/src/wireshark/epan/dissectors/packet-procmon.c
Line | Count | Source |
1 | | /* packet-procmon.c |
2 | | * Routines for MS Procmon dissection |
3 | | * |
4 | | * Used a lot of information from https://github.com/eronnen/procmon-parser |
5 | | * |
6 | | * Wireshark - Network traffic analyzer |
7 | | * By Gerald Combs <gerald@wireshark.org> |
8 | | * Copyright 1998 Gerald Combs |
9 | | * |
10 | | * SPDX-License-Identifier: GPL-2.0-or-later |
11 | | */ |
12 | | |
13 | | #include <config.h> |
14 | | |
15 | | #include <epan/packet.h> |
16 | | #include <epan/expert.h> |
17 | | #include <epan/tfs.h> |
18 | | #include <wiretap/procmon.h> |
19 | | #include <wiretap/wtap.h> |
20 | | #include "packet-ipv6.h" |
21 | | |
22 | | // To do: |
23 | | // - Add a preference for the maximum number of modules to display? |
24 | | // - Add a field that indicates whether or not the event writes data? |
25 | | |
26 | | void event_register_procmon(void); |
27 | | void event_reg_handoff_procmon(void); |
28 | | |
29 | | /* Initialize the protocol and registered fields */ |
30 | | static int proto_procmon; |
31 | | |
32 | | static int hf_procmon_process_index; |
33 | | static int hf_procmon_process_id; |
34 | | static int hf_procmon_process_name; |
35 | | static int hf_procmon_process_parent_name; |
36 | | static int hf_procmon_process_image_path; |
37 | | static int hf_procmon_process_command_line; |
38 | | static int hf_procmon_process_user_name; |
39 | | static int hf_procmon_process_start_time; |
40 | | static int hf_procmon_process_end_time; |
41 | | static int hf_procmon_process_session_number; |
42 | | static int hf_procmon_process_authentication_id; |
43 | | static int hf_procmon_process_integrity; |
44 | | static int hf_procmon_process_company; |
45 | | static int hf_procmon_process_version; |
46 | | static int hf_procmon_process_description; |
47 | | static int hf_procmon_process_is_virtualized; |
48 | | static int hf_procmon_process_is_64_bit; |
49 | | |
50 | | static int hf_procmon_module_base_address; |
51 | | static int hf_procmon_module_size; |
52 | | static int hf_procmon_module_image_path; |
53 | | static int hf_procmon_module_version; |
54 | | static int hf_procmon_module_company; |
55 | | static int hf_procmon_module_description; |
56 | | static int hf_procmon_module_timestamp; |
57 | | |
58 | | static int hf_procmon_thread_id; |
59 | | static int hf_procmon_event_class; |
60 | | static int hf_procmon_operation_type; |
61 | | static int hf_procmon_duration; |
62 | | static int hf_procmon_timestamp; |
63 | | static int hf_procmon_event_result; |
64 | | static int hf_procmon_stack_trace_depth; |
65 | | static int hf_procmon_details_size; |
66 | | static int hf_procmon_extra_details_offset; |
67 | | static int hf_procmon_stack_trace_address; |
68 | | static int hf_procmon_detail_data; |
69 | | static int hf_procmon_extra_detail_data; |
70 | | static int hf_procmon_process_operation; |
71 | | static int hf_procmon_process_pid; |
72 | | static int hf_procmon_process_path; |
73 | | static int hf_procmon_process_path_size; |
74 | | static int hf_procmon_process_path_is_ascii; |
75 | | static int hf_procmon_process_path_char_count; |
76 | | static int hf_procmon_process_commandline; |
77 | | static int hf_procmon_process_commandline_size; |
78 | | static int hf_procmon_process_commandline_is_ascii; |
79 | | static int hf_procmon_process_commandline_char_count; |
80 | | static int hf_procmon_process_thread_id; |
81 | | static int hf_procmon_process_exit_status; |
82 | | static int hf_procmon_process_kernel_time; |
83 | | static int hf_procmon_process_user_time; |
84 | | static int hf_procmon_process_working_set; |
85 | | static int hf_procmon_process_peak_working_set; |
86 | | static int hf_procmon_process_private_bytes; |
