From b8a1aaab48430a0b66e18cc6bbf43df9483fdbf9 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Thu, 10 Sep 2026 18:29:26 +0200 Subject: [PATCH] cleanup(telemetry): Retire handle events Object manager telemetry has a big security value, but given the massive volume of events it produces, we never made use of it. As it is only creating a technical debt, we're getting rid of all handle processors, event types, decoders, and so on. --- cmd/fibratus/app/stats/stats.go | 4 +- configs/fibratus.yml | 4 - internal/etw/processors/chain_windows.go | 3 - internal/etw/processors/handle_windows.go | 96 ----------------- .../etw/processors/handle_windows_test.go | 102 ------------------ internal/etw/source_test.go | 3 - internal/etw/trace.go | 20 +--- pkg/cap/reader_windows.go | 8 -- pkg/cap/writer_windows_test.go | 1 - pkg/config/_fixtures/fibratus.yml | 2 - pkg/config/config.schema.json | 6 -- pkg/config/config_windows.go | 1 - pkg/config/eventsource.go | 4 - pkg/config/eventsource_test.go | 1 - pkg/config/filters.go | 3 - pkg/event/category.go | 7 +- pkg/event/event_windows.go | 24 ----- pkg/event/metainfo_windows.go | 9 -- pkg/event/param_decoder_windows.go | 33 ------ pkg/event/param_windows.go | 2 - pkg/event/params/params_windows.go | 11 -- pkg/event/types_windows.go | 61 +---------- pkg/filter/accessor.go | 6 -- pkg/filter/accessor_windows.go | 27 ----- pkg/filter/accessor_windows_test.go | 10 +- pkg/filter/fields/fields_windows.go | 15 --- pkg/filter/filter.go | 2 - pkg/filter/filter_test.go | 1 - pkg/filter/filter_windows.go | 3 - pkg/filter/ql/function.go | 1 - pkg/filter/valuer_test.go | 12 +-- pkg/handle/snapshotter.go | 54 +--------- pkg/handle/snapshotter_mock.go | 13 --- pkg/rules/compiler.go | 2 - pkg/rules/engine_test.go | 7 +- rules/macros/macros.yml | 6 -- 36 files changed, 25 insertions(+), 539 deletions(-) delete mode 100644 internal/etw/processors/handle_windows.go delete mode 100644 internal/etw/processors/handle_windows_test.go diff --git a/cmd/fibratus/app/stats/stats.go b/cmd/fibratus/app/stats/stats.go index 929775409..4232ee67a 100644 --- a/cmd/fibratus/app/stats/stats.go +++ b/cmd/fibratus/app/stats/stats.go @@ -20,10 +20,11 @@ package stats import ( "encoding/json" - "github.com/rabbitstack/fibratus/internal/bootstrap" "os" "reflect" + "github.com/rabbitstack/fibratus/internal/bootstrap" + "github.com/jedib0t/go-pretty/v6/table" "github.com/rabbitstack/fibratus/pkg/config" errs "github.com/rabbitstack/fibratus/pkg/errors" @@ -59,7 +60,6 @@ type Stats struct { FsFileObjectMisses int `json:"fs.file.object.misses"` FsFileReleases int `json:"fs.file.releases"` FsTotalRundownFiles int `json:"fs.total.rundown.files"` - HandleDeferredEvictions int `json:"handle.deferred.evictions"` HandleNameQueryFailures map[string]int `json:"handle.name.query.failures"` HandleSnapshotCount int `json:"handle.snapshot.count"` HandleSnapshotBytes int `json:"handle.snapshot.bytes"` diff --git a/configs/fibratus.yml b/configs/fibratus.yml index 63cc0225b..8cc8c3ee8 100644 --- a/configs/fibratus.yml +++ b/configs/fibratus.yml @@ -243,10 +243,6 @@ eventsource: # Determines whether module events are collected by Kernel Logger provider #enable-module: true - # Determines whether object manager events (handle creation/destruction) are - # collected by Kernel Logger provider - #enable-handle: false - # Determines whether memory manager events are collected by Kernel Logger provider #enable-mem: true diff --git a/internal/etw/processors/chain_windows.go b/internal/etw/processors/chain_windows.go index 5b8009c22..235e41dfc 100644 --- a/internal/etw/processors/chain_windows.go +++ b/internal/etw/processors/chain_windows.go @@ -59,9 +59,6 @@ func NewChain( if config.EventSource.EnableNetEvents { chain.addProcessor(newNetProcessor()) } - if config.EventSource.EnableHandleEvents { - chain.addProcessor(newHandleProcessor(hsnap, psnap)) - } if config.EventSource.EnableMemEvents { chain.addProcessor(newMemProcessor(psnap, vaRegionProber)) } diff --git a/internal/etw/processors/handle_windows.go b/internal/etw/processors/handle_windows.go deleted file mode 100644 index 0ce844897..000000000 --- a/internal/etw/processors/handle_windows.go +++ /dev/null @@ -1,96 +0,0 @@ -/* - * Copyright 2019-2020 by Nedim Sabic Sabic - * https://www.fibratus.io - * All Rights Reserved. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package processors - -import ( - "github.com/rabbitstack/fibratus/pkg/event" - "github.com/rabbitstack/fibratus/pkg/event/params" - "github.com/rabbitstack/fibratus/pkg/fs" - "github.com/rabbitstack/fibratus/pkg/handle" - "github.com/rabbitstack/fibratus/pkg/ps" - "github.com/rabbitstack/fibratus/pkg/util/key" -) - -type handleProcessor struct { - hsnap handle.Snapshotter - psnap ps.Snapshotter -} - -func newHandleProcessor( - hsnap handle.Snapshotter, - psnap ps.Snapshotter, -) Processor { - return &handleProcessor{ - hsnap: hsnap, - psnap: psnap, - } -} - -func (h *handleProcessor) ProcessEvent(e *event.Event) (*event.Event, bool, error) { - if e.Category == event.Handle { - evt, err := h.processEvent(e) - return evt, false, err - } - return e, true, nil -} - -func (h *handleProcessor) processEvent(e *event.Event) (*event.Event, error) { - if e.Type == event.DuplicateHandle { - // enrich event with process parameters - pid := e.Params.MustGetPid() - proc := h.psnap.FindAndPut(pid) - if proc != nil { - e.AppendParam(params.Exe, params.Path, proc.Exe) - e.AppendParam(params.ProcessName, params.AnsiString, proc.Name) - } - return e, nil - } - - name := e.GetParamAsString(params.HandleObjectName) - typ := e.GetParamAsString(params.HandleObjectTypeID) - - if name != "" { - switch typ { - case handle.Key: - rootKey, keyName := key.Format(name) - if rootKey == key.Invalid { - break - } - name = rootKey.String() - if keyName != "" { - name += "\\" + keyName - } - case handle.File: - name = fs.GetDevMapper().Convert(name) - } - // assign the formatted handle name - if err := e.Params.SetValue(params.HandleObjectName, name); err != nil { - return e, err - } - } - - if e.Type == event.CreateHandle { - return e, h.hsnap.Write(e) - } - - return e, h.hsnap.Remove(e) -} - -func (*handleProcessor) Name() ProcessorType { return Handle } -func (h *handleProcessor) Close() {} diff --git a/internal/etw/processors/handle_windows_test.go b/internal/etw/processors/handle_windows_test.go deleted file mode 100644 index 62fa5e50a..000000000 --- a/internal/etw/processors/handle_windows_test.go +++ /dev/null @@ -1,102 +0,0 @@ -/* - * Copyright 2019-2020 by Nedim Sabic Sabic - * https://www.fibratus.io - * All Rights Reserved. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package processors - -import ( - "testing" - - "github.com/rabbitstack/fibratus/pkg/event" - "github.com/rabbitstack/fibratus/pkg/event/params" - "github.com/rabbitstack/fibratus/pkg/handle" - "github.com/rabbitstack/fibratus/pkg/ps" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/mock" - "github.com/stretchr/testify/require" -) - -func TestHandleProcessor(t *testing.T) { - var tests = []struct { - name string - e *event.Event - hsnap func() *handle.SnapshotterMock - assertions func(*event.Event, *testing.T, *handle.SnapshotterMock) - }{ - { - "process create handle", - &event.Event{ - Type: event.CreateHandle, - Tid: 2484, - PID: 859, - Category: event.Handle, - Params: event.Params{ - params.HandleID: {Name: params.HandleID, Type: params.Uint32, Value: uint32(21)}, - params.HandleObjectTypeID: {Name: params.HandleObjectTypeID, Type: params.AnsiString, Value: "Key"}, - params.HandleObject: {Name: params.HandleObject, Type: params.Uint64, Value: uint64(18446692422059208560)}, - params.HandleObjectName: {Name: params.HandleObjectName, Type: params.UnicodeString, Value: ""}, - }, - Metadata: make(event.Metadata), - }, - func() *handle.SnapshotterMock { - hsnap := new(handle.SnapshotterMock) - hsnap.On("Write", mock.Anything).Return(nil) - return hsnap - }, - func(e *event.Event, t *testing.T, hsnap *handle.SnapshotterMock) { - hsnap.AssertNumberOfCalls(t, "Write", 1) - }, - }, - { - "process close handle", - &event.Event{ - Type: event.CloseHandle, - Tid: 2484, - PID: 859, - Category: event.Handle, - Params: event.Params{ - params.HandleID: {Name: params.HandleID, Type: params.Uint32, Value: uint32(21)}, - params.HandleObjectTypeID: {Name: params.HandleObjectTypeID, Type: params.AnsiString, Value: "Key"}, - params.HandleObject: {Name: params.HandleObject, Type: params.Uint64, Value: uint64(18446692422059208560)}, - params.HandleObjectName: {Name: params.HandleObjectName, Type: params.UnicodeString, Value: `\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b677c565-6ca5-45d3-b618-736b4e09b036}`}, - }, - Metadata: make(event.Metadata), - }, - func() *handle.SnapshotterMock { - hsnap := new(handle.SnapshotterMock) - hsnap.On("Remove", mock.Anything).Return(nil) - return hsnap - }, - func(e *event.Event, t *testing.T, hsnap *handle.SnapshotterMock) { - assert.Equal(t, `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b677c565-6ca5-45d3-b618-736b4e09b036}`, e.GetParamAsString(params.HandleObjectName)) - hsnap.AssertNumberOfCalls(t, "Remove", 1) - }, - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - hsnap := tt.hsnap() - psnap := new(ps.SnapshotterMock) - p := newHandleProcessor(hsnap, psnap) - var err error - tt.e, _, err = p.ProcessEvent(tt.e) - require.NoError(t, err) - tt.assertions(tt.e, t, hsnap) - }) - } -} diff --git a/internal/etw/source_test.go b/internal/etw/source_test.go index 8e481c4ec..8582d0479 100644 --- a/internal/etw/source_test.go +++ b/internal/etw/source_test.go @@ -112,7 +112,6 @@ func TestEventSourceStartTraces(t *testing.T) { EnableNetEvents: true, EnableFileIOEvents: true, EnableVAMapEvents: true, - EnableHandleEvents: true, EnableRegistryEvents: true, BufferSize: 1024, FlushTimer: time.Millisecond * 2300, @@ -141,7 +140,6 @@ func TestEventSourceStartTraces(t *testing.T) { require.NoError(t, err) // check enabled system event flags require.Equal(t, tt.wantFlags[0], flags[0]) - require.Equal(t, tt.wantFlags[1], flags[4]) } } }) @@ -1254,7 +1252,6 @@ func TestEvasionScanner(t *testing.T) { EnableNetEvents: true, EnableRegistryEvents: false, EnableMemEvents: false, - EnableHandleEvents: false, EnableDNSEvents: false, EnableAuditAPIEvents: true, StackEnrichment: true, diff --git a/internal/etw/trace.go b/internal/etw/trace.go index e127a97b9..e29fcf88f 100644 --- a/internal/etw/trace.go +++ b/internal/etw/trace.go @@ -348,38 +348,24 @@ func (t *KernelTrace) Start() error { handle := t.controlHandle - // poorly documented ETW feature that allows for enabling an extended set of - // kernel event tracing flags. According to the MSDN documentation, aside from - // invoking `EventTraceProperties` function to enable object manager tracking - // the `EventTraceProperties` structure's `EnableFlags` member needs to be set - // to PERF_OB_HANDLE (0x80000040). This actually results in an erroneous trace start. - // The documentation neither specifies how the function should be called, group mask - // array with its 4th element set to 0x80000040. - sysTraceFlags := make([]etw.EventTraceFlags, 8) // when we call `TraceSetInformation` with event empty group mask reserved for the // flags that are bitvectored into `EventTraceProperties` structure's `EnableFlags` field, // it will trigger the arrival of rundown events including open file objects and // registry keys that are very valuable for us to construct the initial snapshot of // these system resources and let us build the state machine + sysTraceFlags := make([]etw.EventTraceFlags, 8) if err := etw.SetTraceSystemFlags(handle, sysTraceFlags); err != nil { log.Warnf("unable to set empty system flags: %v", err) return nil } - sysTraceFlags[0] = flags - - // enable object manager tracking - if t.config.EventSource.EnableHandleEvents { - sysTraceFlags[4] = etw.Handle - } // enable stack enrichment if t.config.EventSource.StackEnrichment { if err := etw.EnableStackTracing(handle, t.stackExtensions.EventIds()); err != nil { return fmt.Errorf("fail