Difference between revisions of "Developer's Guide"
Jump to navigation
Jump to search
| (44 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
=Truxton Developer's Guide= | =Truxton Developer's Guide= | ||
| + | * [[How Truxton Works]] - High level overview | ||
| + | * [[Truxton SDK]] - For developing software with Truxton | ||
| + | * [[Debugging Tips]] | ||
| + | * [[UI - Truxton Analyst - Dev Guide]] | ||
| − | [[How to | + | =Truxton Stuff (A collection of developer's information on a variety of topics)= |
| + | * [[Database Tables]] - A detailed look at several of Truxton's tables | ||
| + | * [[Add A New File Type]] - How to add a new file type to Truxton and exploit it | ||
| + | * [[Useful SQL Queries]] - Sample queries for accessing Truxton from a SQL tool (like [https://dbeaver.io/ dBeaver]) | ||
| + | * [[Configuration System]] - All the different ways to configure Truxton | ||
| + | * [[TruxtonService.xml]] - The configuration file for the Truxton Service | ||
| + | * [[ETL Stages]] - What do they mean? | ||
| + | * [[Truxton URL Interface]] - For linking to Truxton | ||
| + | * [[Secure Truxton|How to Secure Truxton Services]] - If you need Truxton to run on a locked down machine | ||
| + | * [[Turn on Syslogging]] - Truxton can use [https://en.wikipedia.org/wiki/Syslog syslog] to send tremendous amounts of debugging data | ||
| + | * [[Watch Desktop Logs]] - Get a scrolling text view of logs | ||
| + | * [[Temporary Filenames]] - How to identify the source of temporary files | ||
| + | * [[Message Bus Drivers]] - How Truxton can be message queue technology agnostic | ||
| + | * [[Azure]] - Running Truxton on and engaging Azure services | ||
| + | * [[Debugging the Loader]] - Not that you'd ever need to... | ||
| + | * [[VC Redistributables]] - Where to get the latest version of C and .Net runtime libraries | ||
| + | * [[Message Bus Messages]] - The different messages that can be sent | ||
| + | * [[Load Validation]] - How to independently validate that Truxton is working correctly | ||
| + | * [[Identifying Databases]] - How Truxton identifies specific file types from generic databases | ||
| + | * [[Black Box]] - Using Truxton's Debugging Black Box | ||
| + | * [[Enable Crash Dumps]] - How to have Windows generate a dump file if a process crashes | ||
| − | =Truxton | + | =Truxton File Formats= |
| − | + | * [[Depot]] file format - The way Truxton stores file contents | |
| − | + | * [[Load List]] file format - Details on the load script format | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | * [[Depot]] file format | ||
| − | * [[Load List]] file format | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
=Data Types= | =Data Types= | ||
| Line 29: | Line 35: | ||
Here's a list of them. | Here's a list of them. | ||
| + | * [[Carve Options]] - The meaning of carving option flags | ||
* [[Content Status]] - The status of the contents of a file. | * [[Content Status]] - The status of the contents of a file. | ||
* [[DATA TYPE|Data Types]] - How the bytes in a file can be interpreted. | * [[DATA TYPE|Data Types]] - How the bytes in a file can be interpreted. | ||
* [[Depot Types]] - The different types of data that can be stored in a depot. | * [[Depot Types]] - The different types of data that can be stored in a depot. | ||
| − | * [[Entity Types]] | + | * [[Depot Status]] - The different statuses of a depot. |
| − | * [[Event Types]] | + | * [[Entity Types]] - The types of artifacts in Truxton |
| − | * [[Investigation Statuses]] | + | * [[ETL Application Modes]] - The different modes of operation you can use in an ETL application |
| − | * [[Investigation Types]] | + | * [[Event Types]] - The types of events in Truxton |
| − | * [[Location Types]] | + | * [[File Export Criteria]] - The different criteria you can specify in the C API for exporting files |
| − | * [[Media Load Percentage]] | + | * [[File Export Options]] - The different options you can specify in the C API for exporting files |
| − | * [[Media Status]] | + | * [[File Types Supported|File Types]] - The different types of files that Truxton knows about |
| − | * [[Media Types]] | + | * [[Group Status]] - The status of groups |
| − | * [[Message Types]] | + | * [[Group Types]] - The types of groups |
| − | * [[Object Types]] | + | * [[Origin|File Content Origins]] - Tells you where the file contents came from |
| − | * [[Origin | + | * [[Investigation Statuses]] - The different statuses of generic investigation |
| − | * [[Relation Types]] | + | * [[Investigation Event Types]] - The types of investigation events |
| − | * [[URL Methods]] | + | * [[Investigation Types]] - Some default types of investigations |
| − | * [[URL Types]] | + | * [[Load Configurations]] - The default paths media can take through the exploitation process. |
| + | * [[Location Types]] - The different types of geographic locations | ||
| + | * [[Media Load Percentage]] - A discussion about what the percent-complete value means during loading | ||
| + | * [[Media Status]] - The different states that media can be in | ||
| + | * [[Media Types]] - The formats of media that Truxton can ingest | ||
| + | * [[Message Participants]] - The types of participants in a communication | ||