87 | | static int hf_procmon_process_peak_private_bytes; |
88 | | static int hf_procmon_process_image_base; |
89 | | static int hf_procmon_process_image_size; |
90 | | static int hf_procmon_process_parent_pid; |
91 | | static int hf_procmon_process_curdir; |
92 | | static int hf_procmon_process_curdir_size; |
93 | | static int hf_procmon_process_curdir_is_ascii; |
94 | | static int hf_procmon_process_curdir_char_count; |
95 | | static int hf_procmon_process_environment; |
96 | | static int hf_procmon_process_environment_char_count; |
97 | | static int hf_procmon_registry_operation; |
98 | | static int hf_procmon_registry_desired_access; |
99 | | static int hf_procmon_registry_granted_access; |
100 | | static int hf_procmon_registry_disposition; |
101 | | static int hf_procmon_registry_key; |
102 | | static int hf_procmon_registry_key_size; |
103 | | static int hf_procmon_registry_key_is_ascii; |
104 | | static int hf_procmon_registry_key_char_count; |
105 | | static int hf_procmon_registry_new_key; |
106 | | static int hf_procmon_registry_new_key_size; |
107 | | static int hf_procmon_registry_new_key_is_ascii; |
108 | | static int hf_procmon_registry_new_key_char_count; |
109 | | static int hf_procmon_registry_value; |
110 | | static int hf_procmon_registry_value_size; |
111 | | static int hf_procmon_registry_value_is_ascii; |
112 | | static int hf_procmon_registry_value_char_count; |
113 | | static int hf_procmon_registry_length; |
114 | | static int hf_procmon_registry_key_information_class; |
115 | | static int hf_procmon_registry_value_information_class; |
116 | | static int hf_procmon_registry_key_set_information_class; |
117 | | static int hf_procmon_registry_index; |
118 | | static int hf_procmon_registry_type; |
119 | | static int hf_procmon_registry_data_length; |
120 | | static int hf_procmon_registry_key_name_size; |
121 | | static int hf_procmon_registry_key_name; |
122 | | static int hf_procmon_registry_key_handle_tags; |
123 | | static int hf_procmon_registry_key_flags; |
124 | | static int hf_procmon_registry_key_last_write_time; |
125 | | static int hf_procmon_registry_key_title_index; |
126 | | static int hf_procmon_registry_key_subkeys; |
127 | | static int hf_procmon_registry_key_max_name_len; |
128 | | static int hf_procmon_registry_key_values; |
129 | | static int hf_procmon_registry_key_max_value_name_len; |
130 | | static int hf_procmon_registry_key_max_value_data_len; |
131 | | static int hf_procmon_registry_key_class_offset; |
132 | | static int hf_procmon_registry_key_class_length; |
133 | | static int hf_procmon_registry_key_max_class_len; |
134 | | static int hf_procmon_registry_value_reg_type; |
135 | | static int hf_procmon_registry_value_offset_to_data; |
136 | | static int hf_procmon_registry_value_length; |
137 | | static int hf_procmon_registry_value_name_size; |
138 | | static int hf_procmon_registry_value_name; |
139 | | static int hf_procmon_registry_value_dword; |
140 | | static int hf_procmon_registry_value_qword; |
141 | | static int hf_procmon_registry_value_sz; |
142 | | static int hf_procmon_registry_value_binary; |
143 | | static int hf_procmon_registry_value_multi_sz; |
144 | | static int hf_procmon_registry_key_set_information_write_time; |
145 | | static int hf_procmon_registry_key_set_information_wow64_flags; |
146 | | static int hf_procmon_registry_key_set_information_handle_tags; |
147 | | static int hf_procmon_filesystem_operation; |
148 | | static int hf_procmon_filesystem_suboperation; |
149 | | static int hf_procmon_filesystem_padding; |
150 | | static int hf_procmon_filesystem_details; |
151 | | static int hf_procmon_filesystem_path; |
152 | | static int hf_procmon_filesystem_path_size; |
153 | | static int hf_procmon_filesystem_path_is_ascii; |
