Black Box

From truxwiki.com
Jump to navigation Jump to search

The Truxton ETL processes have a "black box recorder" that contains information about the process. It is equivalent to an aircraft black box. The contents are dumped upon request to an XML file.

Description

The purpose of the black box is to aid in debugging exploitation programs. It is a bag of clues that will tell programmers what a program was doing, where in the source code it was, what file it was processing, what media the file came from, etc.

Contents

The black box is a place where values can be stored on a per thread basis.

Thread Information

Every thread in a process gets a black box. Here are the items stored per thread:

  • Thread id - the thread's operating system id
  • Type - Set by Truxton and will usually be 0xB58F0316910A765C (Worker Thread) which is where your code runs
  • fileid - The GUID of the file currently being processed. This corresponds to the [ID] column of the [File] table.
  • lastfileid - The GUID of the file previously processed. This corresponds to the [ID] column of the [File] table.
  • mediaid - The GUID of the media that contains the file being processed. This corresponds to the [ID] column of the [Media] table.
  • lastmediaid - The GUID of the media of the last file processed. This corresponds to the [ID] column of the [Media] table.
  • activity
  • lastactivity
  • flushloopcount
  • sourcecodefile - An integer representing the name of the source code file containing the code currently being executed. It is set using the truxton_set_black_box_source_code_location()
  • linenumber - An integer representing the line number of the source code file containing the code currently being executed. It is set using the truxton_set_black_box_source_code_location()
  • lastupdate
  • lastupdatesecondsago
  • laststatusmediaid
  • laststatusmessage
  • getmessagecount

Slots

There are 20 slots where information can be stored.

  • Slot Number - An index value from 0 to 19
  • value - The integer value the programmer chose to store
  • sourcecodefile - An integer that uniquely identifies the full path to the source code file
  • linenumber - The line number in the source code file

Dump File Location

The state information will be written to a file in a folder named "Truxton\Debug Dumps" with a timestamp and process id in the filename. If the logdir option was not set, the root folder for the dump folder will be in the Program Data folder, usually the hidden C:\ProgramData folder.

Examples

Individual Process

If an individual process was told to dump its state and logdir was set to "E:\Logs\" then the dump file would be something like this:
E:\Logs\Truxton\Debug Dumps\20230523_174359_Process_1234_DebugDump.xml

Notice there is a separate section for process names and process data. This was done to preserve proprietary code. If you add your own ETL to Truxton and it continues to blow up and need our help. You can remove that one line with the process name leaving nothing but raw data in the process data section. This allow us to assist in debugging without you having to risk proprietary code being compromised.

For example: 

<processnames>
 <process name="MagneCelleGrayUndocumentedCPUJumpImplant.exe" id="10020" hex_id="2724"></process>
</processnames>

