C Sample Exploitation ETL

This sample shows the steps needed to implement a file exploitation ETL in Truxton.

Sample File Format

This sample will exploit a fake file format we call Acme. Acme Corporation is a known supplier of nefarious devices and explosives. Their file format begins with a five byte magic value followed by eleven bytes in a data structure. If the sixth byte in the file is 0x11 then it is a serial number file that uniquely identifies the user.

0000h: 88 77 66 55 00 11 22 33 44 55 66 77 88 99 AA BB
0010h: CC

Source Code

#include <stdio.h>
#include <memory.h>
#include <inttypes.h>
#include <TruxtonCAPI.h>
#include <TruxtonFileTypes.h>
#include <TruxtonDefines.h>
#pragma comment (lib, "TruxtonCAPI.lib")

int main(void)
{
  uint8_t buffer[20];

  uint64_t message = 0;

  uint64_t etl_application = truxton_etl_create();

  truxton_etl_set_application_name(etl_application, "My File Exploiter");
  truxton_etl_set_description(etl_application, "Exploitation ETL for new file type");
  truxton_etl_set_queue_name(etl_application, "mef");
  truxton_etl_set_stage_number(etl_application, 2);

  truxton_etl_add_desired_file_type(etl_application, 11111);

  //truxton_etl_send_me_file_id(etl_application, "6068992f-af6b-06b8-28ce-094b0000000d");

  message = truxton_etl_get_message(etl_application);

  while (message != 0)
  {
    // Do something with the message
    uint64_t file_in_truxton = truxton_message_get_file(message);

    if (file_in_truxton != 0)
    {
      truxton_file_seek(file_in_truxton, 5, SEEK_SET);

      if (truxton_file_read(file_in_truxton, buffer, 1) == 1)
      {
        if (buffer[0] == 0x11)
        {
          // Serial Number. The next 8 bytes are a serial number
          truxton_file_seek(file_in_truxton, 6, SEEK_SET);

          if (truxton_file_read(file_in_truxton, buffer, 8) == 8)
          {
            char serial_number_string[32];

            uint64_t artifact = truxton_file_create_artifact(file_in_truxton);
            truxton_artifact_set_type(artifact, ENTITY_TYPE_SERIAL_NUMBER);

            sprintf_s(serial_number_string, sizeof(serial_number_string), "%02X%02X%02X%02X%02X%02X%02X%02X",
                            (int)buffer[0], (int)buffer[1], (int)buffer[2], (int)buffer[3],
                            (int)buffer[4], (int)buffer[5], (int)buffer[6], (int)buffer[7]);
            truxton_artifact_set_value(artifact, serial_number_string);
            truxton_artifact_set_data_type(artifact, DATA_TYPE_uint8_t);
            truxton_artifact_set_offset(artifact, 6);
            truxton_artifact_set_length(artifact, 8);

            if (truxton_artifact_save(artifact) == 0)
            {
              printf("Cannot save artifact to the database.\n");
            }

            truxton_artifact_destroy(artifact);
          }
        }
      }

      truxton_file_free(file_in_truxton);
    }

    truxton_message_destroy(message);

    // Pause here until we get another message from the "mef" message queue
    message = truxton_etl_get_message(etl_application);
  }

  truxton_etl_destroy(etl_application);
  return(0);
}