154 | | static int hf_procmon_filesystem_path_char_count; |
155 | | static int hf_procmon_filesystem_create_file_access_mask; |
156 | | static int hf_procmon_filesystem_create_file_impersonating_sid_length; |
157 | | static int hf_procmon_filesystem_create_file_impersonating; |
158 | | static int hf_procmon_filesystem_create_file_disposition; |
159 | | static int hf_procmon_filesystem_create_file_options; |
160 | | static int hf_procmon_filesystem_create_file_attributes; |
161 | | static int hf_procmon_filesystem_create_file_share_mode; |
162 | | static int hf_procmon_filesystem_create_file_allocation; |
163 | | static int hf_procmon_filesystem_create_file_sid_revision; |
164 | | static int hf_procmon_filesystem_create_file_sid_count; |
165 | | static int hf_procmon_filesystem_create_file_sid_authority; |
166 | | static int hf_procmon_filesystem_create_file_sid_value; |
167 | | static int hf_procmon_filesystem_create_file_open_result; |
168 | | static int hf_procmon_filesystem_readwrite_file_io_flags; |
169 | | static int hf_procmon_filesystem_readwrite_file_priority; |
170 | | static int hf_procmon_filesystem_readwrite_file_length; |
171 | | static int hf_procmon_filesystem_readwrite_file_offset; |
172 | | static int hf_procmon_filesystem_readwrite_file_result_length; |
173 | | static int hf_procmon_filesystem_ioctl_write_length; |
174 | | static int hf_procmon_filesystem_ioctl_read_length; |
175 | | static int hf_procmon_filesystem_ioctl_ioctl; |
176 | | static int hf_procmon_filesystem_ioctl_offset; |
177 | | static int hf_procmon_filesystem_ioctl_length; |
178 | | static int hf_procmon_filesystem_create_file_mapping_sync_type; |
179 | | static int hf_procmon_filesystem_create_file_mapping_page_protection; |
180 | | static int hf_procmon_filesystem_directory; |
181 | | static int hf_procmon_filesystem_directory_size; |
182 | | static int hf_procmon_filesystem_directory_is_ascii; |
183 | | static int hf_procmon_filesystem_directory_char_count; |
184 | | static int hf_procmon_filesystem_directory_control_file_information_class; |
185 | | static int hf_procmon_filesystem_directory_control_notify_change_flags; |
186 | | static int hf_procmon_filesystem_set_info_file_disposition_delete; |
187 | | static int hf_procmon_filesystem_directory_control_query_next_entry_offset; |
188 | | static int hf_procmon_filesystem_directory_control_query_file_index; |
189 | | static int hf_procmon_filesystem_directory_control_query_name_length; |
190 | | static int hf_procmon_filesystem_directory_control_query_name; |
191 | | static int hf_procmon_filesystem_directory_control_query_creation_time; |
192 | | static int hf_procmon_filesystem_directory_control_query_last_access_time; |
193 | | static int hf_procmon_filesystem_directory_control_query_last_write_time; |
194 | | static int hf_procmon_filesystem_directory_control_query_change_time; |
195 | | static int hf_procmon_filesystem_directory_control_query_end_of_file; |
196 | | static int hf_procmon_filesystem_directory_control_query_allocation_size; |
197 | | static int hf_procmon_filesystem_directory_control_query_file_attributes; |
198 | | static int hf_procmon_filesystem_directory_control_query_file_ea_size; |
199 | | static int hf_procmon_filesystem_directory_control_query_file_id; |
200 | | static int hf_procmon_filesystem_directory_control_query_short_name_length; |
201 | | static int hf_procmon_filesystem_directory_control_query_short_name; |
202 | | static int hf_procmon_profiling_operation; |
203 | | static int hf_procmon_network_operation; |
204 | | static int hf_procmon_network_flags; |
205 | | static int hf_procmon_network_flags_is_src_ipv4; |
206 | | static int hf_procmon_network_flags_is_dst_ipv4; |
207 | | static int hf_procmon_network_flags_tcp_udp; |
