def __read_process(self, stream):
process_index = read_u32(stream)
pid = read_u32(stream)
parent_pid = read_u32(stream)
stream.seek(4, 1) # Unknown field
authentication_id = read_u64(stream)
session = read_u32(stream)
stream.seek(4, 1) # Unknown field
start_time = read_filetime(stream)
end_time = read_filetime(stream)
virtualized = read_u32(stream)
is_process_64bit = read_u32(stream)
integrity = self._strings_table[read_u32(stream)]
user = self._strings_table[read_u32(stream)]
process_name = self._strings_table[read_u32(stream)]
image_path = self._strings_table[read_u32(stream)]
command_line = self._strings_table[read_u32(stream)]
company = self._strings_table[read_u32(stream)]
version = self._strings_table[read_u32(stream)]
description = self._strings_table[read_u32(stream)]
_ = read_pvoid(stream, self._is_64bit) # Unknown field
_ = read_u64(stream) # Unknown field
number_of_modules = read_u32(stream)
modules = [self.__read_module(stream) for _ in range(number_of_modules)]
return process_index, Process(pid=pid, parent_pid=parent_pid, authentication_id=authentication_id,
session=session, virtualized=virtualized, is_process_64bit=is_process_64bit,
integrity=integrity, user=user, process_name=process_name, image_path=image_path,
command_line=command_line, company=company, version=version,
description=description, start_time=start_time, end_time=end_time,
modules=modules)
def get_filesystem_ioctl_details(io, metadata, event, details_io, extra_detail_io):
details_io.seek(0x8, 1)
write_length = read_u32(details_io)
read_length = read_u32(details_io)
if metadata.sizeof_pvoid == 8:
details_io.seek(4, 1) # Padding for 64 bit
details_io.seek(0x4, 1)
if metadata.sizeof_pvoid == 8:
details_io.seek(4, 1) # Padding for 64 bit
ioctl = read_u32(details_io)
event.details["Control"] = get_ioctl_name(ioctl)
if event.details["Control"] in ["FSCTL_OFFLOAD_READ", "FSCTL_GET_REPARSE_POINT", "FSCTL_READ_RAW_ENCRYPTED"]:
event.category = "Read"
elif event.details["Control"] in ["FSCTL_OFFLOAD_WRITE", "FSCTL_MOVE_FILE", "FSCTL_DELETE_REPARSE_POINT",
"FSCTL_WRITE_RAW_ENCRYPTED", "FSCTL_PIPE_TRANSCEIVE",
"FSCTL_PIPE_INTERNAL_TRANSCEIVE"]:
event.category = "Write"
elif event.details["Control"] in ["FSCTL_SET_COMPRESSION", "FSCTL_WRITE_PROPERTY_DATA", "FSCTL_SET_OBJECT_ID",
"FSCTL_DELETE_OBJECT_ID", "FSCTL_SET_REPARSE_POINT", "FSCTL_SET_SPARSE",
"FSCTL_SET_ENCRYPTION", "FSCTL_CREATE_USN_JOURNAL",
"FSCTL_WRITE_USN_CLOSE_RECORD", "FSCTL_EXTEND_VOLUME",
"FSCTL_DELETE_USN_JOURNAL"]:
event.category = "Write Metadata"
elif event.details["Control"] in ["FSCTL_QUERY_RETRIEVAL_POINTERS", "FSCTL_GET_COMPRESSION",
"FSCTL_QUERY_FAT_BPB", "FSCTL_QUERY_FAT_BPB",
"FSCTL_FILESYSTEM_GET_STATISTICS", "FSCTL_GET_NTFS_VOLUME_DATA",
"FSCTL_GET_NTFS_FILE_RECORD", "FSCTL_GET_VOLUME_BITMAP",
"FSCTL_GET_RETRIEVAL_POINTERS", "FSCTL_IS_VOLUME_DIRTY",
"FSCTL_READ_PROPERTY_DATA", "FSCTL_FIND_FILES_BY_SID", "FSCTL_GET_OBJECT_ID",
"FSCTL_READ_USN_JOURNAL", "FSCTL_SET_OBJECT_ID_EXTENDED",
"FSCTL_CREATE_OR_GET_OBJECT_ID", "FSCTL_READ_FILE_USN_DATA",
"FSCTL_QUERY_USN_JOURNAL"]:
event.category = "Read Metadata"
if event.operation == "FileSystemControl":
if event.details["Control"] == "FSCTL_PIPE_INTERNAL_WRITE":
event.details["Length"] = write_length
elif event.details["Control"] == "FSCTL_OFFLOAD_READ":
details_io.seek(0x8, 1)
event.details["Offset"] = read_s64(io)
event.details["Length"] = read_u64(io)
elif event.details["Control"] == "FSCTL_OFFLOAD_WRITE":
event.details["Offset"] = read_s64(io)
event.details["Length"] = read_u64(io)
elif event.details["Control"] == "FSCTL_PIPE_INTERNAL_READ":
event.details["Length"] = read_length
elif event.details["Control"] in ["FSCTL_PIPE_TRANSCEIVE", "FSCTL_PIPE_INTERNAL_TRANSCEIVE"]:
