admin/jdu2600-API-To-ETW
1
0
Fork 0
mirror of https://github.com/jdu2600/API-To-ETW synced 2026-06-06 15:54:29 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
jdu2600-API-To-ETW/DumpEtwWrites.java
T
John Uhlmann c93afeea75 make search depth adaptive
2024-07-26 16:48:24 +08:00

2052 lines
101 KiB
Java
Raw Permalink Blame History

/*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
// Outputs all calls to EtwWrite* reachable from each function along with provider and event metadata.
//
// functions.txt - functions to analyze. Defaults to exports otherwise.
// ignore.txt - functions to ignore - especially error handling paths.
//
// Kernel-mode ETW functions are prefixed with Etw, the Win32 equivalents with Event and the native API ones with EtwEvent.
// All APIs take the same parameters so this script should partially work on every binary.
//
//@category Functions.ETW
//@author jdu2600
import java.io.*;
import java.lang.Math.*;
import java.nio.file.*;
import java.util.*;
import java.util.stream.*;
import generic.stl.Pair;
import docking.options.OptionsService;
import ghidra.app.cmd.function.*;
import ghidra.app.decompiler.*;
import ghidra.app.script.*;
import ghidra.app.services.*;
import ghidra.framework.options.*;
import ghidra.framework.plugintool.util.*;
import ghidra.program.model.address.*;
import ghidra.program.model.data.*;
import ghidra.program.model.listing.*;
import ghidra.program.model.pcode.*;
import ghidra.program.model.symbol.*;
import ghidra.program.model.util.*;
import ghidra.util.exception.*;
public class DumpEtwWrites extends GhidraScript {
// **********************
// Configurable Settings
// quickscan: stop processing after maxEvents have been found, or extraCallDepth/maxExportCallDepth has been reached
private Boolean quickScan = true;
// maxEvents: maximum events to report per API
private int maxEvents = 100;
// maxCallDepth: maximum call depth to search for events
private int maxCallDepth = 5;
// extraCallDepth: maximum additional call depth to search for events
private int extraCallDepth = 1;
// maxExportCallDepth: maximum depth of exported functions to search
private int maxExportCallDepth = 0;
// debugPrint: verbose logging
private Boolean debugPrint = false;
// decompileTimeoutSeconds: per-function timeout for Ghidra decompilation
private int decompileTimeoutSeconds = 60;
// **********************
private String functionsFile = "functions.txt"; // analyse these functions
private String ignoreFile = "ignore.txt"; // ignore these functions
private DataType eventDescriptorType = null;
private DataType ucharType = null;
private DataType ushortType = null;
private DataType ulonglongType = null;
private DataType guidType = null;
private DataType stringType = null;
private DecompInterface decomplib = null;
private Set<String> exports = null;
private Set<String> functions = null;
private Set<String> ignored = null;
private PrintWriter csv = null;
private Dictionary<Long,Pair<String,String>> providerGuidMap = new Hashtable<Long,Pair<String,String>>(); // Address, (Guid, GuidSymbol)
private List<String> notYetImplemented = new LinkedList<String>();
@Override
public void run() throws Exception {
printf("\n\n--==[ DumpEtwWrites ]==--\n");
printf(" * %s\n", currentProgram.getName());
if(quickScan)
printf(" * quick scan mode - maxCallDepth=%d extraCallDepth=%d maxExportCallDepth=%d\n", maxCallDepth, extraCallDepth, maxExportCallDepth);
else
printf(" * full scan mode - finding all reachable ETW writes\n");
// we want the names of all exports - as we use these as a measure of relevance
// for a given ETW write
exports = new HashSet<String>();
for(Symbol symbol : currentProgram.getSymbolTable().getAllSymbols(false))
if (symbol.isExternalEntryPoint())
exports.add(symbol.getName());
printf(" * found %d exports\n", exports.size());
// provide a list of the functions that you want to analyse, finding the ETW writes
// if not provided, all exports will be parsed
// e.g. this could be the list of Native API syscalls
// or a list of RPC methods e.g. using xpn's RpcEnum
try {
functions = new HashSet<String>(Files.readAllLines(Paths.get(functionsFile)));
printf(" * analysing %d functions from %s\n", functions.size(), FileSystems.getDefault().getPath(functionsFile));
}
catch(Exception e) {
if(exports.contains("NtQuerySystemInformation")) {
functions = new HashSet<String>();
for(String func : exports) {
if(func.startsWith("Nt"))
functions.add(func);
if(func.startsWith("Zw"))
functions.add(func.replaceFirst("Zw", "Nt"));
}
for(String func : functions)
if(func.startsWith("Nt"))
exports.add(func);
printf(" * %s not provided - analysing all %d syscalls instead\n", functionsFile, functions.size());
} else {
functions = exports;
printf(" * %s not provided - analysing all %d exports instead\n", functionsFile, functions.size());
}
Files.write(FileSystems.getDefault().getPath("exports.txt"), exports);
}
// optionally provide a list of functions you want to ignore
// e.g. common error handling functions like KeBugCheckEx
try {
ignored = new HashSet<String>(Files.readAllLines(Paths.get(ignoreFile)));
printf(" * ignoring %d functions\n", ignored.size());
}
catch(Exception e)
{
ignored = new HashSet<String>();
}
// prepare the output file
File csvFile = new File(currentProgram.getName() + ".csv");
csvFile.delete();
printf(" * output will be written to %s\n", csvFile.getAbsolutePath());
csv = new PrintWriter(csvFile);
csv.println("Function,ProviderGuid,ProviderSymbol,ReghandleSymbol,WriteFunction,EventDescriptorSymbol,Id,Version,Channel,Level,Opcode,Task,Keyword,ContainingFunction,CallDepth,ExportedCallDepth,CallPath");
setUpDataTypes();
setUpDecompiler(currentProgram);
if (!decomplib.openProgram(currentProgram)) {
println("Decompiler Setup Error: " + decomplib.getLastMessage());
return;
}
try {
/* first we cache the REGHANDLE address and the GUID of all register ETW Providers so that we can later
* match ETW events to the Provider GUIDs
*
* providers are registered via [Etw|Event]Register(LPCGUID ProviderId, .., .., PREGHANDLE RegHandle)
*
* https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-etwregister
* https://docs.microsoft.com/en-us/windows/win32/api/evntprov/nf-evntprov-eventregister
*/
for(String etwRegisterFuncName : etwRegisterFuncs) {
List<Function> etwRegisterFuncList = getGlobalFunctions(etwRegisterFuncName);
if(etwRegisterFuncList.size() > 1) {
println("Script aborted: Found " + etwRegisterFuncList.size() + " instances of " + etwRegisterFuncName);
return;
}
if(etwRegisterFuncList.size() == 0)
continue;
Function etwRegisterFunc = etwRegisterFuncList.get(0);
Reference[] refs = this.getSymbolAt(etwRegisterFunc.getEntryPoint()).getReferences(null);
printf(" * found %d %s calls\n", refs.length, etwRegisterFuncName);
for (Reference ref : refs) {
if (monitor.isCancelled())
break;
analyseEtwRegisterCall(ref);
}
}
/* now for each function, output the parameters of all ETW writes ( GUID, Event Id etc)
*/
for(String functionName : functions) {
List<Function> functionList = getGlobalFunctions(functionName);
if(functionList.size() == 0) {
printf(" * %s - function not found\n", functionName);
continue;
}
if(functionList.size() > 1)
throw new Exception("Script aborted: Found " + functionList.size() + " instances of " + functionName);
// decompile function & output ETW writes
analyseFunction(functionList.get(0));
}
}
finally {
decomplib.dispose();
csv.close();
}
// if this isn't empty, then I haven't implemented all possible code paths yet :-(
if (notYetImplemented.size() > 0)
printf(" ---------- TODO ----------\n");
for(String todo : notYetImplemented) {
printf("%s\n", todo);
}
}
/*
* EtwRegister - cache all global REGHANDLE addresses and registration details
*/
List<String> etwRegisterFuncs = Arrays.asList("EtwRegister", "EventRegister", "EtwEventRegister", "EtwNotificationRegister", "EventNotificationRegister", "EtwEventNotificationRegister");
public void analyseEtwRegisterCall(Reference ref) throws Exception {
Address refAddr = ref.getFromAddress();
if (refAddr == null)
throw new NotFoundException("Reference.getFromAddress() == null");
if(refAddr.getOffset() == 0)
return;
// skip 'data' references - e.g. import / export offsets
Data refData = getDataAt(refAddr);
if (refData == null)
refData = getDataContaining(refAddr);
if (refData != null &&
(refData.getDataType().toString().startsWith("_IMAGE_RUNTIME_FUNCTION_ENTRY") ||
refData.getDataType().toString().startsWith("GuardCfgTableEntry") ||
refData.getDataType().isEquivalent(new IBO32DataType()) ||
refData.getDataType().isEquivalent(new DWordDataType())))
return;
Function refFunc = currentProgram.getFunctionManager().getFunctionContaining(refAddr);
if (refFunc == null) {
int transactionID = currentProgram.startTransaction("attempting findFunctionEntry()");
CreateFunctionCmd createCmd = new CreateFunctionCmd(refAddr, true);
createCmd.applyTo(currentProgram);
currentProgram.endTransaction(transactionID, true);
refFunc = currentProgram.getFunctionManager().getFunctionContaining(refAddr);
}
if (refFunc == null)
// programmatic resolution failed - user should try manually finding and defining the function
throw new NotFoundException("getFunctionContaining == null; refAddr=" + refAddr);
ClangTokenGroup cCode = decomplib.decompileFunction(refFunc, decompileTimeoutSeconds, monitor).getCCodeMarkup();
if (cCode == null)
throw new Exception("[CALL EtwRegister] Decompile Error: " + decomplib.getLastMessage());
try {
boolean found = cacheProviderReghandle(refFunc, cCode, refAddr);
if(!found) {
// Could not resolve provider GUID(s) yet.
// :TODO: Search a level deeper.
Reference[] refRefs = this.getSymbolAt(refFunc.getEntryPoint()).getReferences(null);
logTODO("Search the " + refRefs.length + " calls to " + refFunc.getName() + " for EtwRegister calls");
}
} catch(NotYetImplementedException e) {
logTODO(e.getMessage());
}
}
private boolean cacheProviderReghandle(Function f, ClangNode astNode, Address refAddr) throws Exception {
if(astNode == null || astNode.getMinAddress() == null)
return false; // leaf node
if (astNode.getMaxAddress() == null)
throw new InvalidInputException("ClangNode.getMaxAddress() is null");
boolean found = false;
Stack<Function> callPath = new Stack<Function>(); // helps with back tracing constants, and determining relevance
callPath.push(f);
// have we found the call(s) yet?
if (refAddr.getPhysicalAddress().equals(astNode.getMaxAddress()) && astNode instanceof ClangStatement) {
ClangStatement stmt = (ClangStatement) astNode;
PcodeOp pcodeOp = stmt.getPcodeOp();
if (pcodeOp.getOpcode() == PcodeOp.CALL) {
long callAddress = astNode.getMaxAddress().getOffset();
String etwRegisterCall = getFunctionAt(pcodeOp.getInput(0).getAddress()).getName();
List<Long> pGuids = null;
List<Long> reghandles = new LinkedList<Long>();
// we need to pass the calling function in order to back trace through any parameters
Stack<Function> callingFunc = new Stack<Function>();
callingFunc.push(f);
debugPrintf("%s :: %s\n", refAddr.toString(), stmt);
if(etwRegisterCall.endsWith("NotificationRegister")) {
// NTSTATUS EtwNotificationRegister (LPCGUID Guid, ULONG Type, PETW_NOTIFICATION_CALLBACK Callback, PVOID Context, PREGHANDLE RegHandle);
throw new NotYetImplementedException(etwRegisterCall);
}
if(f.getName().startsWith("TraceLogging"))
{
if(pcodeOp.getNumInputs() == 0) {
printf("[WARNING] Incomplete Decompilation @ 0x%x - %s\n", callAddress, stmt.toString());
return false;
}
// TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(PTLGREG param_1, ...)