208 | | static int hf_procmon_network_length; |
209 | | static int hf_procmon_network_src_ipv4; |
210 | | static int hf_procmon_network_src_ipv6; |
211 | | static int hf_procmon_network_dest_ipv4; |
212 | | static int hf_procmon_network_dest_ipv6; |
213 | | static int hf_procmon_network_src_port; |
214 | | static int hf_procmon_network_dest_port; |
215 | | static int hf_procmon_network_padding; |
216 | | static int hf_procmon_network_details; |
217 | | |
218 | | |
219 | | /* Initialize the subtree pointers */ |
220 | | static int ett_procmon; |
221 | | static int ett_procmon_header; |
222 | | static int ett_procmon_stack_trace; |
223 | | static int ett_procmon_process_event; |
224 | | static int ett_procmon_process_modules; |
225 | | static int ett_procmon_process_path; |
226 | | static int ett_procmon_process_commandline; |
227 | | static int ett_procmon_process_curdir; |
228 | | static int ett_procmon_registry_event; |
229 | | static int ett_procmon_registry_key; |
230 | | static int ett_procmon_registry_value; |
231 | | static int ett_procmon_registry_new_key; |
232 | | static int ett_procmon_filesystem_event; |
233 | | static int ett_procmon_filesystem_path; |
234 | | static int ett_procmon_filesystem_create_file_impersonating; |
235 | | static int ett_procmon_filesystem_directory; |
236 | | static int ett_procmon_filesystem_information; |
237 | | static int ett_procmon_profiling_event; |
238 | | static int ett_procmon_network_event; |
239 | | static int ett_procmon_network_flags; |
240 | | |
241 | | |
242 | | static expert_field ei_procmon_unknown_event_class; |
243 | | static expert_field ei_procmon_unknown_operation; |
244 | | static expert_field ei_procmon_unknown_index; |
245 | | |
246 | | static dissector_handle_t procmon_handle; |
247 | | |
248 | 0 | #define PROCMON_EVENT_CLASS_TYPE_PROCESS 1 |
249 | 0 | #define PROCMON_EVENT_CLASS_TYPE_REGISTRY 2 |
250 | 0 | #define PROCMON_EVENT_CLASS_TYPE_FILE_SYSTEM 3 |
251 | 0 | #define PROCMON_EVENT_CLASS_TYPE_PROFILING 4 |
252 | 0 | #define PROCMON_EVENT_CLASS_TYPE_NETWORK 5 |
253 | | |
254 | 0 | #define STRING_IS_ASCII_MASK 0x8000 |
255 | 0 | #define STRING_CHAR_COUNT_MASK 0x7FFF |
256 | | |
257 | | static void dissect_procmon_detail_string_info(tvbuff_t* tvb, proto_tree* tree, int offset, |
258 | | int hf_detail, int hf_detail_ascii, int hf_detail_char_count, int ett_detail, bool* is_ascii, uint16_t* char_count) |
259 | 0 | { |
260 | 0 | proto_tree* detail_tree; |
261 | 0 | proto_item* detail_item; |
262 | 0 | uint32_t char_value; |
263 | |
|
264 | 0 | detail_item = proto_tree_add_item(tree, hf_detail, tvb, offset, 2, ENC_LITTLE_ENDIAN); |
265 | 0 | detail_tree = proto_item_add_subtree(detail_item, ett_detail); |
266 | |
|
267 | 0 | proto_tree_add_item_ret_boolean(detail_tree, hf_detail_ascii, tvb, offset, 2, ENC_LITTLE_ENDIAN, is_ascii); |
268 | 0 | proto_tree_add_item_ret_uint(detail_tree, hf_detail_char_count, tvb, offset, 2, ENC_LITTLE_ENDIAN, &char_value); |
269 | 0 | *char_count = (uint16_t)(char_value & STRING_CHAR_COUNT_MASK); |
270 | 0 | } |
271 | | |
272 | | static int dissect_procmon_detail_string(tvbuff_t* tvb, proto_tree* tree, int offset, bool is_ascii, uint16_t char_count, int hf_detail_string) |
273 | 0 | { |
274 | 0 | int char_size = is_ascii ? 1 : 2; |
275 | 0 | int path_size = char_size * char_count; |
276 | 0 | proto_tree_add_item(tree, hf_detail_string, tvb, offset, path_size, is_ascii ? ENC_ASCII : ENC_UTF_16|ENC_LITTLE_ENDIAN); |
277 | 0 | return offset + path_size; |
278 | 0 | } |
279 | | |
280 | | static void dissect_procmon_access_mask(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, int offset, int hf_access_mask, int length, uint32_t* mapping, const value_string* vs_mask_values) |
281 | 0 | { |
282 | 0 | int i = 0; |
283 | 0 | bool first = true; |
