBlock.Text = "Status: Driver started";
}
}
private async void DriverStop_Click(object sender, RoutedEventArgs e)
{
if (ThemedMessageBox.Show(this, "Stop the kernel driver 'blackbird'?", "Driver Stop",
MessageBoxButton.YesNo, MessageBoxImage.Warning) != MessageBoxResult.Yes)
{
return;
}
StopBackendSession();
string message = "";
bool ok = await Task.Run(
() => BlackbirdServiceControl.TryStop("blackbird", TimeSpan.FromSeconds(8), out message));
OutputCapture.AppendLine(message);
StatusBlock.Text = ok ? "Status: Driver stopped" : "Status: Failed to stop blackbird";
await RunPreflightAsync(TryGetPid(), userInitiated: true);
}
private async void ControllerRestart_Click(object sender, RoutedEventArgs e)
{
StopBackendSession();
string message = "";
bool ok = await Task.Run(
() => BlackbirdServiceControl.TryRestart("BlackbirdController", TimeSpan.FromSeconds(10), out message));
OutputCapture.AppendLine(message);
if (!ok)
{
StatusBlock.Text = "Status: Controller restart failed";
return;
}
await RunPreflightAsync(TryGetPid(), userInitiated: true);
int pid = TryGetPid();
bool useUsermodeHooks = _currentSession?.UseUsermodeHooks ?? false;
if (_currentSession != null && !_currentSession.OfflineSnapshot && !_currentSession.TargetExited &&
_currentSession.Pid == pid)
{
EnsureLiveCaptureStoreForCurrentSession(pid);
StartBackendForPid(pid, useUsermodeHooks, stopExistingSession: false);
}
else
{
StartBackendForPid(pid, useUsermodeHooks);
}
if (_lastConnectivityIssueSignature == null)
{
StatusBlock.Text = "Status: Controller restarted";
}
}
private sealed class RegionLifecycleState
{
public ulong ProcessStartKey { get; set; }
public uint TargetPid { get; set; }
public ulong BaseAddress { get; set; }
public ulong RegionSize { get; set; }
public string RegionKind { get; set; } = string.Empty;
public string ExecutionContext { get; set; } = string.Empty;
public bool ObservedByKernel { get; set; }
public bool ObservedByUserHook { get; set; }
public bool BlackbirdOwned { get; set; }
public bool CrossProcess { get; set; }
public bool ImageBacked { get; set; }
public uint InitialProtection { get; set; }
public uint PreviousProtection { get; set; }
public uint CurrentProtection { get; set; }
public bool FirstExecutableTransitionSeen { get; set; }
public bool FirstThreadStartSeen { get; set; }
public ulong FirstThreadStartAddress { get; set; }
public bool FunctionTableRegistered { get; set; }
public uint MapCount { get; set; }
public uint WriteCount { get; set; }
public uint ProtectCount { get; set; }
public uint ThreadStartCount { get; set; }
public uint ProtectFlipCount { get; set; }
public uint RapidProtectFlipCount { get; set; }
public uint ExecutableFlipCount { get; set; }
public uint GuardNoAccessFlipCount { get; set; }
public uint WritableExecutableFlipCount { get; set; }
public string LastProtectionTransition { get; set; } = string.Empty;
public DateTime LastProtectChangeUtc { get; set; }
public double LastEntropyBits { get; set; } = -1;
public double MaxEntropyBits { get; set; } = -1;
public uint EntropyFlipCount { get; set; }
public uint RapidEntropyFlipCount { get; set; }
public uint HighEntropyWriteCount { get; set; }
public DateTime LastEntropyChangeUtc { get; set; }
public uint LastSampleBytes { get; set; }
}
}
}
Reference in New Issue View Git Blame Copy Permalink