forked from Velocidex/velociraptor
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Changed watch_etw to support multiple providers under a single session. Should address issue Velocidex#2944 . --------- Co-authored-by: Mike Cohen <mike@velocidex.com>
- Loading branch information
Showing
10 changed files
with
685 additions
and
179 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| Parameters: | ||
| GUID1: "{70eb4f03-c1de-4f73-a051-33d13d5413bd}" | ||
| GUID2: '{A669021C-C450-4609-A035-5AF59AF4DF18}' | ||
|
|
||
| Queries: | ||
| - LET SessionExists = SELECT Stdout =~ "VeloTest2" | ||
| FROM execve(argv=["logman", "query", "-ets"]) | ||
|
|
||
| # Check that two queries for the same provider apply 2 watchers. | ||
| - SELECT ProviderGUID, { | ||
| SELECT * FROM profile(type="ETW") | ||
| WHERE SessionName =~ "VeloTest2" | ||
| } AS Profile, SessionExists[0] | ||
| FROM chain(async=TRUE, | ||
| a={ | ||
| SELECT * FROM watch_etw(guid=GUID1, name="VeloTest2", timeout=5) | ||
| }, b={ | ||
| SELECT * FROM watch_etw(guid=GUID1, name="VeloTest2", timeout=5) | ||
| }) | ||
| WHERE Profile.Watchers = 2 | ||
| LIMIT 1 | ||
|
|
||
| - SELECT sleep(time=1) FROM scope() | ||
|
|
||
| # Now Check that session is removed. | ||
| - SELECT * FROM profile(type="ETW") WHERE SessionName =~ "VeloTest2" | ||
|
|
||
| # Now Check two queries to different proviers | ||
| - SELECT { | ||
| SELECT * FROM profile(type="ETW") | ||
| WHERE SessionName =~ "VeloTest2" | ||
| ORDER BY GUID | ||
| } AS Profile, SessionExists[0] | ||
| FROM chain(async=TRUE, | ||
| a={ | ||
| SELECT * FROM watch_etw(guid=GUID1, name="VeloTest2", timeout=5) | ||
| }, b={ | ||
| SELECT * FROM watch_etw(guid=GUID2, name="VeloTest2", timeout=5) | ||
| }) | ||
| LIMIT 1 | ||
|
|
||
| # Check that GUID1 is removed when no one is interested any more | ||
| - SELECT { | ||
| SELECT * FROM profile(type="ETW") | ||
| WHERE SessionName =~ "VeloTest2" | ||
| } AS Profile, SessionExists[0] | ||
| FROM chain(async=TRUE, | ||
| a={ | ||
| SELECT * FROM watch_etw(guid=GUID2, name="VeloTest2", timeout=5) | ||
| }, b={ | ||
| SELECT * FROM watch_etw(guid=GUID2, name="VeloTest2", timeout=5) | ||
| }) | ||
| LIMIT 1 | ||
|
|
||
| - SELECT sleep(time=1) FROM scope() | ||
|
|
||
| # Now make sure that the session is actually removed when there are | ||
| # no interested parties. | ||
| - SELECT * FROM SessionExists |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| LET SessionExists = SELECT Stdout =~ "VeloTest2" FROM execve(argv=["logman", "query", "-ets"])[]SELECT ProviderGUID, { SELECT * FROM profile(type="ETW") WHERE SessionName =~ "VeloTest2" } AS Profile, SessionExists[0] FROM chain(async=TRUE, a={ SELECT * FROM watch_etw(guid=GUID1, name="VeloTest2", timeout=5) }, b={ SELECT * FROM watch_etw(guid=GUID1, name="VeloTest2", timeout=5) }) WHERE Profile.Watchers = 2 LIMIT 1[ | ||
| { | ||
| "ProviderGUID": "{70EB4F03-C1DE-4F73-A051-33D13D5413BD}", | ||
| "Profile": { | ||
| "SessionName": "VeloTest2", | ||
| "GUID": "{70EB4F03-C1DE-4F73-A051-33D13D5413BD}", | ||
| "Watchers": 2 | ||
| }, | ||
| "SessionExists[0]": { | ||
| "Stdout =~ \"VeloTest2\"": true | ||
| } | ||
| } | ||
| ]SELECT sleep(time=1) FROM scope()[ | ||
| { | ||
| "sleep(time=1)": true | ||
| } | ||
| ]SELECT * FROM profile(type="ETW") WHERE SessionName =~ "VeloTest2"[]SELECT { SELECT * FROM profile(type="ETW") WHERE SessionName =~ "VeloTest2" ORDER BY GUID } AS Profile, SessionExists[0] FROM chain(async=TRUE, a={ SELECT * FROM watch_etw(guid=GUID1, name="VeloTest2", timeout=5) }, b={ SELECT * FROM watch_etw(guid=GUID2, name="VeloTest2", timeout=5) }) LIMIT 1[ | ||
| { | ||
| "Profile": [ | ||
| { | ||
| "SessionName": "VeloTest2", | ||
| "GUID": "{70EB4F03-C1DE-4F73-A051-33D13D5413BD}", | ||
| "Watchers": 1 | ||
| }, | ||
| { | ||
| "SessionName": "VeloTest2", | ||
| "GUID": "{A669021C-C450-4609-A035-5AF59AF4DF18}", | ||
| "Watchers": 1 | ||
| } | ||
| ], | ||
| "SessionExists[0]": { | ||
| "Stdout =~ \"VeloTest2\"": true | ||
| } | ||
| } | ||
| ]SELECT { SELECT * FROM profile(type="ETW") WHERE SessionName =~ "VeloTest2" } AS Profile, SessionExists[0] FROM chain(async=TRUE, a={ SELECT * FROM watch_etw(guid=GUID2, name="VeloTest2", timeout=5) }, b={ SELECT * FROM watch_etw(guid=GUID2, name="VeloTest2", timeout=5) }) LIMIT 1[ | ||
| { | ||
| "Profile": { | ||
| "SessionName": "VeloTest2", | ||
| "GUID": "{A669021C-C450-4609-A035-5AF59AF4DF18}", | ||
| "Watchers": 2 | ||
| }, | ||
| "SessionExists[0]": { | ||
| "Stdout =~ \"VeloTest2\"": true | ||
| } | ||
| } | ||
| ]SELECT sleep(time=1) FROM scope()[ | ||
| { | ||
| "sleep(time=1)": true | ||
| } | ||
| ]SELECT * FROM SessionExists[ | ||
| { | ||
| "Stdout =~ \"VeloTest2\"": false | ||
| } | ||
| ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.