TGUID - Revision history

Sam: /* Field B */

2024-03-23T13:43:22Z

Field B

2022-04-18T17:10:29Z

ETL ID

2020-12-07T22:36:21Z

Fields

2020-12-07T22:33:28Z

File ID

2020-10-22T12:56:31Z

API Considerations

2020-10-22T12:55:30Z

Media ID

2020-10-16T18:04:26Z

Field A

2020-10-16T13:27:01Z

File ID

2020-10-16T13:23:37Z

In Memory Layout

2020-07-26T16:17:14Z

@@ Line 67: / Line 67: @@
 ===Field B===
 The second field is sixty four bits of random data.
-This is generated using the secure random number generator function <code>[https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/rand-s?view=vs-2019 rand_s]</code> which uses the <code>[https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-rtlgenrandom RtlGenRandom]</code> API.
+This is generated using the secure random number generator function <code>[https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/rand-s?view=vs-2019 rand_s]</code> which uses the <code>[https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-rtlgenrandom RtlGenRandom]</code> API on a Windows machine.
 ===Field C===

@@ Line 90: / Line 90: @@
 ==ETL ID==
-The job of an ETL ID is to identify an ETL on the network.
+The job of an ETL ID is to identify a process runnon on the network as a Truxton exploitation proces.
 ETL IDs are used in status messages when reporting to [[Les]].
 ===Fields===

@@ Line 147: / Line 147: @@
 | <code>TTTTTT</code>
 | style="text-align:center;" | 007514
-| The thread ID 29972
+| Thread ID 29972
 |-
 | <code>AAAAAAAAAAAA</code>
 | style="text-align:center;" | 192168001014
-| The IP address is 192.168.1.14
+| IP address is 192.168.1.14
 |}

@@ Line 27: / Line 27: @@
 This satisfies a couple of requirements we have of file identifiers (other than being globally unique):
 * Quickly Created. Generating purely random data is a lengthy process when you are generating millions of them.
-* Make database partitioning possible. By having part of the identifier being a timestamp, we can partition the <code>[[File Table|File]]</code> table by algorithm.
+* Make database partitioning possible. By having part of the identifier being a timestamp, we can partition the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table by algorithm.
 Let's take apart a sample file identifier:

@@ Line 165: / Line 165: @@
 =API Considerations=
 Internally, Truxton uses TGUIDs.
-The external API intended for use by customers, uses [https://en.wikipedia.org/wiki/Universally_unique_identifier GUIDs] as trying to explain this to them would lead to never ending confusion.
+The external API intended for use by customers, uses [https://en.wikipedia.org/wiki/Universally_unique_identifier GUIDs] as trying to explain this would lead to never ending confusion and bugs.
 It is far better if the Truxton libraries keep TGUIDs to themselves.
 Like a family secret.

@@ Line 76: / Line 76: @@
 ==Media ID==
 The media ID in Truxton is based on time.
 A clock tick is six hours.
 The rollover will happen September 18, 2061.
 Example:

@@ Line 57: / Line 57: @@
 ===Field A===
-The first field is a [https://en.wikipedia.org/wiki/Endianness big endian] representation of a [https://en.wikipedia.org/wiki/Unix_time Unix timestamp].
+The first field is a [https://en.wikipedia.org/wiki/Endianness big endian] representation of a [https://en.wikipedia.org/wiki/Unix_time Unix timestamp] of when the process that generated this identifier was started.
 <code>5da98fe7</code> is 1,571,393,511 seconds since January 1, 1970 or October 18, 2019 10:11:51 AM.
 This makes it possible to construct a query to find out what was loaded on a particular date.

@@ Line 7: / Line 7: @@
 =In Memory Layout=
 A TGUID differs from [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] in that the string/logical value of a TGUID is the same as the series of bytes in memory.
-Think of it as a 128-bit [https://en.wikipedia.org/wiki/Endianness big-endian] in RAM.
+Think of it as a 128-bit [https://en.wikipedia.org/wiki/Endianness big-endian] integer in RAM.
 Consider the following bytes as they appear in RAM:

@@ Line 158: / Line 158: @@
 Using this information, you can attach a debugger to the machine using the IP address and debug the process using the process id and thread id.
 From our example:
-<syntaxhighlight lang="CMD">
+<syntaxhighlight lang="bat">
 C:\> mydbg /ip:192.168.1.14 /pid:31172
 </syntaxhighlight>