Black Box
The Truxton ETL processes have a "black box recorder" that contains information about the process. It is equivalent to an aircraft black box. The contents are dumped upon request to an XML file.
Contents
Description
The purpose of the black box is to aid in debugging exploitation programs. It is a bag of clues that will tell programmers what a program was doing, where in the source code it was, what file it was processing, what media the file came from, etc.
Contents
The black box is a place where values can be stored on a per thread basis.
Thread Information
Every thread in a process gets a black box. Here are the items stored per thread:
- Thread id - the thread's operating system id
- Type - Set by Truxton and will usually be 0xB58F0316910A765C (Worker Thread) which is where your code runs
- fileid - The GUID of the file currently being processed. This corresponds to the
[ID]column of the[File]table. - lastfileid - The GUID of the file previously processed. This corresponds to the
[ID]column of the[File]table. - mediaid - The GUID of the media that contains the file being processed. This corresponds to the
[ID]column of the[Media]table. - lastmediaid - The GUID of the media of the last file processed. This corresponds to the
[ID]column of the[Media]table. - activity
- lastactivity
- flushloopcount
- sourcecodefile - An integer representing the name of the source code file containing the code currently being executed. It is set using the
truxton_set_black_box_source_code_location() - linenumber - An integer representing the line number of the source code file containing the code currently being executed. It is set using the
truxton_set_black_box_source_code_location() - lastupdate
- lastupdatesecondsago
- laststatusmediaid
- laststatusmessage
- getmessagecount
Slots
There are 20 slots where information can be stored.
- Slot Number - An index value from 0 to 19
- value - The integer value the programmer chose to store
- sourcecodefile - An integer that uniquely identifies the full path to the source code file
- linenumber - The line number in the source code file
Dump File Location
The state information will be written to a file in a folder named "Truxton\\Debug Dumps" with a timestamp and process id in the filename.
If the logdir option was not set, the root folder for the dump folder will be in the Program Data folder, usually the hidden C:\ProgramData folder.
Examples
Individual Process
If an indevidual process was told to dump its state and logdir was set to "E:\Logs\" then the dump file would be something like this:
E:\Logs\Truxton\\Debug Dumps\\20230523_174359_Process_1234_DebugDump.xml