List<Long> tlgregs = null;
try {
// Only the first parameter is needed
// It points to an undocumented TraceLogging provider registration struct.
tlgregs = resolveToConstant(1, callingFunc);
} catch (NotFoundException e) {
printf(" --> skipping %s due to local variable storage @ 0x%x\n", f.getName(), callAddress);
return true;
}
printf(" * found %d TraceLoggingRegister calls\n", tlgregs.size());
for(int i=0; i < tlgregs.size(); i++) {
Long tlgreg = tlgregs.get(i);
// At offset 8 of the TLG registration is a pointer to the TLG provider metadata
Long tlgprov = getLong(toAddr(tlgreg + 8));
// The provider guid is at offset -0x10
Address guidAddr = toAddr(tlgprov - 0x10);
clearListing(guidAddr, guidAddr.add(guidType.getLength()-1));
createData(guidAddr, guidType);
String guid = getDataAt(guidAddr).toString().substring(5);
// The provider name is at offet +2
Address nameAddr = toAddr(tlgprov + 2);
clearListing(nameAddr);
createData(nameAddr, stringType);
String providerName = getDataAt(nameAddr).toString().substring(3); // strip type
// The REGHANDLE will be saved at offset 0x20
Long reghandle = tlgreg + 0x20;
printf(" --> cached TraceLoggingRegister(%s, %s)\n", guid, providerName);
providerGuidMap.put(reghandle, new Pair<String,String>(guid, providerName));
}
return true;
}
if(etwRegisterCall.startsWith("Etw") || etwRegisterCall.startsWith("Event")) {
if(pcodeOp.getNumInputs() < 5) {
printf("[WARNING] Incomplete Decompilation @ 0x%x - %s\n", callAddress, stmt.toString());
return false;
}
try {
pGuids = resolveFunctionParameterToConstant(pcodeOp, 1, callingFunc);
} catch (NotFoundException e) {
printf(" --> skipping %s as guid not found @ 0x%x\n", etwRegisterCall, callAddress);
return false;
}
try {
reghandles = resolveFunctionParameterToConstant(pcodeOp, 4, callingFunc);
} catch (NotFoundException e) {
// a global REGHANDLE address was not found
// assume local only use - and cache the containing function as the address
debugPrintf("local REGHANDLE @ 0x%x\n", callAddress);
reghandles.add(f.getEntryPoint().getOffset());
}
}
// :TODO: better guarantee the (guid, reghandle) correlation?
if(pGuids.size() != reghandles.size())
throw new NotFoundException("ETW register parameter list size mismatch");
for(int i = 0; i < pGuids.size(); i++) {
long pGuid = pGuids.get(i);
String guid = "";
String guidSymbol = "";
if(pGuid != 0) {
Address guidAddr = toAddr(pGuid);
clearListing(guidAddr, guidAddr.add(guidType.getLength()-1));
createData(guidAddr, guidType);
guid = getDataAt(guidAddr).toString().substring(5); // strip GUID_ prefix
guidSymbol = SymbolAt(pGuid);
}
long reghandle = reghandles.get(i);
if(reghandle != 0 && pGuid != 0) {
printf(" --> cached %s(%s, %s)\n", etwRegisterCall, guid, guidSymbol);
providerGuidMap.put(reghandle, new Pair<String,String>(guid, guidSymbol));
found = true;
}
}
return found; // CALL found - stop looking
}
}
// otherwise traverse children to find call(s)
for (int j = 0; j < astNode.numChildren(); j++) {
found |= cacheProviderReghandle(f, astNode.Child(j), refAddr);
}
return found;
}
/*
* functions of interest
*/
List<String> etwWriteFuncs = Arrays.asList("EtwWrite", "EventWrite", "EtwEventWrite", "EtwWriteEx", "EventWriteEx", "EtwEventWriteEx", "EtwWriteTransfer", "EventWriteTransfer", "EtwEventWriteTransfer", "EtwEventWriteFull", "EtwWriteStartScenario", "EventWriteStartScenario", "EtwEventWriteStartScenario", "EtwWriteEndScenario", "EventWriteEndScenario", "EtwEventWriteEndScenario", "EtwWriteString", "EventWriteString", "EtwEventWriteString", "EtwWriteNoRegistration", "EventWriteNoRegistration", "EtwEventWriteNoRegistration");
List<String> classicMessageFuncs = Arrays.asList("TraceMesssage", "EtwTraceMessage", "TraceMessageVa", "EtwTraceMessageVa");
List<String> classicEventFuncs = Arrays.asList("TraceEvent", "EtwTraceEvent", "TraceEventInstance", "EtwTraceEventInstance");
public void analyseFunction(Function func) throws Exception {
Queue<QueuedFunction> queue = new LinkedList<QueuedFunction>();
List<String> processed = new LinkedList<String>();
Stack<Function> callPath = new Stack<Function>(); // helps with back tracing constants, and determining relevance
callPath.push(func);
int eventCount = 0;
int depth = 0;
int exportDepth = 0;
int maxLocalCallDepth = maxCallDepth;
String lastParameters = null;
// find all reachable ETW writes
for(Function calledFunction : func.getCalledFunctions(monitor))
queue.add(new QueuedFunction(calledFunction, func, 1, 0, callPath));
while (queue.size() != 0) {
if (monitor.isCancelled())
break;
QueuedFunction next = queue.remove();
Function thisFunction = next.queuedFunction;
Function callingFunction = next.callingFunction;
depth = next.callDepth;
exportDepth = next.exportedCallDepth;
callPath = next.callPath;
String funcName = thisFunction.getName();
String containingFunction = callingFunction.getName();
if( containingFunction.startsWith("FUN_")) {
// Search for the first symbol in the call stack
Stack<Function> stack = (Stack<Function>) callPath.clone();
while(containingFunction.startsWith("FUN_"))
containingFunction = stack.pop().getName();
}
if (processed.contains(funcName) || ignored.contains(funcName))
continue;
if(quickScan && (depth > maxLocalCallDepth || exportDepth > maxExportCallDepth || eventCount == maxEvents))
continue;
if(funcName.startsWith("_tlgWrite")) {
ClangTokenGroup cCode = decomplib.decompileFunction(callingFunction, decompileTimeoutSeconds, monitor).getCCodeMarkup();
if (cCode == null)
throw new Exception("[CALL _tlgWrite] Decompile Error: " + decomplib.getLastMessage());
List<StringBuffer> tlgWriteParametersList = new LinkedList<StringBuffer>();
try {
getTlgWriteParameters(funcName, cCode, tlgWriteParametersList, callPath, 0);
for(StringBuffer tlgWriteParameters : tlgWriteParametersList) {
if(tlgWriteParameters.toString().equals(lastParameters))
continue; // remove duplicates
lastParameters = tlgWriteParameters.toString();
csv.printf("%s,%s,%s,%d,%d,%s\n", func.getName(), tlgWriteParameters, containingFunction.replace(',','-'), depth, exportDepth, callPath.toString().replace(',','-').replace(' ','>') );
eventCount++;
maxLocalCallDepth = Math.min(maxLocalCallDepth, depth + extraCallDepth);
}
} catch(NotFoundException e) {
logTODO(e.getMessage());
} catch(NotYetImplementedException e) {
logTODO(e.getMessage());
}
}
else if(classicEventFuncs.contains(funcName)) {
logTODO("Implement classic provider support for " + containingFunction);
}
else if(classicMessageFuncs.contains(funcName)) {
List<String> wppWriteParametersList = getWppWriteParameters(funcName, callingFunction, callPath);
for(String wppWriteParameters : wppWriteParametersList) {
csv.printf("%s,%s,%s,%d,%d,%s\n", func.getName(), wppWriteParameters, containingFunction.replace(',','-'), depth, exportDepth, callPath.toString().replace(',','-').replace(' ','>') );
eventCount++;
maxLocalCallDepth = Math.min(maxLocalCallDepth, depth + extraCallDepth);
}
}
else if(etwWriteFuncs.contains(funcName)) {
ClangTokenGroup cCode = decomplib.decompileFunction(callingFunction, decompileTimeoutSeconds, monitor).getCCodeMarkup();
if (cCode == null)
throw new Exception("[CALL EtwWrite] Decompile Error: " + decomplib.getLastMessage());
List<StringBuffer> etwWriteParametersList = new LinkedList<StringBuffer>();
try {
getEtwWriteParameters(funcName, cCode, etwWriteParametersList, callPath, 0);
for(StringBuffer etwWriteParameters : etwWriteParametersList) {
if(etwWriteParameters.toString().equals(lastParameters))
continue; // remove duplicates
lastParameters = etwWriteParameters.toString();
csv.printf("%s,%s,%s,%d,%d,%s\n", func.getName(), etwWriteParameters, containingFunction.replace(',','-'), depth, exportDepth, callPath.toString().replace(',','-').replace(' ','>') );
eventCount++;
maxLocalCallDepth = Math.min(maxLocalCallDepth, depth + extraCallDepth);
}
} catch(NotFoundException e) {
logTODO(e.getMessage());
} catch(NotYetImplementedException e) {
logTODO(e.getMessage());
}
}
// Handling classic kernel events via this wrapper function adds more context
else if(funcName.equals("EtwTraceKernelEvent")) {
List<String> kernelEventParametersList = getTraceKernelEventParameters(funcName, callingFunction, callPath);
for(String kernelEventParameters : kernelEventParametersList) {
if(kernelEventParameters.toString().equals(lastParameters))
continue; // remove duplicates
lastParameters = kernelEventParameters.toString();
csv.printf("%s,%s,%s,%d,%d,%s\n", func.getName(), kernelEventParameters, containingFunction.replace(',','-'), depth, exportDepth, callPath.toString().replace(',','-').replace(' ','>') );
eventCount++;
maxLocalCallDepth = Math.min(maxLocalCallDepth, depth + extraCallDepth);
}
}
else {
String functionCrumb = func.getName();
if(functionCrumb.length() > 5)
functionCrumb = functionCrumb.substring(2, functionCrumb.length() - 5);
if(exports.contains(funcName) && !funcName.contains(functionCrumb))
exportDepth++;
processed.add(funcName);
for(Function calledFunction : thisFunction.getCalledFunctions(monitor)) {
if(calledFunction == null)
throw new Exception("Argh!");
if(calledFunction.getName() == null)
createFunction(calledFunction.getEntryPoint(), null);
if(calledFunction.getName() == null)
throw new Exception("FUN_" + calledFunction.getEntryPoint().toString() + " is not defined");
callPath = (Stack<Function>) next.callPath.clone();
if(funcName.startsWith("FUN_"))
queue.add(new QueuedFunction(calledFunction, thisFunction, depth, exportDepth, callPath));
else {
callPath.add(thisFunction);
queue.add(new QueuedFunction(calledFunction, thisFunction, depth+1, exportDepth, callPath));
}
}
}
}
printf(" * %s - found %d events in %d functions. callDepth=%d exportDepth=%d\n",
func.getName(), eventCount, processed.size(), maxLocalCallDepth, exportDepth);
csv.flush();
}
private boolean getEtwWriteParameters(String etwWriteCall, ClangNode node, List<StringBuffer> etwWriteParametersList, Stack<Function> callPath, int depth) throws Exception {
if(node == null || node.getMinAddress() == null)
return false; // leaf node
if (node.getMaxAddress() == null)
throw new InvalidInputException("ClangNode.getMaxAddress() is null");
boolean found = false;
// have we found the right CALL yet?
if(node instanceof ClangStatement) {
ClangStatement stmt = (ClangStatement) node;
PcodeOp pcodeOp = stmt.getPcodeOp();
if (pcodeOp != null &&
pcodeOp.getOpcode() == PcodeOp.CALL &&
getSymbolAt(pcodeOp.getInput(0).getAddress()) != null &&
getSymbolAt(pcodeOp.getInput(0).getAddress()).getName().endsWith(etwWriteCall)) {
if(pcodeOp.getNumInputs() < 3) {
printf("[WARNING] Incomplete Decompilation @ 0x%x - %s\n", node.getMaxAddress().getOffset(), stmt.toString());
}
debugPrintf("%s :: %s\n", callPath.peek().toString(), stmt);
if(etwWriteCall.endsWith("WriteNoRegistration")) {
// NTSTATUS EtwEventWriteNoRegistration (PCGUID ProviderId, PCEVENT_DESCRIPTOR EventDescriptor, ULONG UserDataCount, PEVENT_DATA_DESCRIPTOR UserData);
throw new NotYetImplementedException("EtwEventWriteNoRegistration");
}
long reghandle = 0;
if(pcodeOp.getNumInputs() > 1) {
List<Long> reghandles = null;
try
{
reghandles = resolveFunctionParameterToConstant(pcodeOp, 1, callPath);
if(reghandles.size() == 0)
throw new NotFoundException("ETW write with no REGHANDLE");
if(reghandles.size() > 1)
throw new NotYetImplementedException("ETW write with multiple REGHANDLE");
reghandle = reghandles.get(0);
}
catch (NotFoundException e)
{
debugPrintf("ETW write REGHANDLE resolves to local variable in " + callPath.peek());
// Attempt lookup via function address instead
reghandle = callPath.peek().getEntryPoint().getOffset();
}
catch (NotYetImplementedException e) {
// non fatal
logTODO("Handle REGHANDLE in " + e.getMessage());
}
}
String providerGuid = "???";
String providerSymbol = "";
String reghandleSymbol = SymbolAt(reghandle);
Pair<String,String> providerRegistration = providerGuidMap.get(reghandle);
if ( providerRegistration != null) {
providerGuid = providerRegistration.first;
providerSymbol = providerRegistration.second;
}
StringBuffer etwWriteParameters = new StringBuffer();
if(etwWriteCall.endsWith("WriteString")) {
// NTSTATUS EtwWriteString(REGHANDLE RegHandle, UCHAR Level, ULONGLONG Keyword, LPCGUID ActivityId, PCWSTR String)
etwWriteParameters.append(providerGuid + ",");
etwWriteParameters.append(providerSymbol + ",");
etwWriteParameters.append(reghandleSymbol + ",");
etwWriteParameters.append(etwWriteCall + ",");
List<Long> levels = resolveFunctionParameterToConstant(pcodeOp, 2, callPath);
List<Long> keywords = resolveFunctionParameterToConstant(pcodeOp, 3, callPath);
List<Long> strings = resolveFunctionParameterToConstant(pcodeOp, 5, callPath);
if(levels.size() + keywords.size() + strings.size() != 3)
throw new NotYetImplementedException("EtwWriteString with multiple paths");
etwWriteParameters.append(",,,,"+ levels.get(0) + ",,," + keywords.get(0));
// :TODO: output (PCWSTR String) parameter
logTODO(etwWriteCall);
return true;
}
// NTSTATUS EtwWrite*(REGHANDLE RegHandle, PCEVENT_DESCRIPTOR EventDescriptor, LPCGUID ActivityId, ULONG UserDataCount, PEVENT_DATA_DESCRIPTOR UserData);
Address event = null;
if(pcodeOp.getNumInputs() > 2) {
List<Long> pEvents = new LinkedList<Long>();
try
{
debugPrintf("resolveFunctionParameterToConstant(2)\n");
pEvents = resolveFunctionParameterToConstant(pcodeOp, 2, callPath);
if(pEvents.size() == 0)
logTODO("EtwWrite EVENT_DESCRIPTOR not found in " + callPath.peek());
}
catch (NotFoundException e)
{
logTODO("EtwWrite EVENT_DESCRIPTOR not found in " + callPath.peek());
etwWriteParameters = new StringBuffer();
etwWriteParameters.append(providerGuid + ",");
etwWriteParameters.append(providerSymbol + ",");
etwWriteParameters.append(reghandleSymbol + ",");
etwWriteParameters.append(etwWriteCall + ",");
etwWriteParameters.append(",,,,,,,"); // not found
etwWriteParametersList.add(etwWriteParameters);
}
catch (NotYetImplementedException e)
{
throw new NotYetImplementedException("EVENT_DESCRIPTOR " + e.getMessage());
}
for(long pEvent : pEvents) {
if(pEvent == 0)
continue; // a quirk of ghidra's decompilation? Or because of initialise to zero and error paths?
etwWriteParameters = new StringBuffer();
etwWriteParameters.append(providerGuid + ",");
etwWriteParameters.append(providerSymbol + ",");
etwWriteParameters.append(reghandleSymbol + ",");
etwWriteParameters.append(etwWriteCall + ",");
String eventDescriptorSymbol = SymbolAt(pEvent);
etwWriteParameters.append(eventDescriptorSymbol + ",");
event = toAddr(pEvent);
clearListing(event, event.add(eventDescriptorType.getLength()-1));
try {
createData(event, eventDescriptorType);
appendStructure(event, etwWriteParameters, true);
}
catch(CodeUnitInsertionException e)
{
debugPrintf("EVENT_DESCRIPTOR parsing failed @ 0x%x", pEvent);
etwWriteParameters.append(",,,,,,");
}
etwWriteParametersList.add(etwWriteParameters);
}
}
found = true;
}
}
// search children until call(s) found
for (int j = 0; j < node.numChildren(); j++)
found |= getEtwWriteParameters(etwWriteCall, node.Child(j), etwWriteParametersList, callPath, depth + 1);
if(!found && depth == 0)
throw new Exception("didn't find " + etwWriteCall);
return found;
}
private boolean getTlgWriteParameters(String tlgWriteCall, ClangNode node, List<StringBuffer> tlgWriteParametersList, Stack<Function> callPath, int depth) throws Exception {
if(node == null || node.getMinAddress() == null)
return false; // leaf node
if (node.getMaxAddress() == null)
throw new InvalidInputException("ClangNode.getMaxAddress() is null");
boolean found = false;
// have we found the right CALL yet?
if(node instanceof ClangStatement) {
ClangStatement stmt = (ClangStatement) node;
PcodeOp pcodeOp = stmt.getPcodeOp();
if (pcodeOp != null &&
pcodeOp.getOpcode() == PcodeOp.CALL &&
getSymbolAt(pcodeOp.getInput(0).getAddress()) != null &&
getSymbolAt(pcodeOp.getInput(0).getAddress()).getName().endsWith(tlgWriteCall)) {
if(pcodeOp.getNumInputs() < 2) {
printf("[WARNING] Incomplete Decompilation @ 0x%x - %s\n", node.getMaxAddress().getOffset(), stmt.toString());
}
found = true;
if(tlgWriteCall.startsWith("_tlgWriteEx"))
tlgWriteCall = "_tlgWriteEx";
else if(tlgWriteCall.startsWith("_tlgWriteTransfer"))
tlgWriteCall = "_tlgWriteTransfer";
debugPrintf("%s :: %s\n", tlgWriteCall, stmt);
// _tlgWrite(PTLG_REGISTRATION, PTLG_EVENT, ...)
long reghandle = 0;
if(pcodeOp.getNumInputs() > 1) {
List<Long> reghandles = null;
try
{
reghandles = resolveFunctionParameterToConstant(pcodeOp, 1, callPath);
if(reghandles.size() == 0)
throw new NotFoundException("TLG write with no REGHANDLE");
if(reghandles.size() > 1)
throw new NotYetImplementedException("TLG write with multiple REGHANDLE");
// REGHANDLE is at offset 0x20 in TLG_REGISTRATION
reghandle = reghandles.get(0) + 0x20;
}
catch (NotFoundException e)
{
// non fatal
logTODO("_tlgWrite REGHANDLE not found in " + callPath.peek());
}
catch (NotYetImplementedException e) {
// non fatal
logTODO("REGHANDLE " + e.getMessage());
}
}
String providerGuid = "???";
String providerName = "";
Pair<String,String> providerRegistration = providerGuidMap.get(reghandle);
if ( providerRegistration != null) {
providerGuid = providerRegistration.first;
providerName = providerRegistration.second;
}
String reghandleSymbol = SymbolAt(reghandle);
if(reghandleSymbol.startsWith("DAT_"))
reghandleSymbol = "";
if(pcodeOp.getNumInputs() > 2) {
List<Long> pTlgEvents = null; // TLG_EVENT pointers
try
{
pTlgEvents = resolveFunctionParameterToConstant(pcodeOp, 2, callPath);
}
catch (NotFoundException e)
{
throw new NotYetImplementedException("TLG write EVENT_DESCRIPTOR resolves to local variable in " + callPath.peek()); // :TODO:
}
catch (NotYetImplementedException e)
{
throw new NotYetImplementedException("EVENT_DESCRIPTOR " + e.getMessage());
}
if(pTlgEvents.size() == 0)
throw new NotFoundException("TLG write with no EVENT_DESCRIPTOR");
for(long pEvent : pTlgEvents) {
if(pEvent == 0)
continue; // a quirk of ghidra's decompilation? Or because of initialise to zero and error paths?
StringBuffer tlgWriteParameters = new StringBuffer();
tlgWriteParameters.append(providerGuid + ",");
tlgWriteParameters.append(providerName + ",");
tlgWriteParameters.append(reghandleSymbol + ","); // usually empty for TLG
tlgWriteParameters.append(tlgWriteCall + ",");
// https://posts.specterops.io/data-source-analysis-and-dynamic-windows-re-using-wpp-and-tracelogging-e465f8b653f7
// UCHAR Channel
// UCHAR Level
// UCHAR OpCode
// UINT64 Keyword
// UINT16 Size
// UCHAR Zero
// CSTR EventName
Byte channel = getByte(toAddr(pEvent));
Byte level = getByte(toAddr(pEvent + 1));
Byte opcode = getByte(toAddr(pEvent + 2));
Long keyword = getLong(toAddr(pEvent + 3));
Address nameAddr = toAddr(pEvent + 15);
clearListing(nameAddr);
createData(nameAddr, stringType);
String eventName = getDataAt(nameAddr).toString().substring(3); // strip type
// TraceLogging doesn't have equivalent fields for id, task and version.
tlgWriteParameters.append(eventName + ",");
tlgWriteParameters.append("-,-,"); // Id, Version
tlgWriteParameters.append(channel + ",");
tlgWriteParameters.append(level + ",");
tlgWriteParameters.append(opcode + ",");
tlgWriteParameters.append("-,"); // Task
tlgWriteParameters.append(String.format("0x%x", keyword));
tlgWriteParametersList.add(tlgWriteParameters);
}
}
else
{
StringBuffer tlgWriteParameters = new StringBuffer();
tlgWriteParameters.append(providerGuid + ",");
tlgWriteParameters.append(providerName + ",");
tlgWriteParameters.append(reghandleSymbol + ",");
tlgWriteParameters.append(tlgWriteCall + ",");
tlgWriteParameters.append(",,,,,,,");
tlgWriteParametersList.add(tlgWriteParameters);
}
}
}
// search children until call(s) found
for (int j = 0; j < node.numChildren(); j++)
found |= getTlgWriteParameters(tlgWriteCall, node.Child(j), tlgWriteParametersList, callPath, depth + 1);
if(!found && depth == 0)
throw new Exception("didn't find " + tlgWriteCall);
return found;
}
private List<String> getWppWriteParameters(String wppWriteCall, Function callingFunction, Stack<Function> callPath) throws Exception {
HighFunction hf = decomplib.decompileFunction(callingFunction, decompileTimeoutSeconds, monitor).getHighFunction();
if (hf == null)
throw new Exception("[CALL WppWrite] Decompile Error: " + decomplib.getLastMessage());
List<String> wppWriteParametersList = new LinkedList<String>();
boolean found = false;
Iterator<PcodeOpAST> ops = hf.getPcodeOps();
while (ops.hasNext() && !monitor.isCancelled()) {
PcodeOpAST pcodeOp = ops.next();
if (pcodeOp.getOpcode() == PcodeOp.CALL &&
getSymbolAt(pcodeOp.getInput(0).getAddress()) != null &&
getSymbolAt(pcodeOp.getInput(0).getAddress()).getName().endsWith(wppWriteCall)) {
if(pcodeOp.getNumInputs() < 4) {
printf("[WARNING] Incomplete Decompilation of " + callingFunction.getName());
}
// ULONG TraceMessage(TRACEHANDLE LoggerHandle, ULONG MessageFlags, LPCGUID MessageGuid, USHORT MessageNumber, ...);
StringBuffer wppWriteParameters = new StringBuffer();
found = true;
try {
long tracehandle = resolveParameterToConstant(pcodeOp, wppWriteCall, "TRACEHANDLE", 1, callPath);
long messageFlags = resolveParameterToConstant(pcodeOp, wppWriteCall, "MessageFlags", 2, callPath);
long _messageGuid = resolveParameterToConstant(pcodeOp, wppWriteCall, "MessageGuid", 3, callPath);
long messageId = pcodeOp.getNumInputs() == 4 ? 0 : resolveParameterToConstant(pcodeOp, wppWriteCall, "MessageId", 4, callPath);
String providerGuid = "???";
String providerSymbol = "";
String reghandleSymbol = SymbolAt(tracehandle);
Pair<String,String> providerRegistration = providerGuidMap.get(tracehandle);
if ( providerRegistration != null) {
providerGuid = providerRegistration.first;
providerSymbol = providerRegistration.second;
}
String messageGuid = "???";
Pair<String,String> guidRegistration = providerGuidMap.get(_messageGuid);
if ( guidRegistration != null)
messageGuid = guidRegistration.first;
wppWriteParameters.append("WPP_"+providerGuid + ",");
wppWriteParameters.append(providerSymbol + ",");
wppWriteParameters.append(reghandleSymbol + ",");
wppWriteParameters.append(wppWriteCall + ",");
wppWriteParameters.append(messageGuid + ","); // EventDescriptorSymbol
wppWriteParameters.append(messageId + ","); // Id
wppWriteParameters.append(",,,,,"); // Version,Channel,Level,Opcode,Task,
wppWriteParameters.append("Flags=" + messageFlags); // Keyword
} catch(NotFoundException e) {
wppWriteParameters.append(",,,,,,,,,,,");
}
wppWriteParametersList.add(wppWriteParameters.toString());
}
}
if(!found)
throw new NotFoundException("didn't find any " + wppWriteCall + " calls in " + callPath.peek());
return wppWriteParametersList;
}
private List<String> getTraceKernelEventParameters(String funcName, Function callingFunction, Stack<Function> callPath) throws Exception {
HighFunction hf = decomplib.decompileFunction(callingFunction, decompileTimeoutSeconds, monitor).getHighFunction();
if (hf == null)
throw new Exception("[CALL " + funcName + "] Decompile Error: " + decomplib.getLastMessage());
List<String> parametersList = new LinkedList<String>();
boolean found = false;
Iterator<PcodeOpAST> ops = hf.getPcodeOps();
while (ops.hasNext() && !monitor.isCancelled()) {
PcodeOpAST pcodeOp = ops.next();
if (pcodeOp.getOpcode() == PcodeOp.CALL &&
getSymbolAt(pcodeOp.getInput(0).getAddress()) != null &&
getSymbolAt(pcodeOp.getInput(0).getAddress()).getName().endsWith(funcName)) {
if(pcodeOp.getNumInputs() < 3) {
printf("[WARNING] Incomplete Decompilation of " + callingFunction.getName());
}
StringBuffer parameters = new StringBuffer();
found = true;
parameters.append("Windows Kernel Trace,");
try {
// EtwTraceKernelEvent(PEVENT_DESCRIPTOR, UINT32, PERFINFO_GROUPMASK, LOG_TYPE, UINT32)
long perfinfo = resolveParameterToConstant(pcodeOp, funcName, "PERFINFO_GROUPMASK", 3, callPath);
long logtype = resolveParameterToConstant(pcodeOp, funcName, "LOG_TYPE", 4, callPath);
// If someone wants to reverse the format then more event metadata could likely be
// extracted from the 1st, 2nd and 5th parameters.
parameters.append(LookupPerfInfoMask(perfinfo) + ",");
parameters.append(LookupTraceGroup(logtype) + ",");
parameters.append(funcName + ",");
parameters.append(LookupLogType(logtype) + ",");
parameters.append(",,,,,,"); // Id,Version,Channel,Level,Opcode,Task,Keyword
} catch(NotFoundException e) {
parameters.append(",,,,,,,,,,");
}
parametersList.add(parameters.toString());
}
}
if(!found)
throw new NotFoundException("didn't find any " + funcName + " calls in " + callPath.peek());
return parametersList;
}
// resolve an intermediate pcode call parameter to a list of possible constant values
public List<Long> resolveFunctionParameterToConstant(PcodeOp call, int paramIndex, Stack<Function> callPath) throws Exception {
if (call.getOpcode() != PcodeOp.CALL)
throw new InvalidInputException("Expected a CALL function");
Varnode calledFunc = call.getInput(0);
if (calledFunc == null || !calledFunc.isAddress())
throw new InvalidInputException("Invalid CALL PcodeOp");
if (paramIndex >= call.getNumInputs())
throw new InvalidInputException("Decompiler discovered insufficient parameters");
Varnode param = call.getInput(paramIndex);
if (param == null)
throw new NotFoundException("Missing Parameter");
// else process
return resolveVarnodeToConstant(param, callPath, 0);
}
// resolve a variable to a list of possible constant values
private List<Long> resolveVarnodeToConstant(Varnode node, Stack<Function> callPath, int astDepth) throws Exception {
if (node.isConstant())
return new LinkedList<Long>(Arrays.asList(node.getOffset()));
if (node.isAddress())
return new LinkedList<Long>(Arrays.asList(node.getAddress().getOffset()));
HighVariable hvar = node.getHigh();
if (hvar instanceof HighParam)
return resolveToConstant(((HighParam)hvar).getSlot() + 1, callPath);
if (hvar instanceof HighGlobal)
debugPrintf(":TODO: found a global... already handled?");
if (hvar instanceof HighLocal) {
// printf("### HighLocal " + callPath.peek().getName() + " node: " + node.getDef() + "\n");
return resolvePcodeOpToConstant(node.getDef(), callPath, astDepth);
}
if (hvar instanceof HighOther) {
///printf("### HighOther " + callPath.peek().getName() + " hvar: " + hvar + "\n");
///printf("### getRepresentative: " + hvar.getRepresentative().getDef() + "\n");
///printf("### getDef: " + node.getDef() + "\n");
if(hvar.getRepresentative().getDef() != null)
return resolvePcodeOpToConstant(hvar.getRepresentative().getDef(), callPath, astDepth);
if(node.getDef() != null)
return resolvePcodeOpToConstant(node.getDef(), callPath, astDepth);
}
throw new NotFoundException();
}
// resolve a function call parameter to a list of possible constant values
private List<Long> resolveToConstant(int parameterIndex, Stack<Function> callPath) throws Exception {
List<Long> constants = new LinkedList<Long>();
Stack<Function> parentCallPath = (Stack<Function>)callPath.clone();
Function func = parentCallPath.pop();
if (callPath.size() > 1) {
// forward trace - with full call path
ClangNode astNode = decomplib.decompileFunction(parentCallPath.peek(), decompileTimeoutSeconds, monitor).getCCodeMarkup();
if (astNode == null)
throw new Exception("[resolveToConstant] Decompile Error: " + decomplib.getLastMessage());
constants.addAll(resolveToConstant(astNode, func, parameterIndex, parentCallPath, 0));
} else {
// backwards trace - incomplete call path, follow all paths
for(Function callingFunction : func.getCallingFunctions(monitor)) {
ClangNode astNode = decomplib.decompileFunction(callingFunction, decompileTimeoutSeconds, monitor).getCCodeMarkup();
if (astNode == null)
throw new Exception("[resolveToConstant] Decompile Error: " + decomplib.getLastMessage());
parentCallPath.push(callingFunction);
constants.addAll(resolveToConstant(astNode, func, parameterIndex, parentCallPath, 0));
parentCallPath.pop();
}
}
if (constants.size() == 0)
throw new NotFoundException("resolveToConstant(parameter)");
return constants.stream().distinct().collect(Collectors.toList());
}
// resolve a high level C statement to a list of possible constant values
private List<Long> resolveToConstant(ClangNode astNode, Function func, int parameterIndex, Stack<Function> callPath, int nodeDepth) throws Exception {
List<Long> constants = new LinkedList<Long>();
// find the call(s) to func - and back trace all possible parameter values
if(astNode instanceof ClangStatement) {
ClangStatement stmt = (ClangStatement) astNode;
PcodeOp pcodeOp = stmt.getPcodeOp();
if (pcodeOp != null &&
pcodeOp.getOpcode() == PcodeOp.CALL &&
getFunctionAt(pcodeOp.getInput(0).getAddress()) != null &&
getFunctionAt(pcodeOp.getInput(0).getAddress()).getName().equals(func.getName()))
{
if(parameterIndex >= pcodeOp.getNumInputs()) {
// After porting to Ghidra 11 this condition is triggering when it shouldn't.
// Recovering programmatically appears to require invalidate the existing
// decompilation result so isn't trivial.
// Print (likely) manual recovery instructions for now.
printf("Navigate to " + pcodeOp.getInput(0).getAddress() + " " + stmt + "\n");
printf("P 'Commit Params/Return' for this function and retry\n");
printf("Or try Auto Analyze again if it keeps happening\n");
throw new ArrayIndexOutOfBoundsException(astNode.getMinAddress() + " CALL " +
stmt + " parameterIndex=" + parameterIndex +
" of " + (pcodeOp.getNumInputs() - 1));
}
constants.addAll(resolveVarnodeToConstant(pcodeOp.getInput(parameterIndex), callPath, 0));
}
}
// also traverse all children to find call(s)
for (int i = 0; i < astNode.numChildren(); i++)
constants.addAll(resolveToConstant(astNode.Child(i), func, parameterIndex, callPath, nodeDepth + 1));
if(nodeDepth == 0 && constants.isEmpty())
throw new NotFoundException("resolveToConstant(parameter)");
return constants.stream().distinct().collect(Collectors.toList());
}
// resolve an intermediate pcode operation to a list of possible constant values
private List<Long> resolvePcodeOpToConstant(PcodeOp node, Stack<Function> callPath, int astDepth) throws Exception {
if(node == null)
throw new NotFoundException("node == null");
if(astDepth > 128)
throw new NotFoundException("Pcode AST depth > 128 in " + callPath.peek());
debugPrintf("%s (depth=%d)\n", node.toString(), astDepth);
List<Long> input0;
List<Long> input1;
List<Long> output = new LinkedList<Long>();
int opcode = node.getOpcode();
switch (opcode) {
case PcodeOp.CAST:
case PcodeOp.COPY:
case PcodeOp.INT_ZEXT: // zero-extend
output = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
break;
case PcodeOp.INT_2COMP: // twos complement
input0 = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
output = input0.stream().map(a->-a).collect(Collectors.toList());
break;
case PcodeOp.INT_NEGATE:
input0 = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
output = input0.stream().map(a->~a).collect(Collectors.toList());
break;
case PcodeOp.LOAD:
output = resolveVarnodeToConstant(node.getInput(1), callPath, astDepth+1);
break;
case PcodeOp.INT_ADD:
case PcodeOp.PTRSUB: // pointer to structure and offset to subcomponent
input0 = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
input1 = resolveVarnodeToConstant(node.getInput(1), callPath, astDepth+1);
for(int i = 0; i < input0.size(); i++)
for(int j = 0; j < input1.size(); j++)
output.add(input0.get(i) + input1.get(j));
break;
case PcodeOp.INT_MULT:
input0 = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
input1 = resolveVarnodeToConstant(node.getInput(1), callPath, astDepth+1);
for(int i = 0; i < input0.size(); i++)
for(int j = 0; j < input1.size(); j++)
output.add(input0.get(i) * input1.get(j));
break;
case PcodeOp.INT_NOTEQUAL:
input0 = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
input1 = resolveVarnodeToConstant(node.getInput(1), callPath, astDepth+1);
for(int i = 0; i < input0.size(); i++)
for(int j = 0; j < input1.size(); j++)
output.add((input0.get(i) != input1.get(j)) ? 1L : 0L);
break;
case PcodeOp.PTRADD:
input0 = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
input1 = resolveVarnodeToConstant(node.getInput(1), callPath, astDepth+1);
List<Long> elementSize = resolveVarnodeToConstant(node.getInput(2), callPath, astDepth+1);
for(int i = 0; i < input0.size(); i++)
for(int j = 0; j < input1.size(); j++)
for(int k = 0; k < elementSize.size(); k++)
output.add(input0.get(i) + (input1.get(j) * elementSize.get(k)));
break;
case PcodeOp.INT_AND:
input0 = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
input1 = resolveVarnodeToConstant(node.getInput(1), callPath, astDepth+1);
for(int i = 0; i < input0.size(); i++)
for(int j = 0; j < input1.size(); j++)
output.add(input0.get(i) & input1.get(j));
break;
case PcodeOp.MULTIEQUAL:
for(Varnode n : node.getInputs())
output.addAll(resolveVarnodeToConstant(n, callPath, astDepth+1));
break;
case PcodeOp.INDIRECT:
debugPrintf("ignoring possible indirect effects in %s\n", callPath.peek());
output = resolveVarnodeToConstant(node.getInput(0), callPath, astDepth+1);
break;
case PcodeOp.CALL:
debugPrintf("guessing TRUE for CALL in %s\n", callPath.peek());
output.add(1L); // TRUE
break;
default:
throw new NotYetImplementedException("PcodeOp " + node.toString() + " in " + callPath.peek());
}
// remove duplicates
return output.stream().distinct().collect(Collectors.toList());
}
private void appendStructure(Address addr, StringBuffer buff, Boolean valuesOnly) throws Exception {
Data struct = getDataAt(addr);
for(int i = 0; i < struct.getNumComponents(); i++) {
if(i != 0)
buff.append(",");
Data component = struct.getComponent(i);
if(!valuesOnly)
buff.append(component.getComponentPathName() + "=");
DataType dt = component.getDataType();
if (dt.isEquivalent(ucharType)) {
buff.append(component.getUnsignedByte(0));
} else if (dt.isEquivalent(ushortType)) {
buff.append(component.getUnsignedShort(0));
} else if (dt.isEquivalent(ulonglongType)) {
buff.append(String.format("0x%x", component.getBigInteger(0, 8, false)));
} else
throw new Exception("Unsupported Type:" + dt.toString() + " (DataTypeManager=" + dt.getDataTypeManager().getName() + "CategoryPath=" + dt.getCategoryPath() + ")");
}
}
private long resolveParameterToConstant(PcodeOp pcodeOp, String function, String parameterType, int parameterIndex, Stack<Function> callPath) throws Exception {
if(pcodeOp.getNumInputs() <= parameterIndex)
throw new Exception("Decompilation failure in " + function);
List<Long> constants = null;
try
{
constants = resolveFunctionParameterToConstant(pcodeOp, parameterIndex, callPath);
if(constants.size() == 0)
throw new NotFoundException(parameterType + " not found in " + callPath.peek() + "->" + function);
if(constants.size() > 1)
throw new NotYetImplementedException(parameterType + " with multiple values in " + callPath.peek() + "->" + function);
return constants.get(0);
}
catch (NotFoundException e) {
logTODO(parameterType + " resolves to local variable in " + callPath.peek() + "->" + function);
}
catch (NotYetImplementedException e) {
logTODO(parameterType + " failed to resolve to constant in " + callPath.peek() + "->" + function + " due to " + e.getMessage());
}
throw new NotFoundException(parameterType + " not found in " + callPath.peek() + "->" + function);
}
private String SymbolAt(long address)
{
String strSymbol = "";
Symbol symbol = this.getSymbolAt(toAddr(address));
if (symbol != null)
strSymbol = symbol.toString();
if (strSymbol.startsWith("DAT_"))
strSymbol = "";
return strSymbol;
}
private void setUpDecompiler(Program program) {
decomplib = new DecompInterface();
DecompileOptions options;
options = new DecompileOptions();
OptionsService service = state.getTool().getService(OptionsService.class);
if (service != null) {
ToolOptions opt = service.getOptions("Decompiler");
options.grabFromToolAndProgram(null,opt,program);
}
decomplib.setOptions(options);
decomplib.toggleCCode(true);
decomplib.toggleSyntaxTree(true);
decomplib.setSimplificationStyle("decompile");
}
private void setUpDataTypes() throws NotFoundException {
eventDescriptorType = getDataType("EVENT_DESCRIPTOR");
ulonglongType = getDataType("ULONGLONG");
ushortType = getDataType("USHORT");
ucharType = getDataType("UCHAR");
guidType = getDataType("GUID");
stringType = getDataType("TerminatedCString");
}
private DataType getDataType(String name) throws NotFoundException {
DataTypeManagerService service = state.getTool().getService(DataTypeManagerService.class);
// Loop through all managers in the data type manager service
for (DataTypeManager manager : service.getDataTypeManagers()) {
List<DataType> dataTypes = new ArrayList<DataType>();
manager.findDataTypes(name, dataTypes);
if(dataTypes.size() != 0)
return dataTypes.get(0);
}
throw new NotFoundException(name);
}
private void debugPrintf(String template, Object... args) {
if(debugPrint)
printf("[DEBUG] " + template, args);
}
private void logTODO(String message) {
if(!notYetImplemented.contains(message))
notYetImplemented.add(message);
}
public class QueuedFunction
{
public Function queuedFunction;
public Function callingFunction;
public int callDepth;
public int exportedCallDepth;
public Stack<Function> callPath;
public QueuedFunction(Function queuedFunction, Function callingFunction, int callDepth, int exportedCallDepth, Stack<Function> callPath )
{
this.queuedFunction = queuedFunction;
this.callingFunction = callingFunction;
this.callDepth = callDepth;
this.exportedCallDepth = exportedCallDepth;
this.callPath = callPath;
}
}
//
// Some helpful constants from Windows headers
//
public String LookupPerfInfoMask(long perfinfo) {
switch((int)perfinfo) {
case 0x00000001: return "PROCESS";
case 0x00000002: return "THREAD";
case 0x00000004: return "LOADER";
case 0x00000200: return "FILENAME";
case 0x00001000: return "ALL_FAULTS";
case 0x00002000: return "HARD_FAULTS";
case 0x00010000: return "NETWORK";
case 0x00020000: return "REGISTRY";
case 0x00040000: return "DBGPRINT";
case 0x00000008: return "COUNTER";
case 0x00000400: return "DISK_IO_INIT";
case 0x00100000: return "ALPC";
case 0x00200000: return "SPLIT_IO";
case 0x02000000: return "FILE_IO";
case 0x04000000: return "FILE_IO_INIT";
case 0x00008000: return "VAMAP";
case 0x20000001: return "MEMORY";
case 0x20000002: return "PROFILE";
case 0x20000004: return "CONTEXT_SWITCH";
case 0x20000008: return "FOOTPRINT";
case 0x20000010: return "DRIVERS";
case 0x20000020: return "REFSET";
case 0x20000040: return "POOL";
case 0x20000041: return "POOLTRACE";
case 0x20000080: return "DPC";
case 0x20000100: return "COMPACT_CSWITCH";
case 0x20000200: return "DISPATCHER";
case 0x20000400: return "PMC_PROFILE";
case 0x20000402: return "PROFILING";
case 0x20000800: return "PROCESS_INSWAP";
case 0x20001000: return "AFFINITY";
case 0x20002000: return "PRIORITY";
case 0x20004000: return "INTERRUPT";
case 0x20008000: return "VIRTUAL_ALLOC";
case 0x20010000: return "SPINLOCK";
case 0x20020000: return "SYNC_OBJECTS";
case 0x20040000: return "DPC_QUEUE";
case 0x20080000: return "MEMINFO";
case 0x20100000: return "CONTMEM_GEN";
case 0x20200000: return "SPINLOCK_CNTRS";
case 0x20210000: return "SPININSTR";
case 0x20400000: return "SESSION";
case 0x20800000: return "MEMINFO_WS";
case 0x21000000: return "KERNEL_QUEUE";
case 0x22000000: return "INTERRUPT_STEER";
case 0x24000000: return "SHOULD_YIELD";
case 0x28000000: return "WS";
case 0x40000001: return "ANTI_STARVATION";
case 0x40000002: return "PROCESS_FREEZE";
case 0x40000004: return "PFN_LIST";
case 0x40000008: return "WS_DETAIL";
case 0x40000010: return "WS_ENTRY";
case 0x40000020: return "HEAP";
case 0x40000040: return "SYSCALL";
case 0x40000080: return "UMS";
case 0x40000100: return "BACKTRACE";
case 0x40000200: return "VULCAN";
case 0x40000400: return "OBJECTS";
case 0x40000800: return "EVENTS";
case 0x40001000: return "FULLTRACE";
case 0x40002000: return "DFSS";
case 0x40004000: return "PREFETCH";
case 0x40008000: return "PROCESSOR_IDLE";
case 0x40010000: return "CPU_CONFIG";
case 0x40020000: return "TIMER";
case 0x40040000: return "CLOCK_INTERRUPT";
case 0x40080000: return "LOAD_BALANCER";
case 0x40100000: return "CLOCK_TIMER";
case 0x40200000: return "IDLE_SELECTION";
case 0x40400000: return "IPI";
case 0x40800000: return "IO_TIMER";
case 0x41000000: return "REG_HIVE";
case 0x42000000: return "REG_NOTIF";
case 0x44000000: return "PPM_EXIT_LATENCY";
case 0x48000000: return "WORKER_THREAD";
case 0x80000001: return "OPTICAL_IO";
case 0x80000002: return "OPTICAL_IO_INIT";
case 0x80000008: return "DLL_INFO";
case 0x80000010: return "DLL_FLUSH_WS";
case 0x80000040: return "OB_HANDLE";
case 0x80000080: return "OB_OBJECT";
case 0x80000200: return "WAKE_DROP";
case 0x80000400: return "WAKE_EVENT";
case 0x80000800: return "DEBUGGER";
case 0x80001000: return "PROC_ATTACH";
case 0x80002000: return "WAKE_COUNTER";
case 0x80008000: return "POWER";
case 0x80010000: return "SOFT_TRIM";
case 0x80020000: return "CC";
case 0x80080000: return "FLT_IO_INIT";
case 0x80100000: return "FLT_IO";
case 0x80200000: return "FLT_FASTIO";
case 0x80400000: return "FLT_IO_FAILURE";
case 0x80800000: return "HV_PROFILE";
case 0x81000000: return "WDF_DPC";
case 0x82000000: return "WDF_INTERRUPT";
case 0x84000000: return "CACHE_FLUSH";
case 0xA0000001: return "HIBER_RUNDOWN";
case 0x00000000: return "SYSCFG_SYSTEM";
case 0xC0000001: return "SYSCFG_GRAPHICS";
case 0xC0000004: return "SYSCFG_STORAGE";
case 0xC0000008: return "SYSCFG_NETWORK";
case 0xC0000010: return "SYSCFG_SERVICES";
case 0xC0000020: return "SYSCFG_PNP";
case 0xC0000040: return "SYSCFG_OPTICAL";
}
return "PERF_" + String.format("0x%x", perfinfo);
}
public String LookupTraceGroup(long logtype) {
switch((int)logtype & 0xFF00 ) {
case 0x0000: return "HEADER";
case 0x0100: return "IO";
case 0x0200: return "MEMORY";
case 0x0300: return "PROCESS";
case 0x0400: return "FILE";
case 0x0500: return "THREAD";
case 0x0600: return "TCPIP";
case 0x0700: return "JOB";
case 0x0800: return "UDPIP";
case 0x0900: return "REGISTRY";
case 0x0A00: return "DBGPRINT";
case 0x0B00: return "CONFIG";
case 0x0D00: return "WNF";
case 0x0E00: return "POOL";
case 0x0F00: return "PERFINFO";
case 0x1000: return "HEAP";
case 0x1100: return "OBJECT";
case 0x1200: return "POWER";
case 0x1300: return "MODBOUND";
case 0x1400: return "IMAGE";
case 0x1500: return "DPC";
case 0x1600: return "CC";
case 0x1700: return "CRITSEC";
case 0x1800: return "STACKWALK";
case 0x1900: return "UMS";
case 0x1A00: return "ALPC";
case 0x1B00: return "SPLITIO";
case 0x1C00: return "THREAD_POOL";
case 0x1D00: return "HYPERVISOR";
case 0x1E00: return "HYPERVISORX";
}
return "EVENT_TRACE_GROUP_" + String.format("0x%x", logtype);
}
public String LookupLogType(long logtype) {
switch((int)logtype) {
case 0x0000: return "HEADER";
case 0x0005: return "HEADER_EXTENSION";
case 0x0008: return "RUNDOWN_COMPLETE";
case 0x0020: return "GROUP_MASKS_END";
case 0x0030: return "RUNDOWN_BEGIN";
case 0x0031: return "RUNDOWN_END";
case 0x0040: return "DBGID_RSDS";
case 0x0041: return "DBGID_NB10";
case 0x0042: return "BUILD_LAB";
case 0x0043: return "BINARY_PATH";
case 0x010A: return "IO_READ";
case 0x010B: return "IO_WRITE";
case 0x010C: return "IO_READ_INIT";
case 0x010D: return "IO_WRITE_INIT";
case 0x010E: return "IO_FLUSH";
case 0x010F: return "IO_FLUSH_INIT";
case 0x0110: return "IO_REDIRECTED_INIT";
case 0x0120: return "DRIVER_INIT";
case 0x0121: return "DRIVER_INIT_COMPLETE";
case 0x0122: return "DRIVER_MAJORFUNCTION_CALL";
case 0x0123: return "DRIVER_MAJORFUNCTION_RETURN";
case 0x0124: return "DRIVER_COMPLETIONROUTINE_CALL";
case 0x0125: return "DRIVER_COMPLETIONROUTINE_RETURN";
case 0x0126: return "DRIVER_ADD_DEVICE_CALL";
case 0x0127: return "DRIVER_ADD_DEVICE_RETURN";
case 0x0128: return "DRIVER_STARTIO_CALL";
case 0x0129: return "DRIVER_STARTIO_RETURN";
case 0x0130: return "PREFETCH_ACTION";
case 0x0131: return "PREFETCH_REQUEST";
case 0x0132: return "PREFETCH_READLIST";
case 0x0133: return "PREFETCH_READ";
case 0x0134: return "DRIVER_COMPLETE_REQUEST";
case 0x0135: return "DRIVER_COMPLETE_REQUEST_RETURN";
case 0x0136: return "BOOT_PREFETCH_INFORMATION";
case 0x0137: return "OPTICAL_IO_READ";
case 0x0138: return "OPTICAL_IO_WRITE";
case 0x0139: return "OPTICAL_IO_FLUSH";
case 0x013A: return "OPTICAL_IO_READ_INIT";
case 0x013B: return "OPTICAL_IO_WRITE_INIT";
case 0x013C: return "OPTICAL_IO_FLUSH_INIT";
case 0x020A: return "PAGE_FAULT_TRANSITION";
case 0x020B: return "PAGE_FAULT_DEMAND_ZERO";
case 0x020C: return "PAGE_FAULT_COPY_ON_WRITE";
case 0x020D: return "PAGE_FAULT_GUARD_PAGE";
case 0x020E: return "PAGE_FAULT_HARD_PAGE_FAULT";
case 0x020F: return "PAGE_FAULT_ACCESS_VIOLATION";
case 0x0220: return "HARDFAULT";
case 0x0221: return "REMOVEPAGEBYCOLOR";
case 0x0222: return "REMOVEPAGEFROMLIST";
case 0x0223: return "PAGEINMEMORY";
case 0x0224: return "INSERTINFREELIST";
case 0x0225: return "INSERTINMODIFIEDLIST";
case 0x0226: return "INSERTINLIST";
case 0x0228: return "INSERTATFRONT";
case 0x0229: return "UNLINKFROMSTANDBY";
case 0x022A: return "UNLINKFFREEORZERO";
case 0x022B: return "WORKINGSETMANAGER";
case 0x022C: return "TRIMPROCESS";
case 0x022E: return "ZEROSHARECOUNT";
case 0x023C: return "WSINFOPROCESS";
case 0x0245: return "FAULTADDR_WITH_IP";
case 0x0246: return "TRIMSESSION";
case 0x0247: return "MEMORYSNAPLITE";
case 0x0248: return "PFMAPPED_SECTION_RUNDOWN";
case 0x0249: return "PFMAPPED_SECTION_CREATE";
case 0x024A: return "WSINFOSESSION";
case 0x024B: return "CREATE_SESSION";
case 0x024C: return "SESSION_RUNDOWN_DC_END";
case 0x024D: return "SESSION_RUNDOWN_DC_START";
case 0x024E: return "SESSION_DELETE";
case 0x024F: return "PFMAPPED_SECTION_DELETE";
case 0x0262: return "VIRTUAL_ALLOC";
case 0x0263: return "VIRTUAL_FREE";
case 0x0264: return "HEAP_RANGE_RUNDOWN";
case 0x0265: return "HEAP_RANGE_CREATE";
case 0x0266: return "HEAP_RANGE_RESERVE";
case 0x0267: return "HEAP_RANGE_RELEASE";
case 0x0268: return "HEAP_RANGE_DESTROY";
case 0x0269: return "PAGEFILE_BACK";
case 0x0270: return "MEMINFO";
case 0x0271: return "CONTMEM_GENERATE";
case 0x0272: return "FILE_STORE_FAULT";
case 0x0273: return "INMEMORY_STORE_FAULT";
case 0x0274: return "COMPRESSED_PAGE";
case 0x0275: return "PAGEINMEMORY_ACTIVE";
case 0x0276: return "PAGE_ACCESS";
case 0x0277: return "PAGE_RELEASE";
case 0x0278: return "PAGE_RANGE_ACCESS";
case 0x0279: return "PAGE_RANGE_RELEASE";
case 0x027A: return "PAGE_COMBINE";
case 0x027B: return "KERNEL_MEMUSAGE";
case 0x027C: return "MM_STATS";
case 0x027D: return "MEMINFOEX_WS";
case 0x027E: return "MEMINFOEX_SESSIONWS";
case 0x027F: return "VIRTUAL_ROTATE";
case 0x0280: return "VIRTUAL_ALLOC_DC_START";
case 0x0281: return "VIRTUAL_ALLOC_DC_END";
case 0x0282: return "PAGE_ACCESS_EX";
case 0x0283: return "REMOVEFROMWS";
case 0x0284: return "WSSHAREABLE_RUNDOWN";
case 0x0285: return "INMEMORYACTIVE_RUNDOWN";
case 0x0286: return "MEM_RESET_INFO";
case 0x0287: return "PFMAPPED_SECTION_OBJECT_CREATE";
case 0x0288: return "PFMAPPED_SECTION_OBJECT_DELETE";
case 0x0301: return "PROCESS_CREATE";
case 0x0302: return "PROCESS_DELETE";
case 0x0303: return "PROCESS_DC_START";
case 0x0304: return "PROCESS_DC_END";
case 0x030A: return "PROCESS_LOAD_IMAGE";
case 0x030B: return "PROCESS_TERMINATE";
case 0x0320: return "PROCESS_PERFCTR_END";
case 0x0321: return "PROCESS_PERFCTR_RD";
case 0x0323: return "INSWAPPROCESS";
case 0x0324: return "PROCESS_FREEZE";
case 0x0325: return "PROCESS_THAW";
case 0x0326: return "BOOT_PHASE_START";
case 0x0327: return "ZOMBIE_PROCESS";
case 0x0328: return "PROCESS_SET_AFFINITY";
case 0x0330: return "CHARGE_WAKE_COUNTER_USER";
case 0x0331: return "CHARGE_WAKE_COUNTER_EXECUTION";
case 0x0332: return "CHARGE_WAKE_COUNTER_KERNEL";
case 0x0333: return "CHARGE_WAKE_COUNTER_INSTRUMENTATION";
case 0x0334: return "CHARGE_WAKE_COUNTER_PRESERVE_PROCESS";
case 0x0340: return "RELEASE_WAKE_COUNTER_USER";
case 0x0341: return "RELEASE_WAKE_COUNTER_EXECUTION";
case 0x0342: return "RELEASE_WAKE_COUNTER_KERNEL";
case 0x0343: return "RELEASE_WAKE_COUNTER_INSTRUMENTATION";
case 0x0344: return "RELEASE_WAKE_COUNTER_PRESERVE_PROCESS";
case 0x0350: return "WAKE_DROP_USER";
case 0x0351: return "WAKE_DROP_EXECUTION";
case 0x0352: return "WAKE_DROP_KERNEL";
case 0x0353: return "WAKE_DROP_INSTRUMENTATION";
case 0x0354: return "WAKE_DROP_PRESERVE_PROCESS";
case 0x0360: return "WAKE_EVENT_USER";
case 0x0361: return "WAKE_EVENT_EXECUTION";
case 0x0362: return "WAKE_EVENT_KERNEL";
case 0x0363: return "WAKE_EVENT_INSTRUMENTATION";
case 0x0364: return "WAKE_EVENT_PRESERVE_PROCESS";
case 0x0370: return "DEBUG_EVENT";
case 0x0400: return "FILENAME";
case 0x0420: return "FILENAME_CREATE";
case 0x0421: return "FILENAME_SAME";
case 0x0422: return "FILENAME_NULL";
case 0x0423: return "FILENAME_DELETE";
case 0x0424: return "FILENAME_RUNDOWN";
case 0x0425: return "MAPFILE";
case 0x0426: return "UNMAPFILE";
case 0x0427: return "MAPFILE_DC_START";
case 0x0428: return "MAPFILE_DC_END";
case 0x0440: return "FILE_IO_CREATE";
case 0x0441: return "FILE_IO_CLEANUP";
case 0x0442: return "FILE_IO_CLOSE";
case 0x0443: return "FILE_IO_READ";
case 0x0444: return "FILE_IO_WRITE";
case 0x0445: return "FILE_IO_SET_INFORMATION";
case 0x0446: return "FILE_IO_DELETE";
case 0x0447: return "FILE_IO_RENAME";
case 0x0448: return "FILE_IO_DIRENUM";
case 0x0449: return "FILE_IO_FLUSH";
case 0x044A: return "FILE_IO_QUERY_INFORMATION";
case 0x044B: return "FILE_IO_FS_CONTROL";
case 0x044C: return "FILE_IO_OPERATION_END";
case 0x044D: return "FILE_IO_DIRNOTIFY";
case 0x044E: return "FILE_IO_CREATE_NEW";
case 0x044F: return "FILE_IO_DELETE_PATH";
case 0x0450: return "FILE_IO_RENAME_PATH";
case 0x0451: return "FILE_IO_SETLINK_PATH";
case 0x0452: return "FILE_IO_SETLINK";
case 0x0460: return "FLT_PREOP_INIT";
case 0x0461: return "FLT_POSTOP_INIT";
case 0x0462: return "FLT_PREOP_COMPLETION";
case 0x0463: return "FLT_POSTOP_COMPLETION";
case 0x0464: return "FLT_PREOP_FAILURE";
case 0x0465: return "FLT_POSTOP_FAILURE";
case 0x0501: return "THREAD_CREATE";
case 0x0502: return "THREAD_DELETE";
case 0x0503: return "THREAD_DC_START";
case 0x0504: return "THREAD_DC_END";
case 0x0524: return "CONTEXTSWAP";
case 0x0525: return "CONTEXTSWAP_BATCH";
case 0x0529: return "SPINLOCK";
case 0x052A: return "QUEUE";
case 0x052B: return "RESOURCE";
case 0x052C: return "PUSHLOCK";
case 0x052D: return "WAIT_SINGLE";
case 0x052E: return "WAIT_MULTIPLE";
case 0x052F: return "DELAY_EXECUTION";
case 0x0530: return "THREAD_SET_PRIORITY";
case 0x0531: return "THREAD_SET_BASE_PRIORITY";
case 0x0532: return "READY_THREAD";
case 0x0533: return "THREAD_SET_PAGE_PRIORITY";
case 0x0534: return "THREAD_SET_IO_PRIORITY";
case 0x0535: return "THREAD_SET_AFFINITY";
case 0x0539: return "WORKER_THREAD_ITEM";
case 0x053A: return "DFSS_START_NEW_INTERVAL";
case 0x053B: return "DFSS_PROCESS_IDLE_ONLY_QUEUE";
case 0x053C: return "ANTI_STARVATION_BOOST";
case 0x053D: return "THREAD_MIGRATION";
case 0x053E: return "KQUEUE_ENQUEUE";
case 0x053F: return "KQUEUE_DEQUEUE";
case 0x0540: return "WORKER_THREAD_ITEM_START";
case 0x0541: return "WORKER_THREAD_ITEM_END";
case 0x0542: return "AUTO_BOOST_SET_FLOOR";
case 0x0543: return "AUTO_BOOST_CLEAR_FLOOR";
case 0x0544: return "AUTO_BOOST_NO_ENTRIES";
case 0x0545: return "THREAD_SUBPROCESSTAG_CHANGED";
case 0x060A: return "TCPIP_SEND";
case 0x060B: return "TCPIP_RECEIVE";
case 0x060C: return "TCPIP_CONNECT";
case 0x060D: return "TCPIP_DISCONNECT";
case 0x060E: return "TCPIP_RETRANSMIT";
case 0x060F: return "TCPIP_ACCEPT";
case 0x0610: return "TCPIP_RECONNECT";
case 0x0611: return "TCPIP_FAIL";
case 0x0612: return "TCPIP_TCPCOPY";
case 0x0613: return "TCPIP_ARPCOPY";
case 0x0614: return "TCPIP_FULLACK";
case 0x0615: return "TCPIP_PARTACK";
case 0x0616: return "TCPIP_DUPACK";
case 0x061A: return "TCPIP_SEND_IPV6";
case 0x061B: return "TCPIP_RECEIVE_IPV6";
case 0x061C: return "TCPIP_CONNECT_IPV6";
case 0x061D: return "TCPIP_DISCONNECT_IPV6";
case 0x061E: return "TCPIP_RETRANSMIT_IPV6";
case 0x061F: return "TCPIP_ACCEPT_IPV6";
case 0x0620: return "TCPIP_RECONNECT_IPV6";
case 0x0621: return "TCPIP_FAIL_IPV6";
case 0x0622: return "TCPIP_TCPCOPY_IPV6";
case 0x0623: return "TCPIP_ARPCOPY_IPV6";
case 0x0624: return "TCPIP_FULLACK_IPV6";
case 0x0625: return "TCPIP_PARTACK_IPV6";
case 0x0626: return "TCPIP_DUPACK_IPV6";
case 0x0720: return "JOB_CREATE";
case 0x0721: return "JOB_TERMINATE";
case 0x0722: return "JOB_OPEN";
case 0x0723: return "JOB_ASSIGN_PROCESS";
case 0x0724: return "JOB_REMOVE_PROCESS";
case 0x0725: return "JOB_SET";
case 0x0726: return "JOB_QUERY";
case 0x0727: return "JOB_SET_FAILED";
case 0x0728: return "JOB_QUERY_FAILED";
case 0x0729: return "JOB_SET_NOTIFICATION";
case 0x072A: return "JOB_SEND_NOTIFICATION";
case 0x072B: return "JOB_QUERY_VIOLATION";
case 0x072C: return "JOB_SET_CPU_RATE";
case 0x072D: return "JOB_SET_NET_RATE";
case 0x080A: return "UDP_SEND";
case 0x080B: return "UDP_RECEIVE";
case 0x0811: return "UDP_FAIL";
case 0x081A: return "UDP_SEND_IPV6";
case 0x081B: return "UDP_RECEIVE_IPV6";
case 0x0918: return "REG_RUNDOWNBEGIN";
case 0x0919: return "REG_RUNDOWNEND";
case 0x0920: return "CMCELLREFERRED";
case 0x0921: return "REG_SET_VALUE";
case 0x0922: return "REG_COUNTERS";
case 0x0923: return "REG_CONFIG";
case 0x0924: return "REG_HIVE_INITIALIZE";
case 0x0925: return "REG_HIVE_DESTROY";
case 0x0926: return "REG_HIVE_LINK";
case 0x0927: return "REG_HIVE_RUNDOWN_DC_END";
case 0x0928: return "REG_HIVE_DIRTY";
case 0x0930: return "REG_NOTIF_REGISTER";
case 0x0931: return "REG_NOTIF_DELIVER";
case 0x0A20: return "DEBUG_PRINT";
case 0x0B0A: return "CONFIG_CPU";
case 0x0B0B: return "CONFIG_PHYSICALDISK";
case 0x0B0C: return "CONFIG_LOGICALDISK";
case 0x0B0D: return "CONFIG_NIC";
case 0x0B0E: return "CONFIG_VIDEO";
case 0x0B0F: return "CONFIG_SERVICES";
case 0x0B10: return "CONFIG_POWER";
case 0x0B12: return "CONFIG_OPTICALMEDIA";
case 0x0B15: return "CONFIG_IRQ";
case 0x0B16: return "CONFIG_PNP";
case 0x0B17: return "CONFIG_IDECHANNEL";
case 0x0B18: return "CONFIG_NUMANODE";
case 0x0B19: return "CONFIG_PLATFORM";
case 0x0B1A: return "CONFIG_PROCESSORGROUP";
case 0x0B1B: return "CONFIG_PROCESSORNUMBER";
case 0x0B1C: return "CONFIG_DPI";
case 0x0B1D: return "CONFIG_CODEINTEGRITY";
case 0x0B1E: return "CONFIG_MACHINEID";
case 0x0D20: return "WNF_SUBSCRIBE";
case 0x0D21: return "WNF_UNSUBSCRIBE";
case 0x0D22: return "WNF_CALLBACK";
case 0x0D23: return "WNF_PUBLISH";
case 0x0D24: return "WNF_NAME_SUB_RUNDOWN";
case 0x0E20: return "ALLOCATEPOOL";
case 0x0E21: return "ALLOCATEPOOL_SESSION";
case 0x0E22: return "FREEPOOL";
case 0x0E23: return "FREEPOOL_SESSION";
case 0x0E24: return "ADDPOOLPAGE";
case 0x0E25: return "ADDPOOLPAGE_SESSION";
case 0x0E26: return "BIGPOOLPAGE";
case 0x0E27: return "BIGPOOLPAGE_SESSION";
case 0x0E28: return "POOLSNAP_DC_START";
case 0x0E29: return "POOLSNAP_DC_END";
case 0x0E2A: return "BIGPOOLSNAP_DC_START";
case 0x0E2B: return "BIGPOOLSNAP_DC_END";
case 0x0E2C: return "POOLSNAP_SESSION_DC_START";
case 0x0E2D: return "POOLSNAP_SESSION_DC_END";
case 0x0E2E: return "SESSIONBIGPOOLSNAP_DC_START";
case 0x0E2F: return "SESSIONBIGPOOLSNAP_DC_END";
case 0x0F20: return "RUNDOWN_CHECKPOINT";
case 0x0F22: return "MARK";
case 0x0F24: return "ASYNCMARK";
case 0x0F26: return "IMAGENAME";
case 0x0F27: return "DELAYS_CC_CAN_I_WRITE";
case 0x0F2E: return "SAMPLED_PROFILE";
case 0x0F2F: return "PMC_INTERRUPT";
case 0x0F30: return "PMC_CONFIG";
case 0x0F32: return "MSI_INTERRUPT";
case 0x0F33: return "SYSCALL_ENTER";
case 0x0F34: return "SYSCALL_EXIT";
case 0x0F35: return "BACKTRACE";
case 0x0F36: return "BACKTRACE_USERSTACK";
case 0x0F37: return "SAMPLED_PROFILE_CACHE";
case 0x0F38: return "EXCEPTION_STACK";
case 0x0F39: return "BRANCH_TRACE";
case 0x0F3A: return "DEBUGGER_ENABLED";
case 0x0F3B: return "DEBUGGER_EXIT";
case 0x0F40: return "BRANCH_TRACE_DEBUG";
case 0x0F41: return "BRANCH_ADDRESS_DEBUG";
case 0x0F42: return "THREADED_DPC";
case 0x0F43: return "INTERRUPT";
case 0x0F44: return "DPC";
case 0x0F45: return "TIMERDPC";
case 0x0F46: return "IOTIMER_EXPIRATION";
case 0x0F47: return "SAMPLED_PROFILE_NMI";
case 0x0F48: return "SAMPLED_PROFILE_SET_INTERVAL";
case 0x0F49: return "SAMPLED_PROFILE_DC_START";
case 0x0F4A: return "SAMPLED_PROFILE_DC_END";
case 0x0F4B: return "SPINLOCK_DC_START";
case 0x0F4C: return "SPINLOCK_DC_END";
case 0x0F4D: return "ERESOURCE_DC_START";
case 0x0F4E: return "ERESOURCE_DC_END";
case 0x0F4F: return "CLOCK_INTERRUPT";
case 0x0F50: return "TIMER_EXPIRATION_START";
case 0x0F51: return "TIMER_EXPIRATION";
case 0x0F52: return "TIMER_SET_PERIODIC";
case 0x0F53: return "TIMER_SET_ONE_SHOT";
case 0x0F54: return "TIMER_SET_THREAD";
case 0x0F55: return "TIMER_CANCEL";
case 0x0F56: return "TIME_ADJUSTMENT";
case 0x0F57: return "CLOCK_MODE_SWITCH";
case 0x0F58: return "CLOCK_TIME_UPDATE";
case 0x0F59: return "CLOCK_DYNAMIC_TICK_VETO";
case 0x0F5A: return "CLOCK_CONFIGURATION";
case 0x0F5B: return "IPI";
case 0x0F5C: return "UNEXPECTED_INTERRUPT";
case 0x0F5D: return "IOTIMER_START";
case 0x0F5E: return "IOTIMER_STOP";
case 0x0F5F: return "PASSIVE_INTERRUPT";
case 0x0F60: return "WDF_INTERRUPT";
case 0x0F61: return "WDF_PASSIVE_INTERRUPT";
case 0x0F62: return "WDF_DPC";
case 0x0F63: return "CPU_CACHE_FLUSH";
case 0x0F64: return "DPC_ENQUEUE";
case 0x0F65: return "DPC_EXECUTION";
case 0x0F66: return "INTERRUPT_STEERING";
case 0x0F67: return "WDF_WORK_ITEM";
case 0x0F68: return "KTIMER2_SET";
case 0x0F69: return "KTIMER2_EXPIRATION";
case 0x0F6A: return "KTIMER2_CANCEL";
case 0x0F6B: return "KTIMER2_DISABLE";
case 0x0F6C: return "KTIMER2_FINALIZATION";
case 0x0F6D: return "SHOULD_YIELD_PROCESSOR";
case 0x0F80: return "FUNCTION_CALL";
case 0x0F81: return "FUNCTION_RETURN";
case 0x0F82: return "FUNCTION_ENTER";
case 0x0F83: return "FUNCTION_EXIT";
case 0x0F84: return "TAILCALL";
case 0x0F85: return "TRAP";
case 0x0F86: return "SPINLOCK_ACQUIRE";
case 0x0F87: return "SPINLOCK_RELEASE";
case 0x0F88: return "CAP_COMMENT";
case 0x0F89: return "CAP_RUNDOWN";
case 0x1020: return "HEAP_CREATE";
case 0x1021: return "HEAP_ALLOC";
case 0x1022: return "HEAP_REALLOC";
case 0x1023: return "HEAP_DESTROY";
case 0x1024: return "HEAP_FREE";
case 0x1025: return "HEAP_EXTEND";
case 0x1026: return "HEAP_SNAPSHOT";
case 0x1027: return "HEAP_CREATE_SNAPSHOT";
case 0x1028: return "HEAP_DESTROY_SNAPSHOT";
case 0x1029: return "HEAP_EXTEND_SNAPSHOT";
case 0x102A: return "HEAP_CONTRACT";
case 0x102B: return "HEAP_LOCK";
case 0x102C: return "HEAP_UNLOCK";
case 0x102D: return "HEAP_VALIDATE";
case 0x102E: return "HEAP_WALK";
case 0x102F: return "HEAP_SUBSEGMENT_ALLOC";
case 0x1030: return "HEAP_SUBSEGMENT_FREE";
case 0x1031: return "HEAP_SUBSEGMENT_ALLOC_CACHE";
case 0x1032: return "HEAP_SUBSEGMENT_FREE_CACHE";
case 0x1033: return "HEAP_COMMIT";
case 0x1034: return "HEAP_DECOMMIT";
case 0x1035: return "HEAP_SUBSEGMENT_INIT";
case 0x1036: return "HEAP_AFFINITY_ENABLE";
case 0x1038: return "HEAP_SUBSEGMENT_ACTIVATED";
case 0x1039: return "HEAP_AFFINITY_ASSIGN";
case 0x103A: return "HEAP_REUSE_THRESHOLD_ACTIVATED";
case 0x1120: return "CREATE_HANDLE";
case 0x1121: return "CLOSE_HANDLE";
case 0x1122: return "DUPLICATE_HANDLE";
case 0x1124: return "OBJECT_TYPE_DC_START";
case 0x1125: return "OBJECT_TYPE_DC_END";
case 0x1126: return "OBJECT_HANDLE_DC_START";
case 0x1127: return "OBJECT_HANDLE_DC_END";
case 0x1130: return "CREATE_OBJECT";
case 0x1131: return "DELETE_OBJECT";
case 0x1132: return "REFERENCE_OBJECT";
case 0x1133: return "DEREFERENCE_OBJECT";
case 0x1220: return "BATTERY_LIFE_INFO";
case 0x1221: return "IDLE_STATE_CHANGE";
case 0x1222: return "SET_POWER_ACTION";
case 0x1223: return "SET_POWER_ACTION_RET";
case 0x1224: return "SET_DEVICES_STATE";
case 0x1225: return "SET_DEVICES_STATE_RET";
case 0x1226: return "PO_NOTIFY_DEVICE";
case 0x1227: return "PO_NOTIFY_DEVICE_COMPLETE";
case 0x1228: return "PO_SESSION_CALLOUT";
case 0x1229: return "PO_SESSION_CALLOUT_RET";
case 0x1230: return "PO_PRESLEEP";
case 0x1231: return "PO_POSTSLEEP";
case 0x1232: return "PO_CALIBRATED_PERFCOUNTER";
case 0x1233: return "PPM_PERF_STATE_CHANGE";
case 0x1234: return "PPM_THROTTLE_STATE_CHANGE";
case 0x1235: return "PPM_IDLE_STATE_CHANGE";
case 0x1236: return "PPM_THERMAL_CONSTRAINT";
case 0x1237: return "PO_SIGNAL_RESUME_UI";
case 0x1238: return "PO_SIGNAL_VIDEO_ON";
case 0x1239: return "PPM_IDLE_STATE_ENTER";
case 0x123A: return "PPM_IDLE_STATE_EXIT";
case 0x123B: return "PPM_PLATFORM_IDLE_STATE_ENTER";
case 0x123C: return "PPM_IDLE_EXIT_LATENCY";
case 0x123D: return "PPM_IDLE_PROCESSOR_SELECTION";
case 0x123E: return "PPM_IDLE_PLATFORM_SELECTION";
case 0x123F: return "PPM_COORDINATED_IDLE_ENTER";
case 0x1240: return "PPM_COORDINATED_IDLE_EXIT";
case 0x1318: return "COWHEADER";
case 0x1319: return "COWBLOB";
case 0x131A: return "COWBLOB_CLOSED";
case 0x1320: return "MODULEBOUND_ENT";
case 0x1321: return "MODULEBOUND_JUMP";
case 0x1322: return "MODULEBOUND_RET";
case 0x1323: return "MODULEBOUND_CALL";
case 0x1324: return "MODULEBOUND_CALLRET";
case 0x1325: return "MODULEBOUND_INT2E";
case 0x1326: return "MODULEBOUND_INT2B";
case 0x1327: return "MODULEBOUND_FULLTRACE";
case 0x1401: return "IMAGE_LOAD";
case 0x1402: return "IMAGE_UNLOAD";
case 0x1403: return "IMAGE_DC_START";
case 0x1404: return "IMAGE_DC_END";
case 0x1420: return "IMAGE_RELOCATION";
case 0x1421: return "IMAGE_KERNEL_BASE";
case 0x1422: return "IMAGE_HYPERCALL_PAGE";
case 0x1480: return "LDR_LOCK_ACQUIRE_ATTEMPT";
case 0x1481: return "LDR_LOCK_ACQUIRE_SUCCESS";
case 0x1482: return "LDR_LOCK_ACQUIRE_FAIL";
case 0x1483: return "LDR_LOCK_ACQUIRE_WAIT";
case 0x1484: return "LDR_PROC_INIT_DONE";
case 0x1485: return "LDR_CREATE_SECTION";
case 0x1486: return "LDR_SECTION_CREATED";
case 0x1487: return "LDR_MAP_VIEW";
case 0x1490: return "LDR_RELOCATE_IMAGE";
case 0x1491: return "LDR_IMAGE_RELOCATED";
case 0x1492: return "LDR_HANDLE_OLD_DESCRIPTORS";
case 0x1493: return "LDR_OLD_DESCRIPTORS_HANDLED";
case 0x1494: return "LDR_HANDLE_NEW_DESCRIPTORS";
case 0x1495: return "LDR_NEW_DESCRIPTORS_HANDLED";
case 0x1496: return "LDR_DLLMAIN_EXIT";
case 0x14A0: return "LDR_FIND_DLL";
case 0x14A1: return "LDR_VIEW_MAPPED";
case 0x14A2: return "LDR_LOCK_RELEASE";
case 0x14A3: return "LDR_DLLMAIN_ENTER";
case 0x14A4: return "LDR_ERROR";
case 0x14A5: return "LDR_VIEW_MAPPING";
case 0x14A6: return "LDR_SNAPPING";
case 0x14A7: return "LDR_SNAPPED";
case 0x14A8: return "LDR_LOADING";
case 0x14A9: return "LDR_LOADED";
case 0x14AA: return "LDR_FOUND_KNOWN_DLL";
case 0x14AB: return "LDR_ABNORMAL";
case 0x14AC: return "LDR_PLACEHOLDER";
case 0x14AD: return "LDR_RDY_TO_INIT";
case 0x14AE: return "LDR_RDY_TO_RUN";
case 0x14B0: return "LDR_NEW_DLL_LOAD";
case 0x14B1: return "LDR_NEW_DLL_AS_DATA";
case 0x14C0: return "LDR_EXTERNAL_PATH";
case 0x14C1: return "LDR_GENERATED_PATH";
case 0x14D0: return "LDR_APISET_RESOLVING";
case 0x14D1: return "LDR_APISET_HOSTED";
case 0x14D2: return "LDR_APISET_UNHOSTED";
case 0x14D3: return "LDR_APISET_UNRESOLVED";
case 0x14D4: return "LDR_SEARCH_SECURITY";
case 0x14D5: return "LDR_SEARCH_PATH_SECURITY";
case 0x1600: return "CC_WORKITEM_ENQUEUE";
case 0x1601: return "CC_WORKITEM_DEQUEUE";
case 0x1602: return "CC_WORKITEM_COMPLETE";
case 0x1603: return "CC_READ_AHEAD";
case 0x1604: return "CC_WRITE_BEHIND";
case 0x1605: return "CC_LAZY_WRITE_SCAN";
case 0x1606: return "CC_CAN_I_WRITE_FAIL";
case 0x1609: return "CC_FLUSH_CACHE";
case 0x160A: return "CC_FLUSH_SECTION";
case 0x160B: return "CC_READ_AHEAD_PREFETCH";
case 0x160C: return "CC_SCHEDULE_READ_AHEAD";
case 0x160D: return "CC_LOGGED_STREAM_INFO";
case 0x160E: return "CC_EXTRA_WRITEBEHIND_THREAD";
case 0x1720: return "CRITSEC_ENTER";
case 0x1721: return "CRITSEC_LEAVE";
case 0x1722: return "CRITSEC_COLLISION";
case 0x1723: return "CRITSEC_INITIALIZE";
case 0x1820: return "STACKWALK";
case 0x1822: return "STACKTRACE_CREATE";
case 0x1823: return "STACKTRACE_DELETE";
case 0x1824: return "STACKTRACE_RUNDOWN";
case 0x1825: return "STACKTRACE_KEY_KERNEL";
case 0x1826: return "STACKTRACE_KEY_USER";
case 0x1920: return "UMS_DIRECTED_SWITCH_START";
case 0x1921: return "UMS_DIRECTED_SWITCH_END";
case 0x1922: return "UMS_PARK";
case 0x1923: return "UMS_DISASSOCIATE";
case 0x1924: return "UMS_CONTEXT_SWITCH";
case 0x1A21: return "ALPC_SEND_MESSAGE";
case 0x1A22: return "ALPC_RECEIVE_MESSAGE";
case 0x1A23: return "ALPC_WAIT_FOR_REPLY";
case 0x1A24: return "ALPC_WAIT_FOR_NEW_MESSAGE";
case 0x1A25: return "ALPC_UNWAIT";
case 0x1A26: return "ALPC_CONNECT_REQUEST";
case 0x1A27: return "ALPC_CONNECT_SUCCESS";
case 0x1A28: return "ALPC_CONNECT_FAIL";
case 0x1A29: return "ALPC_CLOSE_PORT";
case 0x1B20: return "SPLITIO_VOLMGR";
case 0x1C20: return "TP_CALLBACK_ENQUEUE";
case 0x1C21: return "TP_CALLBACK_DEQUEUE";
case 0x1C22: return "TP_CALLBACK_START";
case 0x1C23: return "TP_CALLBACK_STOP";
case 0x1C24: return "TP_CALLBACK_CANCEL";
case 0x1C25: return "TP_POOL_CREATE";
case 0x1C26: return "TP_POOL_CLOSE";
case 0x1C27: return "TP_POOL_TH_MIN_SET";
case 0x1C28: return "TP_POOL_TH_MAX_SET";
case 0x1C29: return "TP_WORKER_NUMANODE_SWITCH";
case 0x1C2A: return "TP_TIMER_SET";
case 0x1C2B: return "TP_TIMER_CANCELLED";
case 0x1C2C: return "TP_TIMER_SET_NTTIMER";
case 0x1C2D: return "TP_TIMER_CANCEL_NTTIMER";
case 0x1C2E: return "TP_TIMER_EXPIRATION_BEGIN";
case 0x1C2F: return "TP_TIMER_EXPIRATION_END";
case 0x1C30: return "TP_TIMER_EXPIRATION";
}
return "PERFINFO_LOG_TYPE_" + String.format("0x%x", logtype);
}
}
Reference in New Issue View Git Blame Copy Permalink