Difference between revisions of "Black Box"

From truxwiki.com
Jump to navigation Jump to search
 
(14 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
The Truxton ETL processes have a "black box" that contains information about the process.
+
The Truxton ETL processes have a "black box recorder" that contains information about the process.
−
It is a process equivalent of an [https://en.wikipedia.org/wiki/Flight_recorder aircraft black box].
+
It is equivalent to an [https://en.wikipedia.org/wiki/Flight_recorder aircraft black box].
 
The contents are dumped upon request to an [https://en.wikipedia.org/wiki/XML XML] file.
 
The contents are dumped upon request to an [https://en.wikipedia.org/wiki/XML XML] file.
 +
 +
=Description=
 +
The purpose of the black box is to aid in debugging exploitation programs.
 +
It is a bag of clues that will tell programmers what a program was doing, where in the source code it was, what file it was processing, what media the file came from, etc.
 +
 +
=Contents=
 +
The black box is a place where values can be stored on a per thread basis.
 +
 +
==Thread Information==
 +
Every thread in a process gets a black box.
 +
Here are the items stored per thread:
 +
 +
* Thread id - the thread's operating system [https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getcurrentthreadid id]
 +
* Type - Set by Truxton and will usually be 0xB58F0316910A765C (Worker Thread) which is where your code runs
 +
* fileid - The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the [[TGUID#File_ID|file]] currently being processed. This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
 +
* lastfileid - The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the [[TGUID#File_ID|file]] previously processed. This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
 +
* mediaid - The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media that contains the file being processed. This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table.
 +
* lastmediaid - The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media of the last file processed. This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table.
 +
* activity
 +
* lastactivity
 +
* flushloopcount
 +
* sourcecodefile - An integer representing the name of the source code file containing the code currently being executed. It is set using the <code>[[truxton_set_black_box_source_code_location]]()</code>
 +
* linenumber - An integer representing the line number of the source code file containing the code currently being executed. It is set using the <code>[[truxton_set_black_box_source_code_location]]()</code>
 +
* lastupdate
 +
* lastupdatesecondsago
 +
* laststatusmediaid
 +
* laststatusmessage
 +
* getmessagecount
 +
 +
==Slots==
 +
There are 20 slots where information can be stored.
 +
* Slot Number - An index value from 0 to 19
 +
* value - The integer value the programmer chose to store
 +
* sourcecodefile - An integer that uniquely identifies the full path to the source code file
 +
* linenumber - The line number in the source code file
  
 
=Dump File Location=
 
=Dump File Location=
  
−
The state information will be written to a file in a folder named "<code>Truxton\\Debug Dumps</code>" with a timestamp and process id in the filename.
+
The state information will be written to a file in a folder named "<code>Truxton\Debug Dumps</code>" with a timestamp and process id in the filename.
 
If the <code>[[Configuration System|logdir]]</code> option was not set, the root folder for the dump folder will be in the Program Data folder, usually the hidden <code>C:\ProgramData</code> folder.
 
If the <code>[[Configuration System|logdir]]</code> option was not set, the root folder for the dump folder will be in the Program Data folder, usually the hidden <code>C:\ProgramData</code> folder.
  
 
==Examples==
 
==Examples==
−
If <code>[[Configuration System|logdir]]</code> was set to "<code>E:\Logs\</code>" then the dump file would be something like this:
+
===Individual Process===
−
<code>E:\Logs\Truxton\\Debug Dumps\\"
+
If an individual process was told to dump its state and <code>[[Configuration System|logdir]]</code> was set to "<code>E:\Logs\</code>" then the dump file would be something like this:<br />
 +
<code>E:\Logs\Truxton\Debug Dumps\20230523_174359_Process_1234_DebugDump.xml</code>
 +
 