284 | 0 | proto_item* ti; |
285 | 0 | uint32_t access_mask; |
286 | 0 | wmem_strbuf_t* access_details = wmem_strbuf_new(pinfo->pool, "("); |
287 | |
|
288 | 0 | ti = proto_tree_add_item_ret_uint(tree, hf_access_mask, tvb, offset, length, ENC_LITTLE_ENDIAN, &access_mask); |
289 | 0 | if (mapping != NULL) |
290 | 0 | { |
291 | 0 | if (access_mask & 0x80000000) |
292 | 0 | access_mask |= mapping[0]; |
293 | 0 | if (access_mask & 0x40000000) |
294 | 0 | access_mask |= mapping[1]; |
295 | 0 | if (access_mask & 0x20000000) |
296 | 0 | access_mask |= mapping[2]; |
297 | 0 | if (access_mask & 0x10000000) |
298 | 0 | access_mask |= mapping[3]; |
299 | 0 | } |
300 | |
|
301 | 0 | while (vs_mask_values[i].strptr) { |
302 | 0 | if ((vs_mask_values[i].value & access_mask) == vs_mask_values[i].value) |
303 | 0 | { |
304 | 0 | if (first) |
305 | 0 | first = false; |
306 | 0 | else |
307 | 0 | wmem_strbuf_append(access_details, ", "); |
308 | 0 | wmem_strbuf_append(access_details, vs_mask_values[i].strptr); |
309 | 0 | } |
310 | |
|
311 | 0 | i++; |
312 | 0 | } |
313 | |
|
314 | 0 | wmem_strbuf_append_c(access_details, ')'); |
315 | 0 | proto_item_append_text(ti, " %s", wmem_strbuf_get_str(access_details)); |
316 | 0 | } |
317 | | |
318 | | static const value_string event_class_vals[] = { |
319 | | { PROCMON_EVENT_CLASS_TYPE_PROCESS, "Process" }, |
320 | | { PROCMON_EVENT_CLASS_TYPE_REGISTRY, "Registry" }, |
321 | | { PROCMON_EVENT_CLASS_TYPE_FILE_SYSTEM, "File System" }, |
322 | | { PROCMON_EVENT_CLASS_TYPE_PROFILING, "Profiling" }, |
323 | | { PROCMON_EVENT_CLASS_TYPE_NETWORK, "Network" }, |
324 | | { 0, NULL } |
325 | | }; |
326 | | |
327 | 0 | #define PROCMON_PROCESS_OPERATION_DEFINED 0x0000 |
328 | 0 | #define PROCMON_PROCESS_OPERATION_CREATE 0x0001 |
329 | 0 | #define PROCMON_PROCESS_OPERATION_EXIT 0x0002 |
330 | 0 | #define PROCMON_PROCESS_OPERATION_THREAD_CREATE 0x0003 |
331 | 0 | #define PROCMON_PROCESS_OPERATION_THREAD_EXIT 0x0004 |
332 | 0 | #define PROCMON_PROCESS_OPERATION_LOAD_IMAGE 0x0005 |
333 | 0 | #define PROCMON_PROCESS_OPERATION_THREAD_PROFILE 0x0006 |
334 | 0 | #define PROCMON_PROCESS_OPERATION_PROCESS_START 0x0007 |
335 | 0 | #define PROCMON_PROCESS_OPERATION_PROCESS_STATISTICS 0x0008 |
336 | 0 | #define PROCMON_PROCESS_OPERATION_SYSTEM_STATISTICS 0x0009 |
337 | | |
338 | | static const value_string process_operation_vals[] = { |
339 | | { PROCMON_PROCESS_OPERATION_DEFINED, "Process Defined" }, |
340 | | { PROCMON_PROCESS_OPERATION_CREATE, "Process Create" }, |
341 | | { PROCMON_PROCESS_OPERATION_EXIT, "Process Exit" }, |
342 | | { PROCMON_PROCESS_OPERATION_THREAD_CREATE, "Thread Create" }, |
343 | | { PROCMON_PROCESS_OPERATION_THREAD_EXIT, "Thread Exit" }, |
344 | | { PROCMON_PROCESS_OPERATION_LOAD_IMAGE, "Load Image" }, |
345 | | { PROCMON_PROCESS_OPERATION_THREAD_PROFILE, "Thread Profile" }, |
346 | | { PROCMON_PROCESS_OPERATION_PROCESS_START, "Process Start" }, |
347 | | { PROCMON_PROCESS_OPERATION_PROCESS_STATISTICS, "Process Statistics" }, |
348 | | { PROCMON_PROCESS_OPERATION_SYSTEM_STATISTICS, "System Statistics" }, |
349 | | { 0, NULL } |
350 | | }; |
351 | | |
352 | | static const true_false_string process_architecture_tfs = { "64-bit", "32-bit" }; |
353 | | |
354 | | // https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--0-499- |
355 | | static const value_string system_error_code_vals[] = { |
356 | | { 0x0, "SUCCESS" }, |
357 | | { 0x2, "FILE_NOT_FOUND" }, |
358 | | { 0x3, "PATH_NOT_FOUND" }, |
359 | | { 0x4, "TOO_MANY_OPEN_FILES" }, |
360 | | { 0x5, "ACCESS_DENIED" }, |
361 | | { 0x6, "INVALID_HANDLE" }, |
362 | | { 0, NULL } |
363 | | }; |
364 | | |
365 | | |
366 | | static bool dissect_procmon_process_event(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, uint32_t operation, tvbuff_t* extra_details_tvb _U_) |