to enable kernel callstack tracing: %v", err) } } - // call again to enable all kernel events. Just to recap. The first call to - // `TraceSetInformation` with empty group masks activates rundown events, - // while this second call enables the rest of the kernel events specified in flags. + // call again to enable all kernel events + sysTraceFlags[0] = flags return etw.SetTraceSystemFlags(handle, sysTraceFlags) } diff --git a/pkg/cap/reader_windows.go b/pkg/cap/reader_windows.go index 8d992bd0d..9907a8de3 100644 --- a/pkg/cap/reader_windows.go +++ b/pkg/cap/reader_windows.go @@ -204,14 +204,6 @@ func (r *reader) updateSnapshotters(evt *event.Event) error { if err := r.psnapshotter.WriteFromCapture(evt); err != nil { return err } - case event.CreateHandle: - if err := r.hsnapshotter.Write(evt); err != nil { - return err - } - case event.CloseHandle: - if err := r.hsnapshotter.Remove(evt); err != nil { - return err - } } if evt.PS == nil { _, evt.PS = r.psnapshotter.Find(evt.PID) diff --git a/pkg/cap/writer_windows_test.go b/pkg/cap/writer_windows_test.go index 90e7a7ed9..d13907715 100644 --- a/pkg/cap/writer_windows_test.go +++ b/pkg/cap/writer_windows_test.go @@ -172,7 +172,6 @@ func TestLiveCapture(t *testing.T) { EnableRegistryEvents: true, EnableNetEvents: true, EnableThreadEvents: true, - EnableHandleEvents: true, }, CapFile: "../../test.cap", Filters: &config.Filters{}, diff --git a/pkg/config/_fixtures/fibratus.yml b/pkg/config/_fixtures/fibratus.yml index 4ef56e09a..f420a62cc 100644 --- a/pkg/config/_fixtures/fibratus.yml +++ b/pkg/config/_fixtures/fibratus.yml @@ -136,8 +136,6 @@ eventsource: blacklist: events: - CreateThread - - CreateHandle - - CloseHandle images: - System diff --git a/pkg/config/config.schema.json b/pkg/config/config.schema.json index e223db55c..aa6d47fee 100644 --- a/pkg/config/config.schema.json +++ b/pkg/config/config.schema.json @@ -350,9 +350,6 @@ "enable-vamap": { "type": "boolean" }, - "enable-handle": { - "type": "boolean" - }, "enable-net": { "type": "boolean" }, @@ -427,9 +424,6 @@ "Disconnect", "Reconnect", "Retransmit", - "CreateHandle", - "CloseHandle", - "DuplicateHandle", "QueryDns", "ReplyDns", "VirtualAlloc", diff --git a/pkg/config/config_windows.go b/pkg/config/config_windows.go index ff5058100..6fcf3cac7 100644 --- a/pkg/config/config_windows.go +++ b/pkg/config/config_windows.go @@ -425,7 +425,6 @@ func (c *Config) addFlags() { c.flags.Bool(enableFileIOEvents, true, "Determines whether disk I/O events are collected by Kernel Logger provider") c.flags.Bool(enableVAMapEvents, true, "Determines whether VA map/unmap events are collected by Kernel Logger provider") c.flags.Bool(enableModuleEvents, true, "Determines whether module events are collected by Kernel Logger provider") - c.flags.Bool(enableHandleEvents, false, "Determines whether object manager events (handle creation/destruction) are collected by Kernel Logger provider") c.flags.Bool(enableMemEvents, true, "Determines whether memory manager events are collected by Kernel Logger provider") c.flags.Bool(enableAuditAPIEvents, true, "Determines whether kernel audit API calls events are published") c.flags.Bool(enableDNSEvents, true, "Determines whether DNS client events are enabled") diff --git a/pkg/config/eventsource.go b/pkg/config/eventsource.go index 5cfbf1b92..67d099bd8 100644 --- a/pkg/config/eventsource.go +++ b/pkg/config/eventsource.go @@ -39,7 +39,6 @@ const ( enableFileIOEvents = "eventsource.enable-fileio" enableVAMapEvents = "eventsource.enable-vamap" enableModuleEvents = "eventsource.enable-module" - enableHandleEvents = "eventsource.enable-handle" enableMemEvents = "eventsource.enable-mem" enableAuditAPIEvents = "eventsource.enable-audit-api" enableDNSEvents = "eventsource.enable-dns" @@ -76,8 +75,6 @@ type EventSourceConfig struct { EnableVAMapEvents bool `json:"enable-vamap" yaml:"enable-vamap"` // EnableModuleEvents indicates if module events are collected by the ETW provider. EnableModuleEvents bool `json:"enable-image" yaml:"enable-module"` - // EnableHandleEvents indicates whether handle creation/disposal events are enabled. - EnableHandleEvents bool `json:"enable-handle" yaml:"enable-handle"` // EnableMemEvents indicates whether memory manager events are enabled. EnableMemEvents bool `json:"enable-memory" yaml:"enable-memory"` // EnableAuditAPIEvents indicates if kernel audit API calls events are enabled @@ -116,7 +113,6 @@ func (c *EventSourceConfig) initFromViper(v *viper.Viper) { c.EnableFileIOEvents = v.GetBool(enableFileIOEvents) c.EnableVAMapEvents = v.GetBool(enableVAMapEvents) c.EnableModuleEvents = v.GetBool(enableModuleEvents) - c.EnableHandleEvents = v.GetBool(enableHandleEvents) c.EnableMemEvents = v.GetBool(enableMemEvents) c.EnableAuditAPIEvents = v.GetBool(enableAuditAPIEvents) c.EnableDNSEvents = v.GetBool(enableDNSEvents) diff --git a/pkg/config/eventsource_test.go b/pkg/config/eventsource_test.go index ec68b57a1..157b88eb7 100644 --- a/pkg/config/eventsource_test.go +++ b/pkg/config/eventsource_test.go @@ -56,7 +56,6 @@ func TestEventSourceConfig(t *testing.T) { assert.False(t, c.EventSource.EnableModuleEvents) assert.False(t, c.EventSource.EnableFileIOEvents) - assert.True(t, c.EventSource.ExcludeEvent(event.CloseHandle.ID())) assert.False(t, c.EventSource.ExcludeEvent(event.CreateProcess.ID())) assert.True(t, c.EventSource.ExcludeImage(&pstypes.PS{Name: "svchost.exe"})) diff --git a/pkg/config/filters.go b/pkg/config/filters.go index 3d0bdfe5e..e4a77c644 100644 --- a/pkg/config/filters.go +++ b/pkg/config/filters.go @@ -194,7 +194,6 @@ type RulesCompileResult struct { HasFileEvents bool HasNetworkEvents bool HasRegistryEvents bool - HasHandleEvents bool HasMemEvents bool HasVAMapEvents bool HasDNSEvents bool @@ -284,7 +283,6 @@ func (r RulesCompileResult) String() string { HasFileEvents: %t HasRegistryEvents: %t HasNetworkEvents: %t - HasHandleEvents: %t HasMemEvents: %t HasVAMapEvents: %t HasAuditAPIEvents: %t @@ -298,7 +296,6 @@ func (r RulesCompileResult) String() string { r.HasFileEvents, r.HasRegistryEvents, r.HasNetworkEvents, - r.HasHandleEvents, r.HasMemEvents, r.HasVAMapEvents, r.HasAuditAPIEvents, diff --git a/pkg/event/category.go b/pkg/event/category.go index ae2cc4120..969fddd2d 100644 --- a/pkg/event/category.go +++ b/pkg/event/category.go @@ -41,8 +41,6 @@ const ( Thread Category = "thread" // Module is the category for module (dll, exe, sys) events Module Category = "module" - // Handle is the category for handle events - Handle Category = "handle" // Driver is the category for driver events Driver Category = "driver" // Mem is the category for memory events @@ -70,7 +68,7 @@ func (c Category) Hash() uint32 { } // MaxCategoryIndex designates the maximum category index. -const MaxCategoryIndex = 13 +const MaxCategoryIndex = 12 // Index returns a numerical category index. func (c Category) Index() uint8 { @@ -87,8 +85,6 @@ func (c Category) Index() uint8 { return 5 case Module: return 6 - case Handle: - return 7 case Driver: return 8 case Mem: @@ -113,7 +109,6 @@ func Categories() []string { string(Process), string(Thread), string(Module), - string(Handle), string(Mem), string(Driver), string(Other), diff --git a/pkg/event/event_windows.go b/pkg/event/event_windows.go index 09593be4c..b0b45dcd0 100644 --- a/pkg/event/event_windows.go +++ b/pkg/event/event_windows.go @@ -127,11 +127,6 @@ func (e *Event) adjustPID() { if !e.IsDNS() { e.PID, _ = e.Params.GetPid() } - case Handle: - if e.Type == DuplicateHandle { - e.PID, _ = e.Params.GetUint32(params.TargetProcessID) - e.Params.Remove(params.TargetProcessID) - } case Thread: if e.Type == StackWalk { e.PID, _ = e.Params.GetPid() @@ -217,8 +212,6 @@ func (e *Event) IsCreateProcess() bool { return e.Type == CreateProcess func (e *Event) IsCreateProcessInternal() bool { return e.Type == CreateProcessInternal } func (e *Event) IsCreateThread() bool { return e.Type == CreateThread } func (e *Event) IsCloseFile() bool { return e.Type == CloseFile } -func (e *Event) IsCreateHandle() bool { return e.Type == CreateHandle } -func (e *Event) IsCloseHandle() bool { return e.Type == CloseHandle } func (e *Event) IsDeleteFile() bool { return e.Type == DeleteFile } func (e *Event) IsRenameFile() bool { return e.Type == RenameFile } func (e *Event) IsEnumDirectory() bool { return e.Type == EnumDirectory } @@ -429,10 +422,6 @@ func (e *Event) PartialKey() uint64 { return hashers.FnvUint64(b) case VirtualAlloc, VirtualFree: return e.Params.MustGetUint64(params.MemBaseAddress) + uint64(e.PID) - case DuplicateHandle: - pid := e.Params.MustGetUint32(params.ProcessID) - object := e.Params.MustGetUint64(params.HandleObject) - return object + uint64(pid+e.PID) case QueryDNS, ReplyDNS: n, _ := e.Params.GetString(params.DNSName) b := make([]byte, 4+len(n)) @@ -554,16 +543,6 @@ func (e *Event) Summary() string { size, _ := e.Params.GetUint32(params.NetSize) return printSummary(e, fmt.Sprintf("received %d bytes from %v and %d port", size, ip, port)) - case CreateHandle: - handleType := e.GetParamAsString(params.HandleObjectTypeID) - handleName := e.GetParamAsString(params.HandleObjectName) - return printSummary(e, fmt.Sprintf("created %s handle of %s type", - handleName, handleType)) - case CloseHandle: - handleType := e.GetParamAsString(params.HandleObjectTypeID) - handleName := e.GetParamAsString(params.HandleObjectName) - return printSummary(e, fmt.Sprintf("closed %s handle of %s type", - handleName, handleType)) case VirtualAlloc: addr := e.GetParamAsString(params.MemBaseAddress) return printSummary(e, fmt.Sprintf("allocated memory at %s address", addr)) @@ -576,9 +555,6 @@ func (e *Event) Summary() string { case UnmapViewFile: sec := e.GetParamAsString(params.FileViewSectionType) return printSummary(e, fmt.Sprintf("unmapped view of %s section", sec)) - case DuplicateHandle: - handleType := e.GetParamAsString(params.HandleObjectTypeID) - return printSummary(e, fmt.Sprintf("duplicated %s handle", handleType)) case QueryDNS: dnsName := e.GetParamAsString(params.DNSName) return printSummary(e, fmt.Sprintf("sent %s DNS query", dnsName)) diff --git a/pkg/event/metainfo_windows.go b/pkg/event/metainfo_windows.go index ac2819c8f..4446b029c 100644 --- a/pkg/event/metainfo_windows.go +++ b/pkg/event/metainfo_windows.go @@ -77,9 +77,6 @@ var events = map[Type]Info{ RetransmitTCPv6: {"Retransmit", Net, "Retransmits unacknowledged TCP segments"}, LoadModule: {"LoadModule", Module, "Loads the module into the address space of the calling process"}, UnloadModule: {"UnloadModule", Module, "Unloads the module from the address space of the calling process"}, - CreateHandle: {"CreateHandle", Handle, "Creates a new handle"}, - CloseHandle: {"CloseHandle", Handle, "Closes the handle"}, - DuplicateHandle: {"DuplicateHandle", Handle, "Duplicates the handle"}, VirtualAlloc: {"VirtualAlloc", Mem, "Reserves, commits, or changes the state of a region of memory within the process virtual address space"}, VirtualFree: {"VirtualFree", Mem, "Releases or decommits a region of memory within the process virtual address space"}, MapViewFile: {"MapViewFile", File, "Maps a view of a file mapping into the address space of a calling process"}, @@ -136,9 +133,6 @@ var types = map[string]Type{ "DisconnectTCP6": DisconnectTCPv6, "RetransmitTCP4": RetransmitTCPv4, "RetransmitTCP6": RetransmitTCPv6, - "CreateHandle": CreateHandle, - "CloseHandle": CloseHandle, - "DuplicateHandle": DuplicateHandle, "VirtualAlloc": VirtualAlloc, "VirtualFree": VirtualFree, "MapViewFile": MapViewFile, @@ -198,9 +192,6 @@ var indexedEvents = []Info{ events[DisconnectTCPv6], events[RetransmitTCPv4], events[RetransmitTCPv6], - events[CreateHandle], - events[CloseHandle], - events[DuplicateHandle], events[VirtualAlloc], events[VirtualFree], events[MapViewFile], diff --git a/pkg/event/param_decoder_windows.go b/pkg/event/param_decoder_windows.go index 7bd076a1c..fbfe6ff9c 100644 --- a/pkg/event/param_decoder_windows.go +++ b/pkg/event/param_decoder_windows.go @@ -485,39 +485,6 @@ func (d *ParamDecoder) DecodeThreadpool(r *etw.EventRecord, e *Event) { } } -// DecodeHandle decodes events for handle creation/disposition events. -func (d *ParamDecoder) DecodeHandle(r *etw.EventRecord, e *Event) { - switch r.Header.EventDescriptor.Opcode { - case CreateHandleID, CloseHandleID: - // typedef struct _ETW_CREATE_HANDLE_EVENT { - // PVOID Object; - // ULONG Handle; - // USHORT ObjectType; - // } ETW_CREATE_HANDLE_EVENT, *PETW_CREATE_HANDLE_EVENT; - e.AppendParam(params.HandleObject, params.Address, r.ReadUint64(0)) - e.AppendParam(params.HandleID, params.Uint32, r.ReadUint32(8)) - e.AppendParam(params.HandleObjectTypeID, params.HandleType, r.ReadUint16(12)) - if r.BufferLen >= 16 { - e.AppendParam(params.HandleObjectName, params.UnicodeString, r.ConsumeUTF16String(14)) - } - case DuplicateHandleID: - // typedef struct _ETW_DUPLICATE_HANDLE_EVENT { - // PVOID Object; - // ULONG SourceHandle; - // ULONG TargetHandle; - // ULONG TargetProcessId; - // USHORT ObjectType; - // ULONG SourceProcessId; - // } ETW_DUPLICATE_HANDLE_EVENT, *PETW_DUPLICATE_HANDLE_EVENT; - e.AppendParam(params.HandleObject, params.Address, r.ReadUint64(0)) - e.AppendParam(params.HandleSourceID, params.Uint32, r.ReadUint32(8)) - e.AppendParam(params.HandleID, params.Uint32, r.ReadUint32(12)) - e.AppendParam(params.TargetProcessID, params.PID, r.ReadUint32(16)) - e.AppendParam(params.HandleObjectTypeID, params.HandleType, r.ReadUint16(20)) - e.AppendParam(params.ProcessID, params.PID, r.ReadUint32(22)) - } -} - // DecodeCreateSymbolicLinkObject decodes the payload for the CreateSymbolicLinkObject event. func (d *ParamDecoder) DecodeCreateSymbolicLinkObject(r *etw.EventRecord, e *Event) { source, offset := r.ReadUTF16String(0) diff --git a/pkg/event/param_windows.go b/pkg/event/param_windows.go index 2025461e0..33f148768 100644 --- a/pkg/event/param_windows.go +++ b/pkg/event/param_windows.go @@ -245,8 +245,6 @@ func (e *Event) decodeParams(r *etw.EventRecord) { paramDecoder.DecodeThread(r, e) case ThreadpoolEventGUID: paramDecoder.DecodeThreadpool(r, e) - case HandleEventGUID: - paramDecoder.DecodeHandle(r, e) case RegistryKernelEventGUID: paramDecoder.DecodeRegSetValueInternal(r, e) case ProcessKernelEventGUID: diff --git a/pkg/event/params/params_windows.go b/pkg/event/params/params_windows.go index cb269f02c..2a9a83cb3 100644 --- a/pkg/event/params/params_windows.go +++ b/pkg/event/params/params_windows.go @@ -238,17 +238,6 @@ const ( // DNSAnswers is the field that represents DNS response answers DNSAnswers = "answers" - // HandleID identifies the parameter that specifies the handle identifier. - HandleID = "handle_id" - // HandleSourceID identifies the parameter that specifies the source handle identifier. - HandleSourceID = "handle_source_id" - // HandleObject identifies the parameter that represents the kernel object to which handle is associated. - HandleObject = "handle_object" - // HandleObjectName identifies the parameter that represents the kernel object name. - HandleObjectName = "handle_name" - // HandleObjectTypeID identifies the parameter that represents the kernel object type identifier. - HandleObjectTypeID = "type_id" - // MemBaseAddress identifies the parameter that denotes the allocation base address. MemBaseAddress = "base_address" // MemRegionSize identifies the parameter that represents the allocated region size. diff --git a/pkg/event/types_windows.go b/pkg/event/types_windows.go index 93ff22551..4db5dc63b 100644 --- a/pkg/event/types_windows.go +++ b/pkg/event/types_windows.go @@ -57,8 +57,6 @@ var ( NetworkTCPEventGUID = windows.GUID{Data1: 0x9a280ac0, Data2: 0xc8e0, Data3: 0x11d1, Data4: [8]byte{0x84, 0xe2, 0x0, 0xc0, 0x4f, 0xb9, 0x98, 0xa2}} // NetworkUDPEventGUID represents network UDP provider event GUID NetworkUDPEventGUID = windows.GUID{Data1: 0xbf3a50c5, Data2: 0xa9c9, Data3: 0x4988, Data4: [8]byte{0xa0, 0x05, 0x2d, 0xf0, 0xb7, 0xc8, 0x0f, 0x80}} - // HandleEventGUID represents handle provider event GUID - HandleEventGUID = windows.GUID{Data1: 0x89497f50, Data2: 0xeffe, Data3: 0x4440, Data4: [8]byte{0x8c, 0xf2, 0xce, 0x6b, 0x1c, 0xdc, 0xac, 0xa7}} // MemEventGUID represents memory provider event GUID MemEventGUID = windows.GUID{Data1: 0x3d6fa8d3, Data2: 0xfe05, Data3: 0x11d0, Data4: [8]byte{0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c}} // AuditAPIEventGUID represents audit API calls event GUID @@ -140,10 +138,6 @@ const ( VirtualAllocID uint8 = 98 VirtualFreeID uint8 = 99 - CreateHandleID uint8 = 32 - CloseHandleID uint8 = 33 - DuplicateHandleID uint8 = 34 - QueryDNSID uint16 = 3006 ReplyDNSID uint16 = 3008 @@ -287,13 +281,6 @@ var ( // RetransmitTCPv6 is the TCP IPv6 network retransmit event. RetransmitTCPv6 = pack(NetworkTCPEventGUID, uint16(RetransmitTCPv6ID)) - // CreateHandle represents handle creation event - CreateHandle = pack(HandleEventGUID, uint16(CreateHandleID)) - // CloseHandle represents handle closure event - CloseHandle = pack(HandleEventGUID, uint16(CloseHandleID)) - // DuplicateHandle represents handle duplication event - DuplicateHandle = pack(HandleEventGUID, uint16(DuplicateHandleID)) - // VirtualAlloc represents virtual memory allocation event VirtualAlloc = pack(MemEventGUID, uint16(VirtualAllocID)) // VirtualFree represents virtual memory release event @@ -376,12 +363,6 @@ func (t Type) String() string { return "UnmapViewFile" case MapFileRundown: return "MapFileRundown" - case CreateHandle: - return "CreateHandle" - case CloseHandle: - return "CloseHandle" - case DuplicateHandle: - return "DuplicateHandle" case RegKCBRundown: return "RegKCBRundown" case RegOpenKey: @@ -469,8 +450,6 @@ func (t Type) Category() Category { RecvTCPv4, RecvTCPv6, RecvUDPv4, RecvUDPv6, QueryDNS, ReplyDNS: return Net - case CreateHandle, CloseHandle, DuplicateHandle: - return Handle case VirtualAlloc, VirtualFree: return Mem case CreateSymbolicLinkObject: @@ -563,12 +542,6 @@ func (t Type) Description() string { return "Loads the module into the address space of the calling process" case UnloadModule: return "Unloads the module from the address