Truxton functionality is exposed to the C programming world as a DLL named TruxtonCAPI.dll in the C:\Program Files\Truxton\SDK folder. This DLL can be called from any programming language that has the ability to make operating system calls.

Philosophy

The API is considered to be "flat" in that only sixty-four bit integers and ASCII character strings are used in the interface. This was chosen to make it easy for other languages to interface to. The coding convention is all lower case names with underscores separating words. Truxton is a member of the east const posse.

API Groups

The API is broken down into the different areas of Truxton.

Initialization

truxton_start - Initializes Truxton
truxton_stop - Uninitializes Truxton

Functions

truxton_create - Creates a Truxton object
truxton_destroy - Frees a Truxton object
truxton_get_device_id - Retrieves the Device identifier
truxton_get_machine_id - Retrieves the machine identifier
truxton_get_version - Retrieves the version of Truxton
truxton_start_adding_files - Prepares Truxton to add files to the database

ETL Functions

truxton_etl_create - Creates a Truxton ETL object
truxton_etl_destroy - Destroys a Truxton ETL object
truxton_etl_add_command_line_argument - Adds a command line argument
truxton_etl_add_desired_file_type - Tells Truxton what types of files you want to process
truxton_etl_get_description
truxton_etl_set_description
truxton_etl_get_message
truxton_etl_get_stage_number
truxton_etl_set_stage_number
truxton_etl_set_application_name
truxton_etl_set_depot_type
truxton_etl_set_depot_type_name
truxton_etl_set_expander_identifier
truxton_etl_set_expander_version
truxton_etl_set_queue_name
truxton_etl_set_thread_safe
truxton_etl_set_poly_file_expander
truxton_etl_send_me_file_id - Used during development and debugging
truxton_etl_send_me_files - Used during development and debugging
truxton_etl_send_me_hash - Used during development and debugging
truxton_etl_send_me_local_file - Used during development and debugging

Child Files

A child file is one that you have created and need to save in Truxton.

truxton_child_file_create - Create a file object to save to Truxton
truxton_child_file_destroy - Destroys a file object
truxton_child_file_clear - Returns a file object to an initial state of all zeroes
truxton_child_file_get_id - Retrieves the GUID of the child file
truxton_child_file_set_id - Sets the GUID of the child file
truxton_child_file_get_parent_id - Retrieves the GUID of the parent file
truxton_child_file_set_parent_id - Sets the GUID of the parent of the child
truxton_child_file_get_media_id - Retrieves the GUID of the media this child belongs to
truxton_child_file_set_media_id - Sets the GUID of the media this child belongs to
truxton_child_file_get_name - Retrieves the name of the file
truxton_child_file_set_name - Sets the name of the file
truxton_child_file_get_path - Retrieves the path of the file
truxton_child_file_set_path - Sets the path of the file
truxton_child_file_get_hash - Retrieves the MD5 hash (digital fingerprint) of the file's contents
truxton_child_file_get_number_of_children - Retrieves the number of child files of this file
truxton_child_file_set_number_of_children - Sets the number of child files of this file
truxton_child_file_get_created - Retrieves the date and time of when the file was created
truxton_child_file_set_created - Sets the date and time of when the file was created
truxton_child_file_get_accessed - Retrieves the date and time of when the file was accessed
truxton_child_file_set_accessed - Sets the date and time of when the file was accessed
truxton_child_file_get_modified - Retrieves the date and time of when the file was modified (last written to)
truxton_child_file_set_modified - Sets the date and time of when the file was modified (last written to)
truxton_child_file_get_size - Retrieves the size of the file, in bytes, as reported by the operating system
truxton_child_file_set_size - Sets the size of the file, in bytes, as reported by the operating system
truxton_child_file_get_origin - Retrieves the origin of the file
truxton_child_file_set_origin - Sets the origin of the file
truxton_child_file_get_content_status - Retrieves the status of the contents of the file
truxton_child_file_set_content_status - Sets the status of the contents of the file
truxton_child_file_get_truxton - Retrieves the instance of Truxton this child belongs to
truxton_child_file_begin_write - Prepares Truxton for writing contents to be associated with this file
truxton_child_file_end_write - Tells Truxton to finish writing contents
truxton_child_file_write - Gives Truxton bytes to store as the file contents
truxton_child_file_save - Commits data to the database
truxton_child_file_set_type - Sets the type of the file
truxton_child_file_get_type - Retrieves the type of the file
truxton_child_file_set_attributes - Sets the attributes of the file
truxton_child_file_get_attributes - Retrieves the attributes of the file
truxton_child_file_set_disk_offset - Sets the physical disk offset of the first byte of contents
truxton_child_file_get_disk_offset - Retrieves the physical disk offset of the first byte of contents
truxton_child_file_get_entropy - Retrieves the entropy of the file contents

Creating things related to this file:

truxton_child_file_create_artifact - Creates and associates an artifact with this file. The artifact be saved to the Entity table.
truxton_child_file_create_event - Creates and associates an event with this file. The event will be saved to the Event table.
truxton_child_file_create_exif - Creates and associates camera information with this file. The data will be saved to the EXIF table.
truxton_child_file_create_location - Creates and associates a geographic location with this file. The data will be saved to the Location table.
truxton_child_file_create_relation - Creates a relationship with this file as the source. The data will be saved to the Relation table.
truxton_child_file_create_url - Creates a website visit with this file as the source. This data will be saved to the WebsiteVisit table.
truxton_child_file_create_usb - Creates a USB device with this file as the source. This data will be saved to the USBDevice table.
truxton_child_file_tag - Creates a tag and puts it on this file. This data will be saved to the Tagged table.
truxton_child_file_new_child - Creates a child of this file

File IO

File Record Fields

Create Objects from File

The following APIs are used to create objects with a file as their parent.

truxton_file_create_artifact - Creates and associates an artifact with this file. The artifact be saved to the Entity table.
truxton_file_create_child - For creating a file.
truxton_file_create_event - Creates and associates an event with this file. The event will be saved to the Event table.
truxton_file_create_exif - Creates and associates camera information with this file. The data will be saved to the EXIF table.
truxton_file_create_location - Creates and associates a geographic location with this file. The data will be saved to the Location table.
truxton_file_create_relation - Creates a relationship with this file as the source. The data will be saved to the Relation table.
truxton_file_create_url - Creates a website visit with this file as the source. This data will be saved to the WebsiteVisit table.
truxton_file_create_usb - Creates a USB device with this file as the source. This data will be saved to the USBDevice table.
truxton_file_tag - Creates a tag and puts it on this file. This data will be saved to the Tagged table.

ETL Creation

The following APIs are used to extend Truxton by creating an exploitation process.

Truxton C API

Contents

Philosophy

API Groups

Initialization

Functions

ETL Functions

Child Files

File IO

File Record Fields

Create Objects from File

ETL Creation

Debugging

Message

String Map

File Export

Artifacts

Event

EXIF (Camera Information)

File Type

Geographic Location

Relation

Website Visit

USB Device

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

Tools