367 | 0 | { |
368 | 0 | proto_tree* process_tree; |
369 | 0 | unsigned offset = 0; |
370 | 0 | bool handle_extra_details = false; |
371 | |
|
372 | 0 | process_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_process_event, NULL, "Process Data"); |
373 | |
|
374 | 0 | switch(operation) { |
375 | 0 | case PROCMON_PROCESS_OPERATION_DEFINED: |
376 | 0 | case PROCMON_PROCESS_OPERATION_CREATE: |
377 | 0 | { |
378 | 0 | bool is_path_ascii, is_commandline_ascii; |
379 | 0 | uint16_t path_char_count, commandline_char_count; |
380 | | |
381 | | //Unknown fields |
382 | 0 | offset += 4; |
383 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_pid, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
384 | 0 | offset += 4; |
385 | | //Unknown fields |
386 | 0 | offset += 36; |
387 | 0 | uint8_t unknown_size1 = tvb_get_uint8(tvb, offset); |
388 | 0 | offset += 1; |
389 | 0 | uint8_t unknown_size2 = tvb_get_uint8(tvb, offset); |
390 | 0 | offset += 1; |
391 | 0 | dissect_procmon_detail_string_info(tvb, process_tree, offset, |
392 | 0 | hf_procmon_process_path_size, hf_procmon_process_path_is_ascii, hf_procmon_process_path_char_count, ett_procmon_process_path, |
393 | 0 | &is_path_ascii, &path_char_count); |
394 | 0 | offset += 2; |
395 | 0 | dissect_procmon_detail_string_info(tvb, process_tree, offset, |
396 | 0 | hf_procmon_process_commandline_size, hf_procmon_process_commandline_is_ascii, hf_procmon_process_commandline_char_count, ett_procmon_process_commandline, |
397 | 0 | &is_commandline_ascii, &commandline_char_count); |
398 | 0 | offset += 2; |
399 | | //Unknown fields |
400 | 0 | offset += 2; |
401 | 0 | offset += unknown_size1; |
402 | 0 | offset += unknown_size2; |
403 | 0 | offset = dissect_procmon_detail_string(tvb, process_tree, offset, is_path_ascii, path_char_count, hf_procmon_process_path); |
404 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, process_tree, offset, is_commandline_ascii, commandline_char_count, hf_procmon_process_commandline); |
405 | |
|
406 | 0 | break; |
407 | 0 | } |
408 | 0 | case PROCMON_PROCESS_OPERATION_EXIT: |
409 | 0 | { |
410 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_exit_status, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
411 | 0 | offset += 4; |
412 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_kernel_time, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
413 | 0 | offset += 8; |
414 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_user_time, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
415 | 0 | offset += 8; |
416 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_working_set, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
417 | 0 | offset += 8; |
418 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_peak_working_set, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
419 | 0 | offset += 8; |
420 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_private_bytes, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
421 | 0 | offset += 8; |
422 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_peak_private_bytes, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
423 | | /* offset += 8; */ |
424 | 0 | break; |
425 | 0 | } |
426 | 0 | case PROCMON_PROCESS_OPERATION_THREAD_CREATE: |
427 | 0 | { |
428 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_thread_id, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
429 | | /* offset += 4; */ |
430 | 0 | break; |
431 | 0 | } |
432 | 0 | case PROCMON_PROCESS_OPERATION_THREAD_EXIT: |
433 | 0 | case PROCMON_PROCESS_OPERATION_PROCESS_STATISTICS: |
434 | 0 | { |
435 | | //Unknown fields |
436 | 0 | offset += 4; |
437 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_kernel_time, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