event.details["WriteLength"] = write_length
event.details["ReadLength"] = read_length
def __init__(self, io):
stream = BytesIO(io.read(self.SIZE))
self.signature = stream.read(4)
assert self.signature == b"PML_", "Wrong PML header"
self.version = read_u32(stream)
if self.version not in [9]:
raise NotImplementedError("Not supporting PML version {}".format(self.version))
self.is_64bit = read_u32(stream)
self.computer_name = read_utf16(stream, 0x20)
self.system_root = read_utf16(stream, 0x208)
self.number_of_events = read_u32(stream)
stream.seek(8, 1) # Unknown field
self.events_offset = read_u64(stream)
self.events_offsets_array_offset = read_u64(stream)
self.process_table_offset = read_u64(stream)
self.strings_table_offset = read_u64(stream)
self.unknown_table_offset = read_u64(stream)
stream.seek(12, 1) # Unknown fields
self.windows_major_number = read_u32(stream)
self.windows_minor_number = read_u32(stream)
self.windows_build_number = read_u32(stream)
self.windows_build_number_after_decimal_point = read_u32(stream)
self.service_pack_name = read_utf16(stream, 0x32)
stream.seek(0xd6, 1) # Unknown field
self.number_of_logical_processors = read_u32(stream)
self.ram_memory_size = read_u64(stream)
self.header_size = read_u64(stream)
self.hosts_and_ports_tables_offset = read_u64(stream)
def get_process_exit_details(io, metadata, event, extra_details_io):
event.details["Exit Status"] = read_u32(io)
kernel_time = read_duration(io)
user_time = read_duration(io)
working_set = read_u64(io)
peak_working_set = read_u64(io)
private_bytes = read_u64(io)
peak_private_bytes = read_u64(io)
event.details["User Time"] = user_time
event.details["Kernel Time"] = kernel_time
event.details["Private Bytes"] = private_bytes
event.details["Peak Private Bytes"] = peak_private_bytes
event.details["Working Set"] = working_set
event.details["Peak Working Set"] = peak_working_set
def __init__(self, io):
stream = BytesIO(io.read(self.SIZE))
self.signature = stream.read(4)
if self.signature != b"PML_":
raise PMLError(
"not a Process Monitor backing file (signature missing).")
self.version = read_u32(stream)
if self.version not in [9]:
raise NotImplementedError("Not supporting PML version {}".format(
self.version))
self.is_64bit = read_u32(stream)
self.computer_name = read_utf16(stream, 0x20)
self.system_root = read_utf16(stream, 0x208)
self.number_of_events = read_u32(stream)
stream.seek(8, 1) # Unknown field
self.events_offset = read_u64(stream)
self.events_offsets_array_offset = read_u64(stream)
self.process_table_offset = read_u64(stream)
self.strings_table_offset = read_u64(stream)
# currently not being parsed because I don't know how to show icons in python.
# Docs of this table's layout are in "docs\PML Format.md"
self.icon_table_offset = read_u64(stream)
stream.seek(12, 1) # Unknown fields
self.windows_major_number = read_u32(stream)
self.windows_minor_number = read_u32(stream)
self.windows_build_number = read_u32(stream)
self.windows_build_number_after_decimal_point = read_u32(stream)
self.service_pack_name = read_utf16(stream, 0x32)
stream.seek(0xd6, 1) # Unknown field
self.number_of_logical_processors = read_u32(stream)
self.ram_memory_size = read_u64(stream)
self.header_size = read_u64(stream)
self.hosts_and_ports_tables_offset = read_u64(stream)
if self.events_offset == 0 or self.events_offsets_array_offset == 0 or self.process_table_offset == 0 or self.strings_table_offset == 0 or self.icon_table_offset == 0:
raise PMLError(
"PML was not closed cleanly during capture and is corrupt.")
if self.header_size != self.SIZE or self.hosts_and_ports_tables_offset == 0:
raise PMLError("PML is corrupt and cannot be opened.")
