Truxton C API

From truxwiki.com
Revision as of 06:21, 20 February 2026 by Sam (talk | contribs) (→‎Debugging)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Truxton functionality is exposed to the C programming world as a DLL named TruxtonCAPI.dll in the C:\Program Files\Truxton\SDK folder. This DLL can be called from any programming language that has the ability to make operating system calls.

Philosophy

The API is considered to be "flat" in that only integers and ASCII character strings are used in the interface. This was chosen to make it easy for other languages to call the API. The coding convention is all lower case names with underscores separating words. Truxton is a member of the east const posse.

Preparing for Use

Truxton does not ship a linker library for TruxtonCAPI.dll in order to free the developer to use any particular compiler. If you want to link TruxtonCAPI.dll with your own C/C++ code, you will need to generate a linker library.

Alternatively, you can use a plugin pattern of calling LoadLibrary followed by many calls to GetProcAddress to get the function pointers. This is a lot of work and very prone to errors.

Generating a Linker Library for Microsoft Compilers

You can download a free Visual Studio from Microsoft. The steps to produce a LIB file from a DLL are:

  1. Generate a module definition (DEF) file from TruxtonCAPI.dll.
  2. Use the DEF file to create the linker library (LIB) file.

The following Powershell script will create the lib file for you. 

$msvc = "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64\"
$dumpbin = $msvc + "dumpbin.exe"
$lib = $msvc + "lib.exe"

$lines = (& $dumpbin /exports "C:\Program Files\Truxton\SDK\TruxtonCAPI.dll")

Add-Content TruxtonCAPI.def "EXPORTS"

foreach ( $line in $lines )
{
   if ( $line.Contains(" = ") -EQ $true )
   {
      Add-Content TruxtonCAPI.def $line.SubString($line.IndexOf(" = ") + 3)
   }
}

(& $lib /def:TruxtonCAPI.def /out:TruxtonCAPI.lib /machine:x64)

Remove-Item TruxtonCAPI.def, TruxtonCAPI.exp

In your project folder, execute the script from Powershell to create TruxtonCAPI.lib: 

.\MakeDef.ps1

API Groups

The API is broken down into the different areas of Truxton.

Initialization

Functions

Maintenance

These functions are used to perform periodic maintenance tasks in Truxton. These will send messages to the maintenance ETL which will carry out the tasks.

Hash Sets

These functions handle the creation of hash set files

Database Identification

File Identification

Triage Loads

GUI Colors

Artifacts

Artifacts are pieces of information that are also known as entities.

Derived Objects

The following APIs are used to create objects with an artifact as their parent.

Artifact Type

This API is used to create custom types of artifacts. If one of the default artifact types don't suite your purpose, you are free to create your own.

BOLOs

These are the APIs used to create a be-on-the-lookout alert criteria.

Child Files

A child file is one that you have created and need to save in Truxton.

Derived Objects

Communications

These are the APIs that deal with humans communicating via email, SMS, chat, etc.

Derived Objects

Enumeration

This set of functions allow you to get things out of Truxton.

ETL Application Creation

Debugging

Event

If you need to save a significant place in time, use the following functions. The data structure these API encapsulate is similar to the one used in the event message. These will create a record in the [Event] table.

Derived Objects

The following APIs are used to create objects with an event as their parent.

  • truxton_event_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_event_tag - Creates a tag and puts it on this event. This data will be saved to the [Tagged] table.

Event Type

This API is used to create custom types of events. If one of the default event types don't suite your purpose, you are free to create your own.

EXIF (Camera Information)

This set if APIs deal with information from the EXIF section of files. The primary file types that contain EXIF are JPG and TIFF. Not all of the fields of this object are stored in the database. Internally, Truxton has one parser for EXIF and uses that information to perform other forensic tasks.

These functions give you access to a data structure equivalent to the one used in EXIF messages.

Persisted in Database

The following APIs deal with things that are stored in the database.

Not in Database

The following APIs are useful for forensic processing but not saved in the database. Internally, when Truxton finds EXIF data, it will create and populate an object with that information. All forensic processing is performed on that object. The information presented here, while not stored in the database, was used by Truxton to exploit the camera information data.

Derived Objects

  • truxton_exif_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_exif_tag - Creates a tag and puts it on this EXIF object. This data will be saved to the [Tagged] table.

File

File Actions

These are things your can do to a file. These are not data items stored in the database.

File IO

File Record Fields

Derived Objects

The following APIs are used to create objects with a file as their parent.

File Export

File Type

Group

A group is a collection of things scoped to an investigation and investigator. This is the technology behind marking things as Findings.

Investigation

Investigation Event

This set of API's allow you to add records to the [InvestigationEvent] table.

Jurisdiction

Jurisdictions is a way to keep track of work done on behalf of others. Say you're a regional forensics lab and your boss asks you, "How much work did we do for Mayberry last quarter?"

Geographic Location

Derived Objects

The following APIs are used to create objects with a location as their parent.

Media

These are the API's that allow you to add to the [Media] table in the database.

Derived Objects

The following APIs are used to create objects with a media as their parent.

Maintenance Functions

Message

This is the message sent on the message bus between the ETL processes.

Derived Objects

The following APIs are used to create objects from the given message.

Message Addresses

Message Participant

This is basically a useless API. It is used internally during the enumeration of the participants of a communication.

Options

Truxton "options" are otherwise known as configuration settings, command line options, etc. They are configuration items that your program can use.

Note

This set of API's allow you to add records to the [InvestigatorNote] table.

Relation

These functions let you add to the [Relation] table in Truxton. This is how to establish some sort of relationship between items in Truxton to create a graph. Relations in Truxton adhere to the form of "A is a thing of B" Truxton is not focused on exploring graphs (cliques anyone?) but needed a way to establish simple relationships between objects.

Sensitive Site List

These are the API's that allow you to manipulate a sensitive site list for Truxton. These will add records to the [SensitiveSiteList] and [SensitiveSite] tables.

Subject

These are the API's that allow you to add an investigative subject to Truxton. These will add records to the [Suspect] table.

Derived Objects

The following APIs are used to create objects with a subject as their parent.

  • truxton_subject_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_subject_tag - Associating a tag with this subject. This data will be saved to the [Tagged] table.

Types

Truxton has many different types in it. They are generally integer values that have meanings. Here's how to get a list of them.

URL

These functions encapsulate a data structure similar to the one used in the Website Visit message.

Derived Objects

The following APIs are used to create objects with an event as their parent.

  • truxton_url_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_url_tag - Creates a tag and puts it on this location. This data will be saved to the [Tagged] table.

USB Device

Derived Objects

  • truxton_usb_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_usb_tag - Associate a tag with this USB device. This data will be saved to the [Tagged] table.

Debugging

Samples

Retrieved from "https://truxwiki.com/index.php?title=Truxton_C_API&oldid=10807"