C Sample Identification ETL - Revision history

Sam at 11:25, 24 January 2024

2024-01-24T11:25:49Z

Sam at 18:45, 9 May 2022

2022-05-09T18:45:31Z

Sam at 11:06, 3 June 2021

2021-06-03T11:06:01Z

Sam at 13:34, 14 May 2021

2021-05-14T13:34:49Z

Sam: /* Source Code */

2021-04-05T20:02:41Z

Source Code

Sam at 20:00, 5 April 2021

2021-04-05T20:00:20Z

Sam: Created page with "This sample shows the steps needed to implement a byte identifier ETL in C. =Sample File Format= This sample will identify a fake file format we call Acme. [https://en.wikipe..."

2021-04-05T19:59:08Z

Created page with "This sample shows the steps needed to implement a byte identifier ETL in C. =Sample File Format= This sample will identify a fake file format we call Acme. [https://en.wikipe..."

New page

This sample shows the steps needed to implement a byte identifier ETL in C.

=Sample File Format=
This sample will identify a fake file format we call Acme.
[https://en.wikipedia.org/wiki/Acme_Corporation Acme Corporation] is a known supplier of nefarious devices and explosives.
Their file format begins with a five byte [https://en.wikipedia.org/wiki/Magic_number_(programming) magic value] followed by eleven bytes in a data structure.

<pre>
0000h: 88 77 66 55 00 11 22 33 44 55 66 77 88 99 AA BB
0010h: CC
</pre>

=Source Code=
<source line lang="C">
#include <stdio.h>
#include <memory.h>
#include <inttypes.h>
#include <TruxtonCAPI.h>
#include <TruxtonFileTypes.h>
#include <TruxtonDefines.h>
#pragma comment (lib, "TruxtonCAPI.lib")

int main(void)
{
uint8_t buffer[10];

uint64_t message = 0;

uint64_t etl_application = truxton_etl_create();

truxton_etl_set_application_name(etl_application, "My Identify File");
truxton_etl_set_description(etl_application, "Identifier ETL for new file type");
truxton_etl_set_queue_name(etl_application, "mif");
truxton_etl_set_stage_number(etl_application, 2);

truxton_etl_add_desired_file_type(etl_application, Type_Unknown);

//truxton_etl_send_me_file_id(etl_application, "6068992f-af6b-06b8-28ce-094b0000000d");

message = truxton_etl_get_message(etl_application);

while (message != 0)
{
if (truxton_message_get_depot_length(message) >= 16 &&
truxton_message_get_signature(message) == 0x88776655)
{
uint64_t file_in_truxton = truxton_message_get_file(message);

if (file_in_truxton != 0)
{
truxton_file_seek(file_in_truxton, 4, SEEK_SET);

if (truxton_file_read(file_in_truxton, buffer, 1) == 1)
{
if (buffer[0] == 0x00)
{
truxton_file_change_type(file_in_truxton, 11111);
truxton_message_set_file_type(message, 11111);
truxton_route_message(truxton_file_get_truxton(file_in_truxton), message);
}
}
}

truxton_file_free(file_in_truxton);
}

truxton_message_destroy(message);

message = truxton_etl_get_message(etl_application);
}

truxton_etl_destroy(etl_application);
return(0);
}
</source>

@@ Line 2: / Line 2: @@
 You can see this same sample implemented in [[Python Sample Identification ETL|Python]].
 After identifying the file type, you will next need to [[C Sample Exploitation ETL|exploit]] it.
 =Sample File Format=

← Older revision		Revision as of 13:34, 14 May 2021
Line 1:		Line 1:
	This sample shows the steps needed to implement a byte identifier ETL in C.		This sample shows the steps needed to implement a byte identifier ETL in C.
		+	You can see this same sample implemented in [[Python Sample Identification ETL\|Python]].

	=Sample File Format=		=Sample File Format=

@@ Line 28: / Line 28: @@
 =Source Code=
-<source lang="C">
+<source line lang="C">
 #include <stdio.h>
 #include <memory.h>
@@ Line 45: / Line 45: @@
    uint64_t etl_application = truxton_etl_create();
-   truxton_etl_set_application_name(etl_application, "My Identify File");
+   truxton_etl_set_application_name(etl_application, "Acme Identifier");
-   truxton_etl_set_description(etl_application, "Identifier ETL for new file type");
+   truxton_etl_set_description(etl_application, "This ETL identifies files using the Acme method");
-   truxton_etl_set_queue_name(etl_application, "mif");
+   truxton_etl_set_queue_name(etl_application, "acme");
    truxton_etl_set_stage_number(etl_application, 2);
    truxton_etl_add_desired_file_type(etl_application, Type_Unknown);
    message = truxton_etl_get_message(etl_application);
@@ Line 76: / Line 74: @@
+           }
+         }
+       }
+     }
@@ Line 90: / Line 88: @@
+}
 </source>