 +
Notice there is a separate section for process names and process data.
 +
This was done to preserve proprietary code.
 +
If you add your own ETL to Truxton and it continues to blow up and need our help.
 +
You can remove that one line with the process name leaving nothing but raw data in the process data section.
 +
This allow us to assist in debugging without you having to risk proprietary code being compromised.
 +
 
 +
For example:
 +
<source lang="XML">
 +
<processnames>
 +
<process name="MagneCelleGrayUndocumentedCPUJumpImplant.exe" id="10020" hex_id="2724"></process>
 +
</processnames>
 +
</source>
 +
 
 +
=Sample=
 +
<source lang="XML">
 +
<?xml version="1.0" standalone="yes"?>
 +
<blackbox>
 +
  <processnames>
 +
  <process name="Carve.exe" id="10020" hex_id="2724"></process>
 +
  </processnames>
 +
  <process id="10020">
 +
  <pid hex="2724">10020</pid>
 +
  <version hex="400030002C67D">1125912791926397</version>
 +
  <appid>D7A8523A-B560-9921-A3D4-E1C7EE0A5C71</appid>
 +
  <etlid>0400F4FD-0027-2400-2728-192168079001</etlid>
 +
  <numberofthreads hex="3">3</numberofthreads>
 +
  <shutdowncode>0</shutdowncode>
 +
  <thread>
 +
    <id hex="2728">10024</id>
 +
    <type hex="864A6C3021DEE249" meaning="ETL Application Initialization">9676665703341417033</type>
 +
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
 +
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
 +
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
 +
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
 +
    <lastmessagereceived filetime="134154863347206566">2026-02-13T19:58:54.720656Z</lastmessagereceived>
 +
    <lastmessagereceivedsecondsago ticks="54210659">5</lastmessagereceivedsecondsago>
 +
    <activity hex="5A5A5A5A5A5A5A5A">6510615555426900570</activity>
 +
    <activitymeaning>ETL_IS_SLEEPING</activitymeaning>
 +
    <lastactivity hex="2121212121212121">2387225703656530209</lastactivity>
 +
    <lastactivitymeaning>ETL_IS_AWAKE</lastactivitymeaning>
 +
    <lastactivitychange filetime="134154863347357460">2026-02-13T19:58:54.735746Z</lastactivitychange>
 +
    <lastactivitychangesecondsago ticks="54059765">5</lastactivitychangesecondsago>
 +
    <flushloopcount hex="0">0</flushloopcount>
 +
    <sourcecodefile hex="413390373CE0">71689718676704</sourcecodefile>
 +
    <linenumber hex="16A">362</linenumber>
 +
    <lastupdate filetime="134154863347357529">2026-02-13T19:58:54.735752Z</lastupdate>
 +
    <lastupdatesecondsago ticks="54059696">5</lastupdatesecondsago>
 +
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
 +
    <laststatusmessage hex="0">0</laststatusmessage>
 +
    <getmessagecount hex="0">0</getmessagecount>
 +
    <slot19>
 +
    <value hex="5">5</value>
 +
    <sourcecodefile hex="37E115A35D59">61439870197081</sourcecodefile>
 +
    <linenumber hex="2DF">735</linenumber>
 +
    </slot19>
 +
    <slot20>
 +
    <value hex="5">5</value>
 +
    <sourcecodefile hex="37E715A35D59">61465640000857</sourcecodefile>
 +
    <linenumber hex="2E8">744</linenumber>
 +
    </slot20>
 +
    <slot21>
 +
    <value hex="3517">13591</value>
 +
    <sourcecodefile hex="B5DED720B255">199968696611413</sourcecodefile>
 +
    <linenumber hex="CCB">3275</linenumber>