Sample

<?xml version="1.0" standalone="yes"?>
 <blackbox>
  <processnames>
   <process name="Carve.exe" id="10020" hex_id="2724"></process>
  </processnames>
  <process id="10020">
   <pid hex="2724">10020</pid>
   <version hex="400030002C67D">1125912791926397</version>
   <appid>D7A8523A-B560-9921-A3D4-E1C7EE0A5C71</appid>
   <etlid>0400F4FD-0027-2400-2728-192168079001</etlid>
   <numberofthreads hex="3">3</numberofthreads>
   <shutdowncode>0</shutdowncode>
   <thread>
    <id hex="2728">10024</id>
    <type hex="864A6C3021DEE249" meaning="ETL Application Initialization">9676665703341417033</type>
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
    <lastmessagereceived filetime="134154863347206566">2026-02-13T19:58:54.720656Z</lastmessagereceived>
    <lastmessagereceivedsecondsago ticks="54210659">5</lastmessagereceivedsecondsago>
    <activity hex="5A5A5A5A5A5A5A5A">6510615555426900570</activity>
    <activitymeaning>ETL_IS_SLEEPING</activitymeaning>
    <lastactivity hex="2121212121212121">2387225703656530209</lastactivity>
    <lastactivitymeaning>ETL_IS_AWAKE</lastactivitymeaning>
    <lastactivitychange filetime="134154863347357460">2026-02-13T19:58:54.735746Z</lastactivitychange>
    <lastactivitychangesecondsago ticks="54059765">5</lastactivitychangesecondsago>
    <flushloopcount hex="0">0</flushloopcount>
    <sourcecodefile hex="413390373CE0">71689718676704</sourcecodefile>
    <linenumber hex="16A">362</linenumber>
    <lastupdate filetime="134154863347357529">2026-02-13T19:58:54.735752Z</lastupdate>
    <lastupdatesecondsago ticks="54059696">5</lastupdatesecondsago>
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
    <laststatusmessage hex="0">0</laststatusmessage>
    <getmessagecount hex="0">0</getmessagecount>
    <slot19>
     <value hex="5">5</value>
     <sourcecodefile hex="37E115A35D59">61439870197081</sourcecodefile>
     <linenumber hex="2DF">735</linenumber>
    </slot19>
    <slot20>
     <value hex="5">5</value>
     <sourcecodefile hex="37E715A35D59">61465640000857</sourcecodefile>
     <linenumber hex="2E8">744</linenumber>
    </slot20>
    <slot21>
     <value hex="3517">13591</value>
     <sourcecodefile hex="B5DED720B255">199968696611413</sourcecodefile>
     <linenumber hex="CCB">3275</linenumber>
    </slot21>
    <slot22>
     <value hex="C18E7AD1D5CF99C0">13947220137666910656</value>
     <sourcecodefile hex="37E415A35D59">61452755098969</sourcecodefile>
     <linenumber hex="A6F">2671</linenumber>
    </slot22>
    <slot23>
     <value hex="400030002C67D">1125912791926397</value>
     <sourcecodefile hex="11EA50DC90539CF9">1290933151439494393</sourcecodefile>
     <linenumber hex="3A2">930</linenumber>
    </slot23>
   </thread>
   <thread>
    <id hex="CBC">3260</id>
    <type hex="6269583026F5D7FC" meaning="Database Record Committer">7091296052106876924</type>
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
    <activity hex="0">0</activity>
    <lastactivity hex="0">0</lastactivity>
    <flushloopcount hex="0">0</flushloopcount>
    <sourcecodefile hex="519EDE414A33">89742775503411</sourcecodefile>
    <linenumber hex="655">1621</linenumber>
    <lastupdate filetime="134154863347213036">2026-02-13T19:58:54.721303Z</lastupdate>
    <lastupdatesecondsago ticks="54204189">5</lastupdatesecondsago>
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
    <laststatusmessage hex="0">0</laststatusmessage>
    <getmessagecount hex="0">0</getmessagecount>
    <slot2>
     <value hex="1">1</value>
     <sourcecodefile hex="C67849122549">218219924301129</sourcecodefile>
     <linenumber hex="31C">796</linenumber>
    </slot2>
    <slot19>
     <value hex="2717">10007</value>
     <sourcecodefile hex="529EDE414A33">90842287131187</sourcecodefile>
     <linenumber hex="656">1622</linenumber>
    </slot19>
    <slot20>
     <value hex="0">0</value>
     <sourcecodefile hex="5A9EDE414A33">99638380153395</sourcecodefile>
     <linenumber hex="5B7">1463</linenumber>
    </slot20>
   </thread>
   <thread>
    <id hex="24BC">9404</id>
    <type hex="6269583026F5D7FC" meaning="Database Record Committer">7091296052106876924</type>
    <fileid>00000000-0000-0000-0000-000000000000</fileid>
    <lastfileid>00000000-0000-0000-0000-000000000000</lastfileid>
    <mediaid>00000000-0000-0000-0000-000000000000</mediaid>
    <lastmediaid>00000000-0000-0000-0000-000000000000</lastmediaid>
    <activity hex="0">0</activity>
    <lastactivity hex="0">0</lastactivity>
    <flushloopcount hex="0">0</flushloopcount>
    <sourcecodefile hex="62941319B550">108388115133776</sourcecodefile>
    <linenumber hex="AD">173</linenumber>
    <lastupdate filetime="134154863396551305">2026-02-13T19:58:59.65513Z</lastupdate>
    <lastupdatesecondsago ticks="4865920">0</lastupdatesecondsago>
    <laststatusmediaid>00000000-0000-0000-0000-000000000000</laststatusmediaid>
    <laststatusmessage hex="0">0</laststatusmessage>
    <getmessagecount hex="0">0</getmessagecount>
    <slot2>
     <value hex="2">2</value>
     <sourcecodefile hex="C67849122549">218219924301129</sourcecodefile>
     <linenumber hex="31C">796</linenumber>
    </slot2>
   </thread>
  </process>
 </blackbox>
Retrieved from "https://truxwiki.com/index.php?title=Black_Box&oldid=10813"