438 | 0 | offset += 8; |
439 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_user_time, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
440 | | /* offset += 8; */ |
441 | 0 | break; |
442 | 0 | } |
443 | 0 | case PROCMON_PROCESS_OPERATION_LOAD_IMAGE: |
444 | 0 | { |
445 | 0 | bool is_path_ascii; |
446 | 0 | uint16_t path_char_count; |
447 | |
|
448 | 0 | if (pinfo->pseudo_header->procmon.system_bitness) |
449 | 0 | { |
450 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_image_base, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
451 | 0 | offset += 8; |
452 | 0 | } |
453 | 0 | else |
454 | 0 | { |
455 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_image_base, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
456 | 0 | offset += 4; |
457 | 0 | } |
458 | |
|
459 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_image_size, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
460 | 0 | offset += 4; |
461 | 0 | dissect_procmon_detail_string_info(tvb, process_tree, offset, |
462 | 0 | hf_procmon_process_path_size, hf_procmon_process_path_is_ascii, hf_procmon_process_path_char_count, ett_procmon_process_path, |
463 | 0 | &is_path_ascii, &path_char_count); |
464 | 0 | offset += 2; |
465 | | //Unknown fields |
466 | 0 | offset += 2; |
467 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, process_tree, offset, is_path_ascii, path_char_count, hf_procmon_process_path); |
468 | 0 | break; |
469 | 0 | } |
470 | 0 | case PROCMON_PROCESS_OPERATION_THREAD_PROFILE: |
471 | | //Unknown |
472 | 0 | break; |
473 | 0 | case PROCMON_PROCESS_OPERATION_PROCESS_START: |
474 | 0 | { |
475 | 0 | bool is_commandline_ascii, is_curdir_ascii; |
476 | 0 | uint16_t commandline_char_count, curdir_char_count; |
477 | 0 | uint32_t environment_char_count; |
478 | |
|
479 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_parent_pid, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
480 | 0 | offset += 4; |
481 | 0 | dissect_procmon_detail_string_info(tvb, process_tree, offset, |
482 | 0 | hf_procmon_process_commandline_size, hf_procmon_process_commandline_is_ascii, hf_procmon_process_commandline_char_count, ett_procmon_process_commandline, |
483 | 0 | &is_commandline_ascii, &commandline_char_count); |
484 | 0 | offset += 2; |
485 | 0 | dissect_procmon_detail_string_info(tvb, process_tree, offset, |
486 | 0 | hf_procmon_process_curdir_size, hf_procmon_process_curdir_is_ascii, hf_procmon_process_curdir_char_count, ett_procmon_process_curdir, |
487 | 0 | &is_curdir_ascii, &curdir_char_count); |
488 | 0 | offset += 2; |
489 | 0 | proto_tree_add_item_ret_uint(process_tree, hf_procmon_process_environment_char_count, tvb, offset, 4, ENC_LITTLE_ENDIAN, &environment_char_count); |
490 | 0 | offset += 4; |
491 | 0 | offset = dissect_procmon_detail_string(tvb, process_tree, offset, is_commandline_ascii, commandline_char_count, hf_procmon_process_commandline); |
492 | 0 | offset = dissect_procmon_detail_string(tvb, process_tree, offset, is_curdir_ascii, curdir_char_count, hf_procmon_process_curdir); |
493 | 0 | proto_tree_add_item(process_tree, hf_procmon_process_environment, tvb, offset, environment_char_count*2, ENC_UTF_16|ENC_LITTLE_ENDIAN); |
494 | 0 | break; |
495 | 0 | } |
496 | 0 | case PROCMON_PROCESS_OPERATION_SYSTEM_STATISTICS: |
497 | | //Unknown |
498 | 0 | break; |
499 | 0 | } |
500 | 0 | return handle_extra_details; |
501 | 0 | } |
502 | | |
503 | 0 | #define PROCMON_REGISTRY_OPERATION_OPEN_KEY 0x0000 |
504 | 0 | #define PROCMON_REGISTRY_OPERATION_CREATE_KEY 0x0001 |
505 | 0 | #define PROCMON_REGISTRY_OPERATION_CLOSE_KEY 0x0002 |
506 | 0 | #define PROCMON_REGISTRY_OPERATION_QUERY_KEY 0x0003 |
507 | 0 | #define PROCMON_REGISTRY_OPERATION_SET_VALUE 0x0004 |