 +
    </slot21>
 +
    <slot22>
 +
    <value hex="C18E7AD1D5CF99C0">13947220137666910656</value>
 +
    <sourcecodefile hex="37E415A35D59">61452755098969</sourcecodefile>
 +
    <linenumber hex="A6F">2671</linenumber>
 +
    </slot22>
 +
    <slot23>
 +
    <value hex="400030002C67D">1125912791926397</value>
 +
    <sourcecodefile hex="11EA50DC90539CF9">1290933151439494393</sourcecodefile>
 +
    <linenumber hex="3A2">930</linenumber>
 +
    </slot23>
 +
  </thread>
 +
  <thread>
 +
    <id hex="CBC">3260</id>
 +
    <type hex="6269583026F5D7FC" meaning="Database Record Committer">7091296052106876924</type>
 +
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
 +
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
 +
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
 +
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
 +
    <activity hex="0">0</activity>
 +
    <lastactivity hex="0">0</lastactivity>
 +
    <flushloopcount hex="0">0</flushloopcount>
 +
    <sourcecodefile hex="519EDE414A33">89742775503411</sourcecodefile>
 +
    <linenumber hex="655">1621</linenumber>
 +
    <lastupdate filetime="134154863347213036">2026-02-13T19:58:54.721303Z</lastupdate>
 +
    <lastupdatesecondsago ticks="54204189">5</lastupdatesecondsago>
 +
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
 +
    <laststatusmessage hex="0">0</laststatusmessage>
 +
    <getmessagecount hex="0">0</getmessagecount>
 +
    <slot2>
 +
    <value hex="1">1</value>
 +
    <sourcecodefile hex="C67849122549">218219924301129</sourcecodefile>
 +
    <linenumber hex="31C">796</linenumber>
 +
    </slot2>
 +
    <slot19>
 +
    <value hex="2717">10007</value>
 +
    <sourcecodefile hex="529EDE414A33">90842287131187</sourcecodefile>
 +
    <linenumber hex="656">1622</linenumber>
 +
    </slot19>
 +
    <slot20>
 +
    <value hex="0">0</value>
 +
    <sourcecodefile hex="5A9EDE414A33">99638380153395</sourcecodefile>
 +
    <linenumber hex="5B7">1463</linenumber>
 +
    </slot20>
 +
  </thread>
 +
  <thread>
 +
    <id hex="24BC">9404</id>
 +
    <type hex="6269583026F5D7FC" meaning="Database Record Committer">7091296052106876924</type>
 +
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
 +
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
 +
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
 +
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
 +
    <activity hex="0">0</activity>
 +
    <lastactivity hex="0">0</lastactivity>
 +
    <flushloopcount hex="0">0</flushloopcount>
 +
    <sourcecodefile hex="62941319B550">108388115133776</sourcecodefile>
 +
    <linenumber hex="AD">173</linenumber>
 +
    <lastupdate filetime="134154863396551305">2026-02-13T19:58:59.65513Z</lastupdate>
 +
    <lastupdatesecondsago ticks="4865920">0</lastupdatesecondsago>
 +
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
 +
    <laststatusmessage hex="0">0</laststatusmessage>
 +
    <getmessagecount hex="0">0</getmessagecount>
 +
    <slot2>
 +
    <value hex="2">2</value>
 +
    <sourcecodefile hex="C67849122549">218219924301129</sourcecodefile>
 +
    <linenumber hex="31C">796</linenumber>
 +
    </slot2>
 +
  </thread>
 +
  </process>
 +
</blackbox>
 +
</source>

