Difference between revisions of "Truxton child file create artifact"
Jump to navigation
Jump to search
(→Sample) |
|||
| Line 1: | Line 1: | ||
This creates an artifact from this file that you can use in the [[Truxton C API#Artifacts | Artifact API.]] | This creates an artifact from this file that you can use in the [[Truxton C API#Artifacts | Artifact API.]] | ||
| − | An artifact object is how you add records to the <code>[[Entity Table | Entity]]</code> table. | + | An artifact object is how you add records to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table. |
=Syntax= | =Syntax= | ||
| − | < | + | <source lang="C"> |
uint64_t truxton_child_file_create_artifact( uint64_t child_handle ); | uint64_t truxton_child_file_create_artifact( uint64_t child_handle ); | ||
| − | </ | + | </source> |
=Parameters= | =Parameters= | ||
==<code>child_handle</code>== | ==<code>child_handle</code>== | ||
| − | |||
The handle created by the [[truxton_child_file_create]] or [[truxton_file_create_child]] call. | The handle created by the [[truxton_child_file_create]] or [[truxton_file_create_child]] call. | ||
=Return value= | =Return value= | ||
A handle to an artifact object. | A handle to an artifact object. | ||
| + | |||
=Sample= | =Sample= | ||
| − | + | <source lang="C" highlight="34"> | |
| − | < | ||
void add_folder(uint64_t truxton, uint64_t parent_file) | void add_folder(uint64_t truxton, uint64_t parent_file) | ||
{ | { | ||
| Line 32: | Line 31: | ||
FILETIME now; | FILETIME now; | ||
| − | + | GetSystemTimePreciseAsFileTime(&now); | |
ULARGE_INTEGER ticks; | ULARGE_INTEGER ticks; | ||
| Line 59: | Line 58: | ||
truxton_child_file_destroy(child); | truxton_child_file_destroy(child); | ||
} | } | ||
| − | </ | + | </source> |
Revision as of 05:04, 13 November 2020
This creates an artifact from this file that you can use in the Artifact API.
An artifact object is how you add records to the [Entity] table.
Syntax
uint64_t truxton_child_file_create_artifact( uint64_t child_handle );
Parameters
child_handle
The handle created by the truxton_child_file_create or truxton_file_create_child call.
Return value
A handle to an artifact object.
Sample
void add_folder(uint64_t truxton, uint64_t parent_file)
{
truxton_start_adding_files(truxton);
uint64_t child = truxton_child_file_create(truxton);
char id[40];
truxton_file_get_id(parent_file, id, sizeof(id));
truxton_child_file_set_parent_id(child, id);
truxton_child_file_set_type(child, Type_Directory);
truxton_child_file_set_name(child, "Custom Exploits Folder");
FILETIME now;
GetSystemTimePreciseAsFileTime(&now);
ULARGE_INTEGER ticks;
ticks.LowPart = now.dwLowDateTime;
ticks.HighPart = now.dwHighDateTime;
truxton_child_file_set_created(child, ticks.QuadPart);
truxton_child_file_set_accessed(child, ticks.QuadPart);
truxton_child_file_set_modified(child, ticks.QuadPart);
truxton_child_file_set_origin(child, ORIGIN_GENERATED);
if ( truxton_child_file_save(child) == 0 )
{
printf( "Failed to add child to Truxton\n" );
}
uint64_t artifact = truxton_child_file_create_artifact(child);
truxton_artifact_set_type(artifact, ENTITY_TYPE_SERIAL_NUMBER);
truxton_artifact_set_value(artifact, "1234" );
truxton_artifact_save(artifact);
truxton_artifact_destroy(artifact);
truxton_child_file_destroy(child);
}
