Truxton child file create event - Revision history

Sam at 08:20, 13 February 2021

2021-02-13T08:20:14Z

Sam at 13:22, 10 November 2020

2020-11-10T13:22:10Z

Sam: /* Sample */

2020-06-09T12:55:49Z

Sample

Sam: /* Sample */

2020-06-08T20:31:29Z

Sample

Sam at 17:27, 8 June 2020

2020-06-08T17:27:40Z

Sam at 17:17, 8 June 2020

2020-06-08T17:17:43Z

Sam: Created page with "This creates an avent from this file that you can use in the Event API. An artifact object is how you add records to the `[[Event Table | Event]..."`


2020-06-08T17:08:53Z
Created page with "This creates an avent from this file that you can use in the  Event API. An artifact object is how you add records to the <code>[[Event Table | Event]..."
New page
This creates an avent from this file that you can use in the [[Truxton C API#Event | Event API.]]

An artifact object is how you add records to the <code>[[Event Table | Event]]</code> table.

The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to.



=Syntax=

<syntaxhighlight lang="C">

uint64_t truxton_child_file_create_event( uint64_t child_handle );

</syntaxhighlight>



=Parameters=

==<code>child_handle</code>==



The handle created by the [[truxton_child_file_create]] or [[truxton_file_create_child]] call.



=Return value=

A handle to an event object.

=Sample=



<syntaxhighlight lang="C" highlight="26">

void add_folder(uint64_t truxton, uint64_t parent_file)

{

   truxton_start_adding_files(truxton);



   uint64_t child = truxton_child_file_create(truxton);



   char id[40];



   truxton_file_get_id(parent_file, id, sizeof(id));

   truxton_child_file_set_parent_id(child, id);

   truxton_child_file_set_type(child, Type_Directory);

   truxton_child_file_set_name(child, "Custom Exploits Folder");



   truxton_child_file_set_origin(child, ORIGIN_GENERATED);



   if ( truxton_child_file_save(child) == 0 )

   {

      printf( "Failed to add child to Truxton\n" );

   }

   else

   {

      ticks.QuadPart = truxton_child_file_get_disk_offset(child_file);

      printf( "Physical Disk Offset was %d\n", ticks.QuadPart );

   }



   uint64_t event = truxton_child_file_create_event(child);



   truxton_event_set_type(event, EVENT_TYPE_POSSIBLE_INFECTION);

   truxton_event_set_start(artifact, truxton_file_get_created( parent_file ) );

   truxton_event_set_end(event, truxton_file_get_modified( parent_file ) );

   truxton_event_set_title(event, "Fancy Bear Panda Hurricane" );

   truxton_event_set_description(event, "Russian Malware repurposed by Chinese military used in FBI investigation" );

   truxton_event_save(event);



   truxton_child_file_destroy(child);

}

</syntaxhighlight>

@@ Line 1: / Line 1: @@
 This creates an event from this file that you can use in the [[Truxton C API#Event | Event API.]]
-An event object is how you add records to the <code>[[Event Table | Event]]</code> table.
+An event object is how you add records to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
 The resulting event object will automatically be associated with the file it was created from and with the media the file belongs to.
 =Syntax=
-<syntaxhighlight lang="C">
+<source lang="C">
 uint64_t truxton_child_file_create_event( uint64_t child_handle );
-</syntaxhighlight>
+</source>
 =Parameters=
@@ Line 17: / Line 17: @@
 =Sample=
-<syntaxhighlight lang="C" highlight="21">
+<source lang="C" highlight="21">
 void add_folder(uint64_t truxton, uint64_t parent_file)
+{
@@ Line 50: / Line 50: @@
     truxton_child_file_destroy(child);
+}
-</syntaxhighlight>
+</source>

Truxton child file create event - Revision history

Sam at 08:20, 13 February 2021

Sam at 13:22, 10 November 2020

Sam: /* Sample */

Sam: /* Sample */

Sam at 17:27, 8 June 2020

Sam at 17:17, 8 June 2020

Sam: Created page with "This creates an avent from this file that you can use in the Event API. An artifact object is how you add records to the [[Event Table | Event]..."

Sam: Created page with "This creates an avent from this file that you can use in the Event API. An artifact object is how you add records to the `[[Event Table | Event]..."`