PTCHAR out,

DWORD size,

ULONG64 value

)

{

if (out == NULL) {

return FALSE;

}

_stprintf_s( out, size, _T( "" PRINTF_ULONG64_FS ), value );

return TRUE;

PTCHAR out,

DWORD size,

ULONG64 logonId

)

{

if (out == NULL) {

return FALSE;

}

#if defined _WIN64 || defined _WIN32

_stprintf_s( out, size, _T("0x%I64x"), logonId );

#elif defined __linux__

// On Linux, the low part of the LUID is the Linux logon Id

_stprintf_s( out, size, "%ld", logonId & 0xffff );

#endif

return TRUE;

_In_ PLARGE_INTEGER timestamp,

_In_ ULONGLONG ProcessStartKey,

OBJECT_TYPE type

)

{

GUID result = {0,};

DWORD seconds = 0;

PBYTE pResult = (PBYTE)&result;

#if defined _WIN64 || defined _WIN32

RtlTimeToSecondsSince1970( timestamp, &seconds );

#elif defined __linux__

// timestamp in 100ns intervals since epoch

seconds = LargeTimeToSeconds( timestamp );

#endif

*(DWORD*) pResult = machineId;

pResult += sizeof(DWORD);

*(DWORD*) pResult = seconds;

pResult += sizeof(DWORD);

*(DWORD64*) pResult = ProcessStartKey;

return result;

_In_ DWORD ProcessId,

_In_ const PLARGE_INTEGER time,

_In_opt_ PVOID ProcessObject

)

{

PPROCESS_CACHE_INFORMATION ret = NULL;

LockCache();

//

// search for process ID in unordered map

//

auto processEntry = _processCache.find( ProcessId );

if( processEntry != _processCache.end() ) {

//

// iterate over list items for this process ID

//

for( auto &current : processEntry->second ) {

// #444 If a process object was provided, check for a match against this in addition to the PID

if( (ProcessObject == NULL) ||

(current.data->m_ProcessObject == NULL) ||

(current.data->m_ProcessObject == ProcessObject) ) {

if( time != NULL ) {

//

// If I didn't select the entry or the time of the event was

// before the process was removed

//

if( ret == NULL ) {

//

// Only if time makes sense, else we will select a wrong old entry

// and the latest will be skipped

//

if( (current.removedTime.QuadPart == 0 || // If the current entry is still open

(ULONG64)time->QuadPart < (ULONG64)(current.removedTime.QuadPart + NT_500_MS)) && // Or it has now terminated but terminated after the process creation time

// the half second buffer is because we have seen network events appear marginally later than the process terminate event

(time->QuadPart >= current.data->m_CreateTime.QuadPart) ) { // #444. We validate the end of the time window but not the start..

ret = &current;

}

} else if( current.removedTime.QuadPart != 0 && // The process has terminadumpted

(ULONG64)time->QuadPart < (ULONG64)current.removedTime.QuadPart && // The process terminated after our process creation time

time->QuadPart >= current.data->m_CreateTime.QuadPart && // #444 Validate the start of the time window too

(ret->removedTime.QuadPart == 0 || // we are either superseding a candidate that is still open

(ULONG64)ret->removedTime.QuadPart > ( ULONG64 )current.removedTime.QuadPart) ) { // or we are superseding a process with a wider windows than the current candidate

ret = &current;

}

} else {

//

// Select the latest available;

//

if( ret == NULL ) {

ret = &current;

} else if( (current.removedTime.QuadPart == 0) ||

((ret->removedTime.QuadPart != 0) &&

((ULONG64)ret->removedTime.QuadPart < (ULONG64)current.removedTime.QuadPart)) ) {

ret = &current;

}

break;

}

}

}

}

UnlockCache();

return ret;

{

LockCache();

//

// for every entry in the cache (removing after each iteration)

//

for( auto cacheEntry = _processCache.begin(); cacheEntry != _processCache.end(); cacheEntry = _processCache.erase( cacheEntry ) ) {

//

// iterate over list items for this process ID

//

for( auto &current : cacheEntry->second ) {

free( current.data );

}

}

UnlockCache();

_In_ DWORD ProcessId,

_In_ GUID* ProcessGuid,

_In_opt_ PLARGE_INTEGER EventTime

)

{

LARGE_INTEGER currentTime;

if( EventTime == NULL ) {

GetSystemTimeAsLargeInteger( &currentTime );

EventTime = &currentTime;

}

LockCache();

//

// search for process ID in unordered map

//

auto processEntry = _processCache.find( ProcessId );

if( processEntry != _processCache.end() ) {

//

// iterate over list items for this process ID

//

for( auto &current : processEntry->second) {

//

// Mark the entry as removed, but keep it around in case

// we get delayed ETW events that reference it

//

current.removedTime.QuadPart = EventTime->QuadPart;

}

_expiringProcesses.emplace( EventTime->QuadPart, ProcessId );

}

PurgeExpired( EventTime );

UnlockCache();

{

while( !_expiringProcesses.empty() && Expired( _expiringProcesses.top().time, EventTime->QuadPart ) ) {

CacheEntryToExpire oldest = _expiringProcesses.top();

_expiringProcesses.pop();

auto processes = _processCache.find( oldest.pid );

if( processes != _processCache.end() ) {

for( auto &process : processes->second ) {

free( process.data );

}

_processCache.erase( oldest.pid );

}

}

_In_ GUID uniqueProcessGUID,

_In_ PSYSMON_EVENT_HEADER event

)

{

PROCESS_CACHE_INFORMATION cacheEntry;

PSYSMON_PROCESS_CREATE data;

SIZE_T dataSize;

data = &event->m_EventBody.m_ProcessCreateEvent;

dataSize = event->m_EventSize - offsetof( SYSMON_EVENT_HEADER, m_EventBody );

cacheEntry.data = static_cast<PSYSMON_PROCESS_CREATE>( malloc( dataSize ) );

if( cacheEntry.data != NULL ) {

LockCache();

memcpy( cacheEntry.data, data, dataSize );

cacheEntry.uniqueProcessGUID = uniqueProcessGUID;

cacheEntry.removedTime.QuadPart = 0;

cacheEntry.dnsQueryCache = {};

ProcessRemove( data->m_ProcessId, &uniqueProcessGUID, NULL );

auto processEntry = _processCache.find( data->m_ProcessId );

if( processEntry == _processCache.end() ) {

_processCache.emplace( data->m_ProcessId, CacheEntries{ cacheEntry } );

} else {

processEntry->second.push_front( cacheEntry );

}

UnlockCache();

}

{

LockCache();

bool ret = _processCache.empty();

UnlockCache();

return ret;

{

LockCache();

auto processInfo = ProcessGet( ProcessId, NULL, NULL );

if( processInfo != NULL ) {

for( auto &cachedQuery : processInfo->dnsQueryCache) {

if( !_tcsicmp( cachedQuery.QueryName, DnsEntry->QueryName ) &&

!_tcsicmp( cachedQuery.QueryResult, DnsEntry->QueryResult ) &&

!_tcsicmp( cachedQuery.QueryStatus, DnsEntry->QueryStatus ) ) {

UnlockCache();

return false;

}

}

//

// Add to the cache

//

if( processInfo->dnsQueryCache.size() == DNS_CACHE_LIMIT ) {

processInfo->dnsQueryCache.pop_back();

}

// Performing a copy here, just in case.

processInfo->dnsQueryCache.push_front( *DnsEntry );

}

UnlockCache();

return true;

_In_ PEVENT_DATA_DESCRIPTOR Data,

_In_ const TCHAR* String

)

{

if( String == NULL ) {

String = _T("NULL");

}

EventDataDescCreate( Data, (PVOID)String, (ULONG)((_tcslen(String) + 1) * sizeof(TCHAR)) );

_In_ GUID* pguid,

_In_ PSYSMON_EVENT_HEADER event,

_In_ BOOLEAN Cache

)

{

GUID g;

PSYSMON_PROCESS_CREATE data;

data = &event->m_EventBody.m_ProcessCreateEvent;

g = GenerateUniqueId( &data->m_CreateTime, data->m_ProcessKey, Process );

// Update the cache

if( Cache ) {

ProcessCache::Instance().ProcessAdd( g, event );

}

*pguid = g;

_Out_ GUID* pguid,

_In_ ULONG ProcessId,

_In_ BOOLEAN UpdateCache,

_In_ PLARGE_INTEGER time

)

{

PPROCESS_CACHE_INFORMATION cache;

UCHAR buffer[16386];

BOOL result;

PSYSMON_EVENT_HEADER event;

ProcessCache::Instance().LockCache();

cache = ProcessCache::Instance().ProcessGet( ProcessId, time, NULL );

if( cache ) {

*pguid = cache->uniqueProcessGUID;

ProcessCache::Instance().UnlockCache();

} else {

ProcessCache::Instance().UnlockCache();

#if defined _WIN64 || defined _WIN32

DWORD bytesReturned = 1;

UPDATE_CACHE cacheRequest;

cacheRequest.ProcessId = ProcessId;

cacheRequest.UpdateCache = UpdateCache;

result = DeviceIoControl( g_hDriver, IOCTL_SYSMON_PROCESS_CACHE, &cacheRequest, sizeof(cacheRequest),

buffer, sizeof(buffer), &bytesReturned, NULL );

if( result ) {

D_ASSERT(bytesReturned > 0);

event = (PSYSMON_EVENT_HEADER) buffer;

GenerateUniquePGUID( pguid, event, UpdateCache );

} else {

DBG_MODE( _tprintf( _T("PROCESS_CACHE_REQUEST failed with %d\n"), GetLastError() ) );

}

#elif defined __linux__

result = GetProcess( (PSYSMON_EVENT_HEADER) buffer, sizeof(buffer), ProcessId );

if( result ) {

event = (PSYSMON_EVENT_HEADER) buffer;

GenerateUniquePGUID( pguid, event, UpdateCache );

} else {

DBG_MODE( _tprintf( _T("PROCESS_CACHE_REQUEST failed\n") ) );

}

#endif

}

_In_ GUID* sguid,

_In_ LUID* authenticationId

)

{

GUID g;

LARGE_INTEGER timestamp = {0,};

#if defined _WIN64 || defined _WIN32

NTSTATUS status;

PSECURITY_LOGON_SESSION_DATA sessionData;

status = LsaGetLogonSessionData( authenticationId, &sessionData );

if (NT_SUCCESS(status))

{

timestamp = sessionData->LogonTime;

LsaFreeReturnBuffer( sessionData );

}

#elif defined __linux__

timestamp = GetLogonTime( authenticationId );

#endif

g = GenerateUniqueId( &timestamp, * (PULONGLONG) authenticationId, Session );

*sguid = g;

VOID

)

{

PDWORD processList = NULL;

GUID tmp;

DWORD i;

// 16384 entries should be large enough for most systems, but still only uses

// 64KB of RAM.

DWORD processSize = 16384 * sizeof( DWORD );

DWORD processUsed = 0;

for( i = 0; i < 5; i++ ) {

processList = (PDWORD)malloc( processSize );

if( processList == NULL ) {

PrintErrorEx( (PTCHAR)_T( __FUNCTION__ ), 0, (PTCHAR)_T( "Out of memory condition" ) );

return;

}

// Check that EnumProcesses succeeds AND that we have all the processes available

// If EnumProcesses fails, for simplicity handle it in the same way as if the buffer

// is too small. The extra memory usage is inconsequential - total memory usage would

// reach 128KB if it fails 5 times in a row.

if( EnumProcesses( processList, processSize, &processUsed ) && processUsed < processSize ) {

break;

}

// If 16K entries is too small, we need to jump a reasonable amount to ensure

// we find a suitable size before the loop expires.

processSize += 4096 * sizeof( DWORD );

free( processList );

processList = NULL;

}

if( processList == NULL ) {

PrintErrorEx( (PTCHAR)_T( __FUNCTION__ ), 0, (PTCHAR)_T( "Failed to udpate the process cache on start" ) );

return;

}

//

// Fetch each process GUID to update the cache

//

for( i = 0; i < (processUsed / sizeof( DWORD )); i++ ) {

FetchUniquePGUID( &tmp, processList[i], TRUE, NULL );

}

free( processList );

_Out_ PTCHAR buffer,

_In_ SIZE_T bufferCount,

_In_ PLARGE_INTEGER timestamp

)

{

#if defined _WIN64 || defined _WIN32

SYSTEMTIME timeFields;

FILETIME fileTime;

fileTime.dwLowDateTime = timestamp->LowPart;

fileTime.dwHighDateTime = (DWORD)timestamp->HighPart;

if( FileTimeToSystemTime( &fileTime, &timeFields ) ) {

_stprintf_s( buffer, bufferCount, _T("%04u-%02u-%02u %02u:%02u:%02u.%03u"),

timeFields.wYear, timeFields.wMonth, timeFields.wDay,

timeFields.wHour, timeFields.wMinute, timeFields.wSecond, timeFields.wMilliseconds );

} else {

_stprintf_s( buffer, bufferCount, _T("Incorrect filetime: 0x%I64x"),

timestamp->QuadPart );

}

#elif defined __linux__

// time in 100ns intervals since epoch

struct tm timeFields;

time_t fileTime = 0;

// timestamp in 100ns intervals since epoch

fileTime = LargeTimeToSeconds( timestamp );

if ( gmtime_r(&fileTime, &timeFields) ) {

snprintf( buffer, bufferCount, "%04u-%02u-%02u %02u:%02u:%02u.%03u",

timeFields.tm_year + 1900, timeFields.tm_mon + 1, timeFields.tm_mday,

timeFields.tm_hour, timeFields.tm_min, timeFields.tm_sec,

LargeTimeMilliseconds( timestamp ));

} else {

_stprintf_s( buffer, bufferCount, _T("Incorrect filetime: 0x%" PRIx64),

timestamp->QuadPart );

}

#endif

_In_ PULONG extensionsSizes,

_In_ PVOID extensions,

_In_ ULONG index,

_Out_ PULONG retSize

)

{

ULONG i, size;

PBYTE ptr = (PBYTE) extensions;

size = extensionsSizes[index];

if( retSize ) {

*retSize = size;

}

if( size == 0 ) {

return NULL;

}

for( i = 0; i < index; i++ ) {

ptr += extensionsSizes[i];

}

return ptr;

_In_ PULONG extensionsSizes,

_In_ PVOID extensions,

_In_ ULONG index

)

{

ULONG size, i, escapes = 0;

PVOID ptr;

PTCHAR str, strPtr;

ptr = ExtGetPtr( extensionsSizes, extensions, index, &size );

if( ptr == NULL || size < sizeof( TCHAR ) ) {

return NULL;

}

if( (size % sizeof( TCHAR )) != 0 ) {

size--;

}

// Count % characters

for (i = 0; i < size / sizeof(TCHAR); i++) {

if( ((PTCHAR) ptr)[i] == '%' )

escapes++;

}

str = strPtr = (PTCHAR) malloc( size + (escapes * sizeof( TCHAR )) + sizeof( TCHAR ) );

if( str != NULL ) {

size /= sizeof( TCHAR );

for( i = 0; i < size; i++ ) {

*strPtr = ((PTCHAR) ptr)[i];

strPtr++;

if( ((PTCHAR) ptr)[i] == '%' ) {

*strPtr = '%';

strPtr++;

}

}

*strPtr = 0;

}

return str;

_In_ PULONG extensionsSizes,

_In_ PVOID extensions,

_In_ ULONG index,

_In_ PULONG size

)

{

ULONG origSize;

PVOID ptr;

PWCHAR str;

ptr = ExtGetPtr( extensionsSizes, extensions, index, &origSize );

if( ptr == NULL || origSize < sizeof( TCHAR ) ) {

return NULL;

}

#if defined _WIN64 || defined _WIN32

*size = MultiByteToWideChar( CP_ACP, MB_PRECOMPOSED, (LPCSTR) ptr, origSize, NULL, 0 );

#elif defined __linux__

*size = UTF8toUTF16( NULL, (LPCSTR) ptr, 0 );

#endif

if( *size == 0 ) {

return NULL;

}

*size = *size * sizeof( WCHAR );

str = (PWCHAR)malloc( *size );

if( str != NULL ) {

#if defined _WIN64 || defined _WIN32

MultiByteToWideChar( CP_ACP, MB_PRECOMPOSED, (LPCSTR)ptr, origSize, str, *size );

#elif defined __linux__

UTF8toUTF16( str, (LPCSTR)ptr, *size );

#endif

}

return str;

_In_ PULONG extensionsSizes,

_In_ PVOID extensions,

_In_ ULONG index

)

{

ULONG size;

PVOID ptr;

PTCHAR str;

ptr = ExtGetPtr( extensionsSizes, extensions, index, &size );

if( ptr == NULL || size < sizeof(TCHAR) ) {

return NULL;

}

if( (size % sizeof(TCHAR)) != 0 ) {

size--;

}

str = (PTCHAR) malloc( size + sizeof(TCHAR) );

if( str != NULL ) {

size /= sizeof(TCHAR);

_tcsncpy( str, (PTCHAR) ptr, size );

str[size] = 0;

}

return str;

_In_ PVOID ptr,

_In_ ULONG size

)

{

if( size == 0 ) {

return FALSE;

}

PTCHAR str = (PTCHAR)ptr;

size /= sizeof(TCHAR);

return ( str[size-1] == 0 );

_In_ PTCHAR input,

_In_ ULONG sizeInByte

)

{

PTCHAR str;

if( input == NULL || sizeInByte < sizeof(TCHAR) ) {

return NULL;

}

if( (sizeInByte % sizeof(TCHAR)) != 0 ) {

sizeInByte--;

}

if( IsNullTerminated( input, sizeInByte ) ) {

return _tcsdup( input );

}

str = (PTCHAR) malloc( sizeInByte + sizeof(TCHAR) );

if( str == NULL ) {

return NULL;

}

ZeroMemory( str, sizeInByte + sizeof(TCHAR) );

_tcsncpy( str, input, sizeInByte / sizeof(TCHAR) );

return str;

_In_ PTCHAR Input,

_In_ ULONG SizeInBytes,

_In_ ULONG Offset,

_In_ ULONG SubCch,

_In_ PTCHAR Replacement

)

{

ULONG newSize, replaceSize, sizeCch;

PTCHAR str, pos;

if( Input == NULL || SizeInBytes < sizeof(TCHAR) ) {

return NULL;

}

sizeCch = SizeInBytes / sizeof(TCHAR);

if( sizeCch <= Offset || sizeCch < (Offset + SubCch) ) {

return NULL;

}

replaceSize = (ULONG)_tcslen( Replacement );

newSize = sizeCch + replaceSize - SubCch;

//

// Need a null char?

//

if( sizeCch < 2 || Input[sizeCch-1] != 0 ) {

newSize++;