Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

filetracer refactor and update #1661

Merged
merged 1 commit into from
May 19, 2023
Merged

filetracer refactor and update #1661

merged 1 commit into from
May 19, 2023

Conversation

EscardosS
Copy link
Contributor

Hello I refactored filetracer again and add some new features:

  • All offsets can be extracted from one profile - ole32.json
  • NtOpenFile now gets file handle
  • Add some functions to get files creation/modification time (from _FILE_BASIC_INFO and etc) - it is useful in some cases
  • All time converted to unixtime - it is easier to correlate with time in filetracer events
  • "Status" now in hex - NTSTATUS Values are better

@drakvuf-jenkins
Copy link
Collaborator

Can one of the admins verify this patch?

@EscardosS
Copy link
Contributor Author

@tklengyel, can you please restart the checks if needed?
one of them failed due to "The requested URL returned error: 429"

@tklengyel
Copy link
Owner

@drakvuf-jenkins Test this please

@tklengyel tklengyel merged commit 79e4f72 into tklengyel:main May 19, 2023
@EscardosS EscardosS deleted the filetracer_upgrade branch May 27, 2023 21:38
@tklengyel tklengyel mentioned this pull request Jun 1, 2023
Closed
tklengyel added a commit that referenced this pull request Jun 2, 2023
@tklengyel
Partially revert PR #1661
f1be201
tklengyel added a commit that referenced this pull request Jun 4, 2023
@tklengyel
Partially revert PR #1661 (#1674)
d9bfe6a 
* Partially revert PR #1661

* Fixes

* Read _FILE_NETWORK_OPEN_INFORMATION from kernel profile

* FILE_RENAME_INFO is ole32 specific
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@EscardosS @drakvuf-jenkins @tklengyel