508 | 0 | #define PROCMON_REGISTRY_OPERATION_QUERY_VALUE 0x0005 |
509 | 0 | #define PROCMON_REGISTRY_OPERATION_ENUM_VALUE 0x0006 |
510 | 0 | #define PROCMON_REGISTRY_OPERATION_ENUM_KEY 0x0007 |
511 | 0 | #define PROCMON_REGISTRY_OPERATION_SET_INFO_KEY 0x0008 |
512 | 0 | #define PROCMON_REGISTRY_OPERATION_DELETE_KEY 0x0009 |
513 | 0 | #define PROCMON_REGISTRY_OPERATION_DELETE_VALUE 0x000A |
514 | 0 | #define PROCMON_REGISTRY_OPERATION_FLUSH_KEY 0x000B |
515 | 0 | #define PROCMON_REGISTRY_OPERATION_LOAD_KEY 0x000C |
516 | 0 | #define PROCMON_REGISTRY_OPERATION_UNLOAD_KEY 0x000D |
517 | 0 | #define PROCMON_REGISTRY_OPERATION_RENAME_KEY 0x000E |
518 | 0 | #define PROCMON_REGISTRY_OPERATION_QUERY_MULTIPLE_VALUE 0x000F |
519 | 0 | #define PROCMON_REGISTRY_OPERATION_SET_KEY_SECURITY 0x0010 |
520 | 0 | #define PROCMON_REGISTRY_OPERATION_QUERY_KEY_SECURITY 0x0011 |
521 | | |
522 | | static const value_string registry_operation_vals[] = { |
523 | | { PROCMON_REGISTRY_OPERATION_OPEN_KEY, "Open Key" }, |
524 | | { PROCMON_REGISTRY_OPERATION_CREATE_KEY, "Create Key" }, |
525 | | { PROCMON_REGISTRY_OPERATION_CLOSE_KEY, "Close Key" }, |
526 | | { PROCMON_REGISTRY_OPERATION_QUERY_KEY, "Query Key" }, |
527 | | { PROCMON_REGISTRY_OPERATION_SET_VALUE, "Set Value" }, |
528 | | { PROCMON_REGISTRY_OPERATION_QUERY_VALUE, "Query Value" }, |
529 | | { PROCMON_REGISTRY_OPERATION_ENUM_VALUE, "Enum Value" }, |
530 | | { PROCMON_REGISTRY_OPERATION_ENUM_KEY, "Enum Key" }, |
531 | | { PROCMON_REGISTRY_OPERATION_SET_INFO_KEY, "Set Info Key" }, |
532 | | { PROCMON_REGISTRY_OPERATION_DELETE_KEY, "Delete Key" }, |
533 | | { PROCMON_REGISTRY_OPERATION_DELETE_VALUE, "Delete Value" }, |
534 | | { PROCMON_REGISTRY_OPERATION_FLUSH_KEY, "Flush Key" }, |
535 | | { PROCMON_REGISTRY_OPERATION_LOAD_KEY, "Load Key" }, |
536 | | { PROCMON_REGISTRY_OPERATION_UNLOAD_KEY, "Unload Key" }, |
537 | | { PROCMON_REGISTRY_OPERATION_RENAME_KEY, "Rename Key" }, |
538 | | { PROCMON_REGISTRY_OPERATION_QUERY_MULTIPLE_VALUE, "Query Multiple Value" }, |
539 | | { PROCMON_REGISTRY_OPERATION_SET_KEY_SECURITY, "Set Key Security" }, |
540 | | { PROCMON_REGISTRY_OPERATION_QUERY_KEY_SECURITY, "Query Key Security" }, |
541 | | { 0, NULL } |
542 | | }; |
543 | | |
544 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_BASIC 0 |
545 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NODE 1 |
546 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FULL 2 |
547 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NAME 3 |
548 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_CACHED 4 |
549 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FLAGS 5 |
550 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_VIRTUALIZATION 6 |
551 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_HANDLE_TAGS 7 |
552 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_TRUST 8 |
553 | 0 | #define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_LAYER 9 |
554 | | |
555 | | static const value_string registry_key_information_class_vals[] = { |
556 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_BASIC, "Basic" }, |
557 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NODE, "Node" }, |
558 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FULL, "Full" }, |
559 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NAME, "Name" }, |
560 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_CACHED, "Cached" }, |
561 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FLAGS, "Flags" }, |
562 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_VIRTUALIZATION, "Virtualization" }, |
563 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_HANDLE_TAGS, "Handle Tags" }, |
564 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_TRUST, "Trust" }, |
565 | | { PROCMON_REGISTRY_KEY_INFORMATION_CLASS_LAYER, