OrcCommand: WolfLauncher: WolfTask: store process times

DFIR-ORC · Feb 10, 2021 · 589de7f · 589de7f
1 parent 606880f
commit 589de7f
Show file tree

Hide file tree

Showing 2 changed files with 50 additions and 1 deletion.
diff --git a/src/OrcCommand/Command/WolfLauncher/WolfTask.cpp b/src/OrcCommand/Command/WolfLauncher/WolfTask.cpp
@@ -14,6 +14,21 @@
 using namespace Orc;
 using namespace Orc::Command::Wolf;
 
+namespace {
+
+std::chrono::microseconds ConvertExecutionTime(const FILETIME& ft)
+{
+    ULARGE_INTEGER ull;
+    ull.LowPart = ft.dwLowDateTime;
+    ull.HighPart = ft.dwHighDateTime;
+
+    // See section REMARKS:
+    // https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getprocesstimes
+    return std::chrono::microseconds(ull.QuadPart / 10);
+}
+
+}  // namespace
+
 HRESULT WolfTask::ApplyNotification(
     const std::shared_ptr<CommandNotification>& notification,
     std::vector<std::shared_ptr<CommandMessage>>& actions)
@@ -33,7 +48,7 @@ HRESULT WolfTask::ApplyNotification(
             m_status = Running;
 
             break;
-        case CommandNotification::Terminated:
+        case CommandNotification::Terminated: {
             if (notification->GetExitCode() == 0)
             {
                 m_journal.Print(
@@ -54,7 +69,25 @@ HRESULT WolfTask::ApplyNotification(
 
             m_dwExitCode = notification->GetExitCode();
             m_status = Done;
+
+            auto processTimes = notification->GetProcessTimes();
+            if (processTimes)
+            {
+                m_userTime = ConvertExecutionTime(processTimes->UserTime);
+                m_kernelTime = ConvertExecutionTime(processTimes->KernelTime);
+                m_creationTime = processTimes->CreationTime;
+                m_exitTime = processTimes->ExitTime;
+            }
+            else
+            {
+                m_creationTime = m_startTime;
+
+                FILETIME now;
+                GetSystemTimeAsFileTime(&now);
+                m_exitTime = now;
+            }
             break;
+        }
         case CommandNotification::Canceled:
             m_status = Cancelled;
             break;

diff --git a/src/OrcCommand/Command/WolfLauncher/WolfTask.h b/src/OrcCommand/Command/WolfLauncher/WolfTask.h
@@ -42,11 +42,15 @@ class WolfTask
         , m_dwExitCode(-1)
         , m_dwLastReportedHang(30)
         , m_dwMostReportedHang(0)
+        , m_userTime()
+        , m_kernelTime()
         , m_status(Init)
     {
         ZeroMemory(&m_times, sizeof(PROCESS_TIMES));
         ZeroMemory(&m_lastActiveTime, sizeof(FILETIME));
         ZeroMemory(&m_startTime, sizeof(FILETIME));
+        ZeroMemory(&m_creationTime, sizeof(FILETIME));
+        ZeroMemory(&m_exitTime, sizeof(FILETIME));
     };
 
     const std::wstring& Command() const { return m_command; }
@@ -55,6 +59,12 @@ class WolfTask
     DWORD ExitCode() const { return m_dwExitCode; }
     const std::wstring& CommandLine() const { return m_commandLine; }
 
+    FILETIME CreationTime() const { return m_creationTime; }
+    FILETIME ExitTime() const { return m_exitTime; }
+
+    std::optional<std::chrono::microseconds> UserTime() const { return m_userTime; }
+    std::optional<std::chrono::microseconds> KernelTime() const { return m_kernelTime; }
+
     HRESULT ApplyNotification(
         const std::shared_ptr<CommandNotification>& notification,
         std::vector<std::shared_ptr<CommandMessage>>& actions);
@@ -75,6 +85,12 @@ class WolfTask
     FILETIME m_startTime;
     FILETIME m_lastActiveTime;
 
+    FILETIME m_creationTime;
+    FILETIME m_exitTime;
+
+    std::optional<std::chrono::microseconds> m_userTime;
+    std::optional<std::chrono::microseconds> m_kernelTime;
+
     Status m_status;
 
     PROCESS_TIMES m_times;