def read_registry_data(io, reg_type_name, length=0):
"""Reads registry data (which is present in the Detail column in original Procmon) according to ``reg_type``
"""
if reg_type_name == RegistryTypes.REG_DWORD.name:
return read_u32(io)
elif reg_type_name == RegistryTypes.REG_QWORD.name:
return read_u64(io)
elif reg_type_name == RegistryTypes.REG_EXPAND_SZ.name or reg_type_name == RegistryTypes.REG_SZ.name:
return read_utf16(io)
elif reg_type_name == RegistryTypes.REG_BINARY.name:
# Assuming the stream ends at the end of the extra detail, so just read everything
return io.read(length)
elif reg_type_name == RegistryTypes.REG_MULTI_SZ.name:
return read_utf16_multisz(io, length)
return ''
def get_filesystem_query_directory_details(io, metadata, event, details_io, extra_detail_io):
event.category = "Read Metadata"
directory_name_info = read_detail_string_info(io)
directory_name = read_detail_string(io, directory_name_info)
if directory_name:
event.path = event.path + directory_name if event.path[-1] == "\\" else event.path + "\\" + directory_name
event.details['Filter'] = directory_name
details_io.seek(0x10, 1)
if metadata.sizeof_pvoid == 8:
details_io.seek(4, 1) # Padding for 64 bit
details_io.seek(0x4, 1)
if metadata.sizeof_pvoid == 8:
details_io.seek(4, 1) # Padding for 64 bit
file_information_class = FileInformationClass(read_u32(details_io))
event.details["FileInformationClass"] = file_information_class.name
if extra_detail_io and file_information_class in [FileInformationClass.FileDirectoryInformation,
FileInformationClass.FileFullDirectoryInformation,
FileInformationClass.FileBothDirectoryInformation,
FileInformationClass.FileNamesInformation,
FileInformationClass.FileIdBothDirectoryInformation,
FileInformationClass.FileIdFullDirectoryInformation]:
extra_detail_length = len(extra_detail_io.getvalue())
next_entry_offset = -1 # hack so the first iteration won't exit
current_entry_offset = 1
i = 0 if directory_name else -1
while True:
i += 1
if next_entry_offset == 0 or (current_entry_offset + next_entry_offset) > extra_detail_length:
break # No more structures
extra_detail_io.seek(current_entry_offset + next_entry_offset, 0)
current_entry_offset = extra_detail_io.tell()
next_entry_offset = read_u32(extra_detail_io)
file_index = read_u32(extra_detail_io)
if file_information_class == FileInformationClass.FileNamesInformation:
# FILE_NAMES_INFORMATION structure
file_name_length = read_u32(extra_detail_io)
event.details[str(i)] = read_utf16(extra_detail_io, file_name_length)
continue
creation_time = read_filetime(extra_detail_io)
last_access_time = read_filetime(extra_detail_io)
last_write_time = read_filetime(extra_detail_io)
change_time = read_filetime(extra_detail_io)
end_of_file = read_u64(extra_detail_io)
allocation_size = read_u64(extra_detail_io)
file_attributes = read_u32(extra_detail_io)
file_name_length = read_u32(extra_detail_io)
if file_information_class == FileInformationClass.FileDirectoryInformation:
# FILE_DIRECTORY_INFORMATION structure
event.details[str(i)] = read_utf16(extra_detail_io, file_name_length)
continue
ea_size = read_u32(extra_detail_io)
if file_information_class == FileInformationClass.FileFullDirectoryInformation:
# FILE_FULL_DIR_INFORMATION structure
event.details[str(i)] = read_utf16(extra_detail_io, file_name_length)
continue
if file_information_class == FileInformationClass.FileIdFullDirectoryInformation:
# FILE_ID_FULL_DIR_INFORMATION structure
file_id = read_u64(extra_detail_io)
event.details[str(i)] = read_utf16(extra_detail_io, file_name_length)
continue
short_name_length = read_u8(extra_detail_io)
extra_detail_io.seek(1, 1) # Padding
short_name = extra_detail_io.read(12 * 2)
if file_information_class == FileInformationClass.FileBothDirectoryInformation:
# FILE_BOTH_DIR_INFORMATION structure
event.details[str(i)] = read_utf16(extra_detail_io, file_name_length)
continue
# FILE_ID_BOTH_DIR_INFORMATION structure
extra_detail_io.seek(2, 1) # Padding
file_id = read_u64(extra_detail_io)
event.details[str(i)] = read_utf16(extra_detail_io, file_name_length)
continue