space of the calling process" - case CreateHandle: - return "Creates a new handle" - case CloseHandle: - return "Closes the handle" - case DuplicateHandle: - return "Duplicates the handle" case VirtualAlloc: return "Reserves, commits, or changes the state of a region of memory within the process virtual address space" case VirtualFree: @@ -726,73 +699,47 @@ func (t Type) color() string { switch t { case CreateFile, ReadFile, CloseFile, SetFileInformation, MapViewFile, UnmapViewFile: return colorizer.SpanBold(colorizer.Cyan, t.String()) - case RenameFile: return colorizer.SpanBold(colorizer.Amber, t.String()) - case WriteFile: return colorizer.SpanBold(colorizer.Teal, t.String()) - case DeleteFile: return colorizer.SpanBold(colorizer.Red, t.String()) - case RegOpenKey, RegCreateKey, RegQueryValue, RegQueryKey: return colorizer.SpanBold(colorizer.Yellow, t.String()) - case RegDeleteKey, RegDeleteValue: return colorizer.SpanBold(colorizer.Red, t.String()) - case RegSetValue: return colorizer.SpanBold(colorizer.Amber, t.String()) - case CreateProcess, OpenProcess: return colorizer.SpanBold(colorizer.Green, t.String()) - case TerminateProcess: return colorizer.SpanBold(colorizer.Red, t.String()) - case CreateThread, OpenThread: return colorizer.SpanBold(colorizer.Green, t.String()) - case TerminateThread: return colorizer.SpanBold(colorizer.Red, t.String()) - case SetThreadContext: return colorizer.SpanBold(colorizer.Amber, t.String()) - case LoadModule, UnloadModule: return colorizer.SpanBold(colorizer.Magenta, t.String()) - case SendTCPv4, SendTCPv6, SendUDPv4, SendUDPv6, RecvTCPv4, RecvTCPv6, RecvUDPv4, RecvUDPv6: return colorizer.SpanBold(colorizer.Blue, t.String()) - case ConnectTCPv4, ConnectTCPv6: return colorizer.SpanBold(colorizer.Teal, t.String()) - case DisconnectTCPv4, DisconnectTCPv6: return colorizer.SpanBold(colorizer.Blue, t.String()) - case AcceptTCPv4, AcceptTCPv6: return colorizer.SpanBold(colorizer.Teal, t.String()) - case QueryDNS, ReplyDNS: return colorizer.SpanBold(colorizer.Indigo, t.String()) - - case CreateHandle, CloseHandle: - return colorizer.SpanBold(colorizer.Gray, t.String()) - case DuplicateHandle: - return colorizer.SpanBold(colorizer.Amber, t.String()) - case VirtualAlloc, VirtualFree: return colorizer.SpanBold(colorizer.Magenta, t.String()) - case CreateSymbolicLinkObject: return colorizer.SpanBold(colorizer.Lavender, t.String()) - case SubmitThreadpoolCallback, SubmitThreadpoolWork, SetThreadpoolTimer: return colorizer.SpanBold(colorizer.Lavender, t.String()) - default: return colorizer.SpanBold(colorizer.White, t.String()) } @@ -816,20 +763,16 @@ func (t Type) arrow() string { case TerminateProcess, TerminateThread, DeleteFile, RegDeleteKey, RegDeleteValue, UnloadModule, VirtualFree, UnmapViewFile: clr = colorizer.Red - case CreateProcess, CreateFile, WriteFile, RenameFile, SetFileInformation, RegCreateKey, RegSetValue, CreateThread, SetThreadContext, VirtualAlloc, MapViewFile, - DuplicateHandle, ConnectTCPv4, ConnectTCPv6, AcceptTCPv4, AcceptTCPv6, + ConnectTCPv4, ConnectTCPv6, AcceptTCPv4, AcceptTCPv6, SendTCPv4, SendTCPv6, SendUDPv4, SendUDPv6: clr = colorizer.Amber - case ReadFile, EnumDirectory, LoadModule, RegOpenKey, RegQueryKey, RegQueryValue, OpenProcess, - OpenThread, CreateHandle, RecvTCPv4, RecvTCPv6, RecvUDPv4, RecvUDPv6: + OpenThread, RecvTCPv4, RecvTCPv6, RecvUDPv4, RecvUDPv6: clr = colorizer.Teal - case QueryDNS, ReplyDNS: clr = colorizer.Indigo - default: clr = colorizer.Gray } diff --git a/pkg/filter/accessor.go b/pkg/filter/accessor.go index 470f636ff..934ee7334 100644 --- a/pkg/filter/accessor.go +++ b/pkg/filter/accessor.go @@ -160,7 +160,6 @@ func (f *filter) narrowAccessors() { removeFileAccessor = true removeRegistryAccessor = true removeNetworkAccessor = true - removeHandleAccessor = true removePEAccessor = true removeMemAccessor = true removeDNSAccessor = true @@ -185,8 +184,6 @@ func (f *filter) narrowAccessors() { removeRegistryAccessor = false case field.Name.IsNetworkField(): removeNetworkAccessor = false - case field.Name.IsHandleField(): - removeHandleAccessor = false case field.Name.IsMemField(): removeMemAccessor = false case field.Name.IsDNSField(): @@ -217,9 +214,6 @@ func (f *filter) narrowAccessors() { if removeNetworkAccessor { f.removeAccessor(&networkAccessor{}) } - if removeHandleAccessor { - f.removeAccessor(&handleAccessor{}) - } if removePEAccessor { f.removeAccessor(&peAccessor{}) } diff --git a/pkg/filter/accessor_windows.go b/pkg/filter/accessor_windows.go index 25e60ee7e..924b83400 100644 --- a/pkg/filter/accessor_windows.go +++ b/pkg/filter/accessor_windows.go @@ -56,7 +56,6 @@ func GetAccessors() []Accessor { newEventAccessor(), newModuleAccessor(), newThreadAccessor(), - newHandleAccessor(), newNetworkAccessor(), newRegistryAccessor(), newThreadpoolAccessor(), @@ -965,32 +964,6 @@ func (n *networkAccessor) resolveNamesForIP(ip net.IP) ([]string, error) { return names, nil } -// handleAccessor extracts handle event values. -type handleAccessor struct{} - -func (handleAccessor) SetFields([]Field) {} -func (handleAccessor) SetSegments([]fields.Segment) {} -func (handleAccessor) IsFieldAccessible(e *event.Event) bool { - return e.Category == event.Handle -} - -func newHandleAccessor() Accessor { return &handleAccessor{} } - -func (h *handleAccessor) Get(f Field, e *event.Event) (params.Value, error) { - switch f.Name { - case fields.HandleID: - return e.Params.GetUint32(params.HandleID) - case fields.HandleType: - return e.GetParamAsString(params.HandleObjectTypeID), nil - case fields.HandleName: - return e.Params.GetString(params.HandleObjectName) - case fields.HandleObject: - return e.Params.GetUint64(params.HandleObject) - } - - return nil, nil -} - // peAccessor extracts PE specific values. type peAccessor struct { fields []Field diff --git a/pkg/filter/accessor_windows_test.go b/pkg/filter/accessor_windows_test.go index c2164da48..6d52f0717 100644 --- a/pkg/filter/accessor_windows_test.go +++ b/pkg/filter/accessor_windows_test.go @@ -42,17 +42,13 @@ func TestNarrowAccessors(t *testing.T) { New(`foreach(ps._modules, $mod, $mod.path = 'C:\\Windows\\System32')`, cfg), 1, }, - { - New(`handle.type = 'Section' and ps.pe.nsections > 1 and evt.name = 'CreateHandle'`, cfg), - 3, - }, { New(`sequence |evt.name = 'CreateProcess'| as e1 |evt.name = 'CreateFile' and file.name = $e1.ps.exe |`, cfg), 3, }, { - New(`base(file.name) = 'kernel32.dll'`, cfg), - 1, + New(`base(file.name) = 'kernel32.dll' and ps.pe.nsections > 1`, cfg), + 2, }, } @@ -72,7 +68,7 @@ func TestNarrowAccessors(t *testing.T) { } // check if fields are set in the accessor require.NotNil(t, pea) - assert.Len(t, pea.fields, 3) + assert.Len(t, pea.fields, 2) } func TestIsFieldAccessible(t *testing.T) { diff --git a/pkg/filter/fields/fields_windows.go b/pkg/filter/fields/fields_windows.go index 5743682ce..47d032138 100644 --- a/pkg/filter/fields/fields_windows.go +++ b/pkg/filter/fields/fields_windows.go @@ -413,15 +413,6 @@ const ( // KevtArg represents the field sequence for generic argument access KevtArg Field = "kevt.arg" - // HandleID represents the handle identifier within the process address space - HandleID Field = "handle.id" - // HandleObject represents the handle object address - HandleObject Field = "handle.object" - // HandleName represents the handle name - HandleName Field = "handle.name" - // HandleType represents the handle type (e.g. file) - HandleType Field = "handle.type" - // NetDIP represents network destination IP address NetDIP Field = "net.dip" // NetSIP represents the source IP address @@ -699,7 +690,6 @@ func (f Field) IsImageField() bool { return strings.HasPrefix(string(f), "ima func (f Field) IsFileField() bool { return strings.HasPrefix(string(f), "file.") } func (f Field) IsRegistryField() bool { return strings.HasPrefix(string(f), "registry.") } func (f Field) IsNetworkField() bool { return strings.HasPrefix(string(f), "net.") } -func (f Field) IsHandleField() bool { return strings.HasPrefix(string(f), "handle.") } func (f Field) IsPeField() bool { return strings.HasPrefix(string(f), "pe.") || strings.HasPrefix(string(f), "ps.pe.") || strings.HasPrefix(string(f), "ps.signature.") } @@ -1204,11 +1194,6 @@ var fields = map[Field]FieldInfo{ NetSIPNames: {NetSIPNames, "source IP names", params.Slice, []string{"net.sip.names in ('github.com.')"}, nil, nil}, NetDIPNames: {NetDIPNames, "destination IP names", params.Slice, []string{"net.dip.names in ('github.com.')"}, nil, nil}, - HandleID: {HandleID, "handle identifier", params.Uint16, []string{"handle.id = 24"}, nil, nil}, - HandleObject: {HandleObject, "handle object address", params.Address, []string{"handle.object = 'FFFFB905DBF61988'"}, nil, nil}, - HandleName: {HandleName, "handle name", params.UnicodeString, []string{"handle.name = '\\Device\\NamedPipe\\chrome.12644.28.105826381'"}, nil, nil}, - HandleType: {HandleType, "handle type", params.AnsiString, []string{"handle.type = 'Mutant'"}, nil, nil}, - PeNumSections: {PeNumSections, "number of sections", params.Uint16, []string{"pe.nsections < 5"}, &Deprecation{Since: "3.0.0", Fields: []Field{PsPeNumSections}}, nil}, PeNumSymbols: {PeNumSymbols, "number of entries in the symbol table", params.Uint32, []string{"pe.nsymbols > 230"}, &Deprecation{Since: "3.0.0", Fields: []Field{PsPeNumSymbols}}, nil}, PeBaseAddress: {PeBaseAddress, "image base address", params.Address, []string{"pe.address.base = '140000000'"}, &Deprecation{Since: "3.0.0", Fields: []Field{PsPeBaseAddress}}, nil}, diff --git a/pkg/filter/filter.go b/pkg/filter/filter.go index 5ff528b7c..d9783e4df 100644 --- a/pkg/filter/filter.go +++ b/pkg/filter/filter.go @@ -129,8 +129,6 @@ func (b *BoundField) Accessor(f *filter) Accessor { b.accessor = newRegistryAccessor() case b.Field.Name.IsNetworkField(): b.accessor = newNetworkAccessor() - case b.Field.Name.IsHandleField(): - b.accessor = newHandleAccessor() case b.Field.Name.IsPeField(): b.accessor = newPEAccessor() case b.Field.Name.IsMemField(): diff --git a/pkg/filter/filter_test.go b/pkg/filter/filter_test.go index ecf7ac0d4..872414f39 100644 --- a/pkg/filter/filter_test.go +++ b/pkg/filter/filter_test.go @@ -51,7 +51,6 @@ import ( var cfg = &config.Config{ EventSource: config.EventSourceConfig{ - EnableHandleEvents: true, EnableNetEvents: true, EnableRegistryEvents: true, EnableFileIOEvents: true, diff --git a/pkg/filter/filter_windows.go b/pkg/filter/filter_windows.go index d2a0ea1fa..c4d48121d 100644 --- a/pkg/filter/filter_windows.go +++ b/pkg/filter/filter_windows.go @@ -76,9 +76,6 @@ func New(expr string, config *config.Config, options ...Option) Filter { if config.EventSource.EnableNetEvents { accessors = append(accessors, newNetworkAccessor()) } - if config.EventSource.EnableHandleEvents { - accessors = append(accessors, newHandleAccessor()) - } if config.EventSource.EnableMemEvents { accessors = append(accessors, newMemAccessor()) } diff --git a/pkg/filter/ql/function.go b/pkg/filter/ql/function.go index 332cd1232..041c43c82 100644 --- a/pkg/filter/ql/function.go +++ b/pkg/filter/ql/function.go @@ -310,7 +310,6 @@ func (f *Foreach) Desc() functions.FunctionDesc { "$registry": true, "$net": true, "$mem": true, - "$handle": true, "$dns": true, "$evt": true, } diff --git a/pkg/filter/valuer_test.go b/pkg/filter/valuer_test.go index aa1e0ed92..1a4b0cbe5 100644 --- a/pkg/filter/valuer_test.go +++ b/pkg/filter/valuer_test.go @@ -162,17 +162,17 @@ func TestValuerCacheFieldWithoutID(t *testing.T) { return "value" } - c.populateValuer(Field{Name: fields.HandleID, Value: fields.HandleID.String()}, extract) - c.populateValuer(Field{Name: fields.HandleName, Value: fields.HandleName.String()}, extract) + c.populateValuer(Field{Name: fields.PsUUID, Value: fields.PsUUID.String()}, extract) + c.populateValuer(Field{Name: fields.PsName, Value: fields.PsName.String()}, extract) assert.Equal(t, 2, calls, "unknown fields (id == -1) must not be cached") - c.populateValuer(Field{Name: fields.HandleID, Value: fields.HandleID.String()}, dontCallValuerFunc) - c.populateValuer(Field{Name: fields.HandleName, Value: fields.HandleName.String()}, dontCallValuerFunc) + c.populateValuer(Field{Name: fields.PsUUID, Value: fields.PsUUID.String()}, dontCallValuerFunc) + c.populateValuer(Field{Name: fields.PsName, Value: fields.PsName.String()}, dontCallValuerFunc) // now the fields should be cached - assert.Equal(t, "value", c.valuer[fields.HandleID.String()]) - assert.Equal(t, "value", c.valuer[fields.HandleName.String()]) + assert.Equal(t, "value", c.valuer[fields.PsUUID.String()]) + assert.Equal(t, "value", c.valuer[fields.PsName.String()]) } func BenchmarkValuerCacheHit(b *testing.B) { diff --git a/pkg/handle/snapshotter.go b/pkg/handle/snapshotter.go index dfcaebb2b..b29f668b1 100644 --- a/pkg/handle/snapshotter.go +++ b/pkg/handle/snapshotter.go @@ -24,17 +24,16 @@ package handle import ( "expvar" "fmt" - "github.com/rabbitstack/fibratus/pkg/sys" - "golang.org/x/sys/windows" "os" "strconv" "sync" "time" "unsafe" + "github.com/rabbitstack/fibratus/pkg/sys" + "golang.org/x/sys/windows" + "github.com/rabbitstack/fibratus/pkg/config" - "github.com/rabbitstack/fibratus/pkg/event" - "github.com/rabbitstack/fibratus/pkg/event/params" htypes "github.com/rabbitstack/fibratus/pkg/handle/types" log "github.com/sirupsen/logrus" ) @@ -63,16 +62,10 @@ type DestroyCallback func(pid uint32, rawHandle windows.Handle) // SnapshotBuildCompleted is the function type for snapshot completed signal type SnapshotBuildCompleted func(total uint64, named uint64) -// Snapshotter keeps the system-wide snapshot of allocated handles always when handle kernel events are enabled or -// supported on the target system. It also provides facilities for obtaining a list of handles pertaining to the specific +// Snapshotter keeps the system-wide snapshot of allocated handles. It also +// provides facilities for obtaining a list of handles pertaining to the specific // process. type Snapshotter interface { - // Write updates the snapshotter state by storing a new entry for the inbound create handle event. It also notifies - // the registered callback that a new handle has been created. - Write(evt *event.Event) error - // Remove destroys the handle state for the specified handle object. The removal callback is triggered when an item - // is deleted from the store. - Remove(evt *event.Event) error // FindHandles returns a list of all known handles for the specified process identifier. FindHandles(pid uint32) ([]htypes.Handle, error) // FindByObject returns the handle for the given handle object reference. @@ -397,46 +390,9 @@ func (s *snapshotter) GetSnapshot() []htypes.Handle { return handles } -func (s *snapshotter) Write(e *event.Event) error { - if !e.IsCreateHandle() { - return fmt.Errorf("expected CreateHandle event but got %s", e.Type) - } - h := unwrapHandle(e) - obj, err := e.Params.GetUint64(params.HandleObject) - if err != nil { - return err - } - s.mu.Lock() - s.handlesByObject[obj] = h - s.mu.Unlock() - return nil -} - -func (s *snapshotter) Remove(e *event.Event) error { - if !e.IsCloseHandle() { - return fmt.Errorf("expected CloseHandle event but got %s", e.Type) - } - obj, err := e.Params.GetUint64(params.HandleObject) - if err != nil { - return err - } - s.mu.Lock() - delete(s.handlesByObject, obj) - s.mu.Unlock() - return nil -} - func (s *snapshotter) Close() error { if s.housekeepTick != nil { s.housekeepTick.Stop() } return nil } - -func unwrapHandle(e *event.Event) htypes.Handle { - h := htypes.Handle{} - h.Type = e.GetParamAsString(params.HandleObjectTypeID) - h.Object, _ = e.Params.GetUint64(params.HandleObject) - h.Name, _ = e.Params.GetString(params.HandleObjectName) - return h -} diff --git a/pkg/handle/snapshotter_mock.go b/pkg/handle/snapshotter_mock.go index 8b7241b01..ca5ff7aae 100644 --- a/pkg/handle/snapshotter_mock.go +++ b/pkg/handle/snapshotter_mock.go @@ -22,7 +22,6 @@ package handle import ( - "github.com/rabbitstack/fibratus/pkg/event" htypes "github.com/rabbitstack/fibratus/pkg/handle/types" "github.com/stretchr/testify/mock" ) @@ -32,18 +31,6 @@ type SnapshotterMock struct { mock.Mock } -// Write method -func (s *SnapshotterMock) Write(evt *event.Event) error { - args := s.Called(evt) - return args.Error(0) -} - -// Remove method -func (s *SnapshotterMock) Remove(evt *event.Event) error { - args := s.Called(evt) - return args.Error(0) -} - // FindHandles method func (s *SnapshotterMock) FindHandles(pid uint32) ([]htypes.Handle, error) { args := s.Called(pid) diff --git a/pkg/rules/compiler.go b/pkg/rules/compiler.go index d0c107df3..be34cb31e 100644 --- a/pkg/rules/compiler.go +++ b/pkg/rules/compiler.go @@ -354,8 +354,6 @@ func (c *compiler) buildCompileResult(filters map[*config.FilterConfig]filter.Fi rs.HasRegistryEvents = true case event.Mem: rs.HasMemEvents = true - case event.Handle: - rs.HasHandleEvents = true case event.Threadpool: rs.HasThreadpoolEvents = true } diff --git a/pkg/rules/engine_test.go b/pkg/rules/engine_test.go index 21bdc4250..f3d649052 100644 --- a/pkg/rules/engine_test.go +++ b/pkg/rules/engine_test.go @@ -84,7 +84,6 @@ func init() { func newConfig(fromFiles ...string) *config.Config { c := &config.Config{ EventSource: config.EventSourceConfig{ - EnableHandleEvents: true, EnableNetEvents: true, EnableRegistryEvents: true, EnableFileIOEvents: true, @@ -557,9 +556,9 @@ func BenchmarkRunRules(b *testing.B) { Metadata: make(map[event.MetadataKey]any), }, { - Type: event.CreateHandle, - Name: "CreateHandle", - Category: event.Handle, + Type: event.CreateFile, + Name: "CreateFile", + Category: event.File, Tid: 2484, PID: 859, PS: &types.PS{ diff --git a/rules/macros/macros.yml b/rules/macros/macros.yml index 6b19c7dc8..f4677eb4c 100644 --- a/rules/macros/macros.yml +++ b/rules/macros/macros.yml @@ -103,12 +103,6 @@ - macro: unmap_view_of_section expr: unmap_view_file and file.view.type in ('IMAGE', 'IMAGE_NO_EXECUTE') -- macro: duplicate_handle - expr: evt.name = 'DuplicateHandle' - -- macro: create_handle - expr: evt.name = 'CreateHandle' - - macro: query_dns expr: evt.name = 'QueryDns'