Latest revision as of 08:01, 20 February 2026

The Truxton ETL processes have a "black box recorder" that contains information about the process. It is equivalent to an aircraft black box. The contents are dumped upon request to an XML file.

Description

The purpose of the black box is to aid in debugging exploitation programs. It is a bag of clues that will tell programmers what a program was doing, where in the source code it was, what file it was processing, what media the file came from, etc.

Contents

The black box is a place where values can be stored on a per thread basis.

Thread Information

Every thread in a process gets a black box. Here are the items stored per thread:

  • Thread id - the thread's operating system id
  • Type - Set by Truxton and will usually be 0xB58F0316910A765C (Worker Thread) which is where your code runs
  • fileid - The GUID of the file currently being processed. This corresponds to the [ID] column of the [File] table.
  • lastfileid - The GUID of the file previously processed. This corresponds to the [ID] column of the [File] table.
  • mediaid - The GUID of the media that contains the file being processed. This corresponds to the [ID] column of the [Media] table.
  • lastmediaid - The GUID of the media of the last file processed. This corresponds to the [ID] column of the [Media] table.
  • activity
  • lastactivity
  • flushloopcount
  • sourcecodefile - An integer representing the name of the source code file containing the code currently being executed. It is set using the truxton_set_black_box_source_code_location()
  • linenumber - An integer representing the line number of the source code file containing the code currently being executed. It is set using the truxton_set_black_box_source_code_location()
  • lastupdate
  • lastupdatesecondsago
  • laststatusmediaid
  • laststatusmessage
  • getmessagecount

Slots

There are 20 slots where information can be stored.

  • Slot Number - An index value from 0 to 19
  • value - The integer value the programmer chose to store
  • sourcecodefile - An integer that uniquely identifies the full path to the source code file
  • linenumber - The line number in the source code file

Dump File Location

The state information will be written to a file in a folder named "Truxton\Debug Dumps" with a timestamp and process id in the filename. If the logdir option was not set, the root folder for the dump folder will be in the Program Data folder, usually the hidden C:\ProgramData folder.

Examples

Individual Process

If an individual process was told to dump its state and logdir was set to "E:\Logs\" then the dump file would be something like this:
E:\Logs\Truxton\Debug Dumps\20230523_174359_Process_1234_DebugDump.xml

Notice there is a separate section for process names and process data. This was done to preserve proprietary code. If you add your own ETL to Truxton and it continues to blow up and need our help. You can remove that one line with the process name leaving nothing but raw data in the process data section. This allow us to assist in debugging without you having to risk proprietary code being compromised.

For example: 

<processnames>
 <process name="MagneCelleGrayUndocumentedCPUJumpImplant.exe" id="10020" hex_id="2724"></process>
</processnames>

Sample

<?xml version="1.0" standalone="yes"?>
 <blackbox>
  <processnames>
   <process name="Carve.exe" id="10020" hex_id="2724"></process>
  </processnames>
  <process id="10020">
   <pid hex="2724">10020</pid>
   <version hex="400030002C67D">1125912791926397</version>
   <appid>D7A8523A-B560-9921-A3D4-E1C7EE0A5C71</appid>
   <etlid>0400F4FD-0027-2400-2728-192168079001</etlid>
   <numberofthreads hex="3">3</numberofthreads>
   <shutdowncode>0</shutdowncode>
   <thread>
    <id hex="2728">10024</id>
    <type hex="864A6C3021DEE249" meaning="ETL Application Initialization">9676665703341417033</type>
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
    <lastmessagereceived filetime="134154863347206566">2026-02-13T19:58:54.720656Z</lastmessagereceived>
    <lastmessagereceivedsecondsago ticks="54210659">5</lastmessagereceivedsecondsago>
    <activity hex="5A5A5A5A5A5A5A5A">6510615555426900570</activity>
    <activitymeaning>ETL_IS_SLEEPING</activitymeaning>
    <lastactivity hex="2121212121212121">2387225703656530209</lastactivity>
    <lastactivitymeaning>ETL_IS_AWAKE</lastactivitymeaning>
    <lastactivitychange filetime="134154863347357460">2026-02-13T19:58:54.735746Z</lastactivitychange>
    <lastactivitychangesecondsago ticks="54059765">5</lastactivitychangesecondsago>
    <flushloopcount hex="0">0</flushloopcount>
    <sourcecodefile hex="413390373CE0">71689718676704</sourcecodefile>
    <linenumber hex="16A">362</linenumber>
    <lastupdate filetime="134154863347357529">2026-02-13T19:58:54.735752Z</lastupdate>
    <lastupdatesecondsago ticks="54059696">5</lastupdatesecondsago>
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
    <laststatusmessage hex="0">0</laststatusmessage>
    <getmessagecount hex="0">0</getmessagecount>
    <slot19>
     <value hex="5">5</value>
     <sourcecodefile hex="37E115A35D59">61439870197081</sourcecodefile>
     <linenumber hex="2DF">735</linenumber>
    </slot19>
    <slot20>
     <value hex="5">5</value>
     <sourcecodefile hex="37E715A35D59">61465640000857</sourcecodefile>
     <linenumber hex="2E8">744</linenumber>
    </slot20>
    <slot21>
     <value hex="3517">13591</value>
     <sourcecodefile hex="B5DED720B255">199968696611413</sourcecodefile>
     <linenumber hex="CCB">3275</linenumber>
    </slot21>
    <slot22>
     <value hex="C18E7AD1D5CF99C0">13947220137666910656</value>
     <sourcecodefile hex="37E415A35D59">61452755098969</sourcecodefile>
     <linenumber hex="A6F">2671</linenumber>
    </slot22>
    <slot23>
     <value hex="400030002C67D">1125912791926397</value>
     <sourcecodefile hex="11EA50DC90539CF9">1290933151439494393</sourcecodefile>
     <linenumber hex="3A2">930</linenumber>
    </slot23>
   </thread>
   <thread>
    <id hex="CBC">3260</id>
    <type hex="6269583026F5D7FC" meaning="Database Record Committer">7091296052106876924</type>
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
    <activity hex="0">0</activity>
    <lastactivity hex="0">0</lastactivity>
    <flushloopcount hex="0">0</flushloopcount>
    <sourcecodefile hex="519EDE414A33">89742775503411</sourcecodefile>
    <linenumber hex="655">1621</linenumber>
    <lastupdate filetime="134154863347213036">2026-02-13T19:58:54.721303Z</lastupdate>
    <lastupdatesecondsago ticks="54204189">5</lastupdatesecondsago>
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
    <laststatusmessage hex="0">0</laststatusmessage>
    <getmessagecount hex="0">0</getmessagecount>
    <slot2>
     <value hex="1">1</value>
     <sourcecodefile hex="C67849122549">218219924301129</sourcecodefile>
     <linenumber hex="31C">796</linenumber>
    </slot2>
    <slot19>
     <value hex="2717">10007</value>
     <sourcecodefile hex="529EDE414A33">90842287131187</sourcecodefile>
     <linenumber hex="656">1622</linenumber>
    </slot19>
    <slot20>
     <value hex="0">0</value>
     <sourcecodefile hex="5A9EDE414A33">99638380153395</sourcecodefile>
     <linenumber hex="5B7">1463</linenumber>
    </slot20>
   </thread>
   <thread>
    <id hex="24BC">9404</id>
    <type hex="6269583026F5D7FC" meaning="Database Record Committer">7091296052106876924</type>
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
    <activity hex="0">0</activity>
    <lastactivity hex="0">0</lastactivity>
    <flushloopcount hex="0">0</flushloopcount>
    <sourcecodefile hex="62941319B550">108388115133776</sourcecodefile>
    <linenumber hex="AD">173</linenumber>
    <lastupdate filetime="134154863396551305">2026-02-13T19:58:59.65513Z</lastupdate>
    <lastupdatesecondsago ticks="4865920">0</lastupdatesecondsago>
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
    <laststatusmessage hex="0">0</laststatusmessage>
    <getmessagecount hex="0">0</getmessagecount>
    <slot2>
     <value hex="2">2</value>
     <sourcecodefile hex="C67849122549">218219924301129</sourcecodefile>
     <linenumber hex="31C">796</linenumber>
    </slot2>
   </thread>
  </process>
 </blackbox>
Retrieved from "https://truxwiki.com/index.php?title=Black_Box&oldid=10813"