Developer's Guide

Truxton Developer's Guide

• How Truxton Works - High level overview
• Truxton SDK - For developing software with Truxton
• Debugging Tips
• UI - Truxton Analyst - Dev Guide

Truxton Stuff (A collection of developer's information on a variety of topics)

• Database Tables - A detailed look at several of Truxton's tables
• Add A New File Type - How to add a new file type to Truxton and exploit it
• Useful SQL Queries - Sample queries for accessing Truxton from a SQL tool (like dBeaver)
• Configuration System - All the different ways to configure Truxton
• TruxtonService.xml - The configuration file for the Truxton Service
• ETL Stages - What do they mean?
• Truxton URL Interface - For linking to Truxton
• How to Secure Truxton Services - If you need Truxton to run on a locked down machine
• Turn on Syslogging - Truxton can use syslog to send tremendous amounts of debugging data
• Watch Desktop Logs - Get a scrolling text view of logs
• Temporary Filenames - How to identify the source of temporary files
• Message Bus Drivers - How Truxton can be message queue technology agnostic
• Azure - Running Truxton on and engaging Azure services
• Debugging the Loader - Not that you'd ever need to...
• VC Redistributables - Where to get the latest version of C and .Net runtime libraries
• Message Bus Messages - The different messages that can be sent
• Load Validation - How to independently validate that Truxton is working correctly
• Identifying Databases - How Truxton identifies specific file types from generic databases
• Black Box - Using Truxton's Debugging Black Box
• Enable Crash Dumps - How to have Windows generate a dump file if a process crashes

Truxton File Formats

• Depot file format - The way Truxton stores file contents
• Load List file format - Details on the load script format

Data Types

Truxton uses lots of defined constants and enums. Here's a list of them.

• Carve Options - The meaning of carving option flags
• Content Status - The status of the contents of a file.
• Data Types - How the bytes in a file can be interpreted.
• Depot Types - The different types of data that can be stored in a depot.
• Depot Status - The different statuses of a depot.
• Entity Types - The types of artifacts in Truxton
• ETL Application Modes - The different modes of operation you can use in an ETL application
• Event Types - The types of events in Truxton
• File Export Criteria - The different criteria you can specify in the C API for exporting files
• File Export Options - The different options you can specify in the C API for exporting files
• Group Status - The status of groups
• Group Types - The types of groups
• File Content Origins - Tells you where the file contents came from
• Investigation Statuses - The different statuses of generic investigation
• Investigation Event Types - The types of investigation events
• Investigation Types - Some default types of investigations
• Load Configurations - The default paths media can take through the exploitation process.
• Location Types - The different types of geographic locations
• Media Load Percentage - A discussion about what the percent-complete value means during loading
• Media Status - The different states that media can be in
• Media Types - The formats of media that Truxton can ingest
• Message Participants - The types of participants in a communication
• Message Types - The different types of message that Truxton handles
• Object Types - The types of objects in Truxton
• Origin - Where files come from
• Relation Types - The types of relationships between objects that Truxton supports
• URL Methods - The different reasons why a URL was retrieved
• URL Types - The types of URLs

Exploitation Hints

• File Format Research - Where to find details on files to exploit
• SQLite Queries
• Time Epochs

Code Dependencies

• vcpkg
• Win32 Foundation Classes
• VC Runtime redistributables aka VC REDIST, aka vc_redist, aka vc_redist.x64.exe

Integrated APIs

• Flashpoint API
• Whooster API