Add A New File Type

Adding a new file type to Truxton can be as easy or as hard as you make it.

Overview

This article will walk you through what must be done in order to extend Truxton with custom file types. The Truxton exploitation process can be summarized as gathering bytes, identifying them, routing them to exploitators and writing reports.

The steps are:

1. Register a new file type with Truxton
2. Author an ETL to recognize files of your new type
3. Author an ETL to exploit that file type (optional)
4. Author an ETL to write a report (optional)

Load is the first process to attempt to identify a file based on its contents. Since it is navigating the source media, it will gather If it cannot, it will give the file at type of Type_Unknown. To extend Truxton, you need to write an ETL process that registers for files of type Type_Unknown.

Register a New Type

The first step in adding a file type is choose a unique integer value for use in the database. It should be a value over 10,000 but less than 32,000 in order to not collide with Truxton's built-in identifier.

Make an entry into the [FileType] table. The unique integer value you chose should go into the [ID] column. You should also fill in the [ShortName], [LongName], [Extension] and [MIME] at a minimum. This will allow the user interface to correctly display the file type in the user interface.

Sample Code

The following samples will demonstrate how to register a new type of file with Truxton.

• C
• Python

Identification ETL

You need to host your byte identification algorithm in an ETL. You can add as many file type algorithms to this ETL as you wish. It is more efficient to host many identifiers in a single process than to have many separate processes. The ETL should perform the following tasks:

1. Register for Type_Unknown. In the [ETLRoute] table, add the message queue name for your new ETL to receive the "unknown" file type.
2. Identify the Contents. Navigate the contents to identify the contents of the file. If the file is not of your type, wait to process the next message.
3. Change the File's Type in the database.
4. Route the file to whomever wants it.

Sample Code

The following samples will demonstrate how to become a byte-identifier ETL running in Truxton's exploitation layer.

• C
• Python

Exploitation ETL

If you wish to exploit files, you must write an ETL process to receive the file types you want. The ETL should perform the the following tasks:

1. Registry for the types of files to process
2. Read the contents of the file
3. Produce files, arifacts, events, etc.
4. Save them to Truxton

Sample Code

The following samples will demonstrate how to be a file exploiter ETL running in Truxton's exploitation layer.

• C
• Python