Skip to content

Commit

Permalink
Merge pull request #8 from kirbyUK/main
Browse files Browse the repository at this point in the history 
Initial ETW probe support
  • Loading branch information
@stevemk14ebr
stevemk14ebr authored Oct 4, 2022
2 parents 27e57cd + f4d179e commit 0a1d3cc
Show file tree
Hide file tree
Showing 16 changed files with 803 additions and 58 deletions.
176 changes: 176 additions & 0 deletions C/EtwCallbackPlugin/EtwCallbackPlugin.vcxproj
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,176 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{3ac65894-4a8a-487a-bc59-5917b91e2169}</ProjectGuid>
<RootNamespace>EtwCallbackPlugin</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpplatest</LanguageStandard>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<AdditionalDependencies>..\ntoskrnl.lib</AdditionalDependencies>
<EnableUAC>false</EnableUAC>
<EntryPointSymbol>Main</EntryPointSymbol>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpplatest</LanguageStandard>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<AdditionalDependencies>..\ntoskrnl.lib</AdditionalDependencies>
<EnableUAC>false</EnableUAC>
<EntryPointSymbol>Main</EntryPointSymbol>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpplatest</LanguageStandard>
<ExceptionHandling>false</ExceptionHandling>
<BasicRuntimeChecks />
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<AdditionalDependencies>..\ntoskrnl.lib</AdditionalDependencies>
<EnableUAC>false</EnableUAC>
<EntryPointSymbol>Main</EntryPointSymbol>
<OptimizeReferences>true</OptimizeReferences>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>false</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpplatest</LanguageStandard>
<WholeProgramOptimization>false</WholeProgramOptimization>
<ExceptionHandling>false</ExceptionHandling>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<AdditionalDependencies>..\ntoskrnl.lib</AdditionalDependencies>
<EnableUAC>false</EnableUAC>
<EntryPointSymbol>Main</EntryPointSymbol>
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="dllmain.cpp" />
<ClCompile Include="Interface.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="Interface.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
</Project>
30 changes: 30 additions & 0 deletions C/EtwCallbackPlugin/EtwCallbackPlugin.vcxproj.filters
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<Filter Include="Source Files">
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
</Filter>
<Filter Include="Header Files">
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
</Filter>
<Filter Include="Resource Files">
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="dllmain.cpp">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="Interface.cpp">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="Interface.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
</Project>
24 changes: 24 additions & 0 deletions C/EtwCallbackPlugin/Interface.cpp
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
#include "Interface.h"

UNICODE_STRING WideToUnicodeString(PCWSTR SourceString)
{
UNICODE_STRING DestinationString;

SIZE_T Size;
CONST SIZE_T MaxSize = (MAXUSHORT & ~1) - sizeof(UNICODE_NULL); // an even number

if (SourceString)
{
Size = wcslen(SourceString) * sizeof(WCHAR);
if (Size > MaxSize)
Size = MaxSize;
DestinationString.Length = (USHORT)Size;
DestinationString.MaximumLength = (USHORT)Size + sizeof(UNICODE_NULL);
} else {
DestinationString.Length = 0;
DestinationString.MaximumLength = 0;
}

DestinationString.Buffer = (PWCHAR)SourceString;
return DestinationString;
}
108 changes: 108 additions & 0 deletions C/EtwCallbackPlugin/Interface.h
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,108 @@
#pragma once
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
#include <subauth.h>
#include <stdint.h>
#include <evntcons.h>
#include <type_traits>

class MachineState
{
public:
uint32_t paramCount;
uint32_t regArgsSize;
uint64_t* pStackArgs;
uint64_t* pRegArgs;

uint64_t read_argument(const uint32_t idx)
{
if (idx > paramCount || regArgsSize > paramCount)
return 0;

if (idx >= regArgsSize) {
// stack array trims off the register array data, and indexes from that offset value
return pStackArgs[idx - regArgsSize];
}
else {
return pRegArgs[idx];
}
}

template<typename T>
void write_argument(const uint32_t idx, T value) {
if (idx > paramCount || regArgsSize > paramCount)
return;

if (idx >= regArgsSize) {
// stack array trims off the register array data, and indexes from that offset value
pStackArgs[idx - regArgsSize] = (uint64_t)value;
}
else {
pRegArgs[idx] = (uint64_t)value;
}
}

uint64_t read_return_value() {
return pRegArgs[0];
}

template<typename T>
void write_return_value(T value) {
pRegArgs[0] = (uint64_t)value;
}
};

typedef LONG NTSTATUS;
typedef NTSTATUS(*tLogPrintApi)(uint32_t Level, const char* FunctionName, const char* Format, ...);
typedef NTSTATUS(*tSetCallbackApi)(const char* syscallName, BOOLEAN isEntry, ULONG64 probeId);
typedef NTSTATUS(*tUnSetCallbackApi)(const char* syscallName, BOOLEAN isEntry);
typedef NTSTATUS(*tSetEtwCallbackApi)(GUID providerGuid);
typedef NTSTATUS(*tUnSetEtwCallbackApi)();
typedef PVOID(NTAPI* tMmGetSystemRoutineAddress)(PUNICODE_STRING SystemRoutineName);
typedef BOOLEAN(*tTraceAccessMemory)(PVOID SafeAddress, ULONG_PTR UnsafeAddress, SIZE_T NumberOfBytes, SIZE_T ChunkSize, BOOLEAN DoRead);

class PluginApis {
public:
PluginApis() = default;

tLogPrintApi pLogPrint;
tSetCallbackApi pSetCallback;
tUnSetCallbackApi pUnsetCallback;
tSetEtwCallbackApi pEtwSetCallback;
tUnSetEtwCallbackApi pEtwUnSetCallback;
tMmGetSystemRoutineAddress pGetSystemRoutineAddress;
tTraceAccessMemory pTraceAccessMemory;
};

#define MINCHAR 0x80 // winnt
#define MAXCHAR 0x7f // winnt
#define MINSHORT 0x8000 // winnt
#define MAXSHORT 0x7fff // winnt
#define MINLONG 0x80000000 // winnt
#define MAXLONG 0x7fffffff // winnt
#define MAXUCHAR 0xff // winnt
#define MAXUSHORT 0xffff // winnt
#define MAXULONG 0xffffffff // winnt

UNICODE_STRING WideToUnicodeString(PCWSTR SourceString);

template<typename T>
T ResolveApi(const wchar_t* name, PluginApis& apis) {
auto ustr = WideToUnicodeString(name);
return (T)apis.pGetSystemRoutineAddress(&ustr);
}

typedef void(*tStpInitialize)(PluginApis& pApis);
typedef void(*tStpDeInitialize)();
typedef void(*tDtEtwpEventCallback)(EVENT_HEADER* EventHeader, ULONG32 a, GUID* ProviderGuid, ULONG32 b);

typedef enum _LOG_LEVEL_OPTIONS
{
LogLevelDebug = 0x10ul,
LogLevelInfo = 0x20ul,
LogLevelWarn = 0x40ul,
LogLevelError = 0x80ul,
} LOG_LEVEL_OPTIONS;

// Assert a function is the same type as a function pointer typedef, or throw msg as a compiler error
#define ASSERT_INTERFACE_IMPLEMENTED(Implementer, tFnTypeDef, msg) static_assert(std::is_same_v<decltype(&Implementer), tFnTypeDef>, msg);
Loading

0 comments on commit 0a1d3cc

Please sign in to comment.