| + | * [[Message Types]] - The different types of message that Truxton handles | ||
| + | * [[Object Types]] - The types of objects in Truxton | ||
| + | * [[Origin]] - Where files come from | ||
| + | * [[Relation Types]] - The types of relationships between objects that Truxton supports | ||
| + | * [[URL Methods]] - The different reasons why a URL was retrieved | ||
| + | * [[URL Types]] - The types of URLs | ||
| − | =Exploitation= | + | =Exploitation Hints= |
| − | * [[File Format Research]] | + | * [[File Format Research]] - Where to find details on files to exploit |
* [[SQLite Queries]] | * [[SQLite Queries]] | ||
* [[Time Epochs]] | * [[Time Epochs]] | ||
| Line 55: | Line 73: | ||
* [[vcpkg]] | * [[vcpkg]] | ||
* [https://github.com/SammyB428/WFC Win32 Foundation Classes] | * [https://github.com/SammyB428/WFC Win32 Foundation Classes] | ||
| + | * [https://support.microsoft.com/en-us/topic/the-latest-supported-visual-c-downloads-2647da03-1eea-4433-9aff-95f26a218cc0 VC Runtime redistributables] aka VC REDIST, aka vc_redist, aka vc_redist.x64.exe | ||
| + | |||
| + | =Integrated APIs= | ||
| + | * [[Flashpoint API]] | ||
| + | * [[Whooster API]] | ||
Latest revision as of 06:41, 16 August 2025
Contents
Truxton Developer's Guide
- How Truxton Works - High level overview
- Truxton SDK - For developing software with Truxton
- Debugging Tips
- UI - Truxton Analyst - Dev Guide
Truxton Stuff (A collection of developer's information on a variety of topics)
- Database Tables - A detailed look at several of Truxton's tables
- Add A New File Type - How to add a new file type to Truxton and exploit it
- Useful SQL Queries - Sample queries for accessing Truxton from a SQL tool (like dBeaver)
- Configuration System - All the different ways to configure Truxton
- TruxtonService.xml - The configuration file for the Truxton Service
- ETL Stages - What do they mean?
- Truxton URL Interface - For linking to Truxton
- How to Secure Truxton Services - If you need Truxton to run on a locked down machine
- Turn on Syslogging - Truxton can use syslog to send tremendous amounts of debugging data
- Watch Desktop Logs - Get a scrolling text view of logs
- Temporary Filenames - How to identify the source of temporary files
- Message Bus Drivers - How Truxton can be message queue technology agnostic
- Azure - Running Truxton on and engaging Azure services
- Debugging the Loader - Not that you'd ever need to...
- VC Redistributables - Where to get the latest version of C and .Net runtime libraries
- Message Bus Messages - The different messages that can be sent
- Load Validation - How to independently validate that Truxton is working correctly
- Identifying Databases - How Truxton identifies specific file types from generic databases
- Black Box - Using Truxton's Debugging Black Box
- Enable Crash Dumps - How to have Windows generate a dump file if a process crashes
Truxton File Formats
- Depot file format - The way Truxton stores file contents
- Load List file format - Details on the load script format
Data Types
Truxton uses lots of defined constants and enums. Here's a list of them.
- Carve Options - The meaning of carving option flags
- Content Status - The status of the contents of a file.
- Data Types - How the bytes in a file can be interpreted.
- Depot Types - The different types of data that can be stored in a depot.
- Depot Status - The different statuses of a depot.
- Entity Types - The types of artifacts in Truxton
- ETL Application Modes - The different modes of operation you can use in an ETL application
- Event Types - The types of events in Truxton
- File Export Criteria - The different criteria you can specify in the C API for exporting files
- File Export Options - The different options you can specify in the C API for exporting files
- File Types - The different types of files that Truxton knows about
- Group Status - The status of groups
- Group Types - The types of groups
- File Content Origins - Tells you where the file contents came from
- Investigation Statuses - The different statuses of generic investigation
- Investigation Event Types - The types of investigation events
- Investigation Types - Some default types of investigations
- Load Configurations - The default paths media can take through the exploitation process.
- Location Types - The different types of geographic locations
- Media Load Percentage - A discussion about what the percent-complete value means during loading
- Media Status - The different states that media can be in
- Media Types - The formats of media that Truxton can ingest
- Message Participants - The types of participants in a communication
- Message Types - The different types of message that Truxton handles
- Object Types - The types of objects in Truxton
- Origin - Where files come from
- Relation Types - The types of relationships between objects that Truxton supports
- URL Methods - The different reasons why a URL was retrieved
- URL Types - The types of URLs
Exploitation Hints
- File Format Research - Where to find details on files to exploit
- SQLite Queries
- Time Epochs
Code Dependencies
- vcpkg
- Win32 Foundation Classes
- VC Runtime redistributables aka VC REDIST, aka vc_redist, aka vc_redist.x64.exe
