Black Box

The Truxton ETL processes have a "black box recorder" that contains information about the process. It is a process equivalent of an aircraft black box. The contents are dumped upon request to an XML file.

Description

The purpose of the black box is to aid in debugging exploitation programs. It is a bag of clues that will tell programmers what a program was doing, where in the source code it was, what file it was processing, what media the file came from, etc.

Contents

The black box is a place where values can be stored on a per thread basis.

Thread Information

Every thread in a process gets a black box. Here are the items stored per thread:

• Thread id - the thread's operating system id
• Type - Set by Truxton and will usually be 0xB58F0316910A765C (Worker Thread) which is where your code runs
• fileid - The GUID of the file currently being processed. This corresponds to the [ID] column of the [File] table.
• lastfileid - The GUID of the file previously processed. This corresponds to the [ID] column of the [File] table.
• mediaid - The GUID of the media that contains the file being processed. This corresponds to the [ID] column of the [Media] table.
• lastmediaid - The GUID of the media of the last file processed. This corresponds to the [ID] column of the [Media] table.
• activity
• lastactivity
• flushloopcount
• sourcecodefile - An integer representing the name of the source code file containing the code currently being executed. It is set using the truxton_set_black_box_source_code_location()
• linenumber - An integer representing the line number of the source code file containing the code currently being executed. It is set using the truxton_set_black_box_source_code_location()
• lastupdate
• lastupdatesecondsago
• laststatusmediaid
• laststatusmessage
• getmessagecount

Slots

There are 20 slots where information can be stored.

• Slot Number
• value
• sourcecodefile
• linenumber

Dump File Location

The state information will be written to a file in a folder named "Truxton\\Debug Dumps" with a timestamp and process id in the filename. If the logdir option was not set, the root folder for the dump folder will be in the Program Data folder, usually the hidden C:\ProgramData folder.

Examples

Individual Process

If an indevidual process was told to dump its state and logdir was set to "E:\Logs\" then the dump file would be something like this:
E:\Logs\Truxton\\Debug Dumps\\20230523_174359_Process_1234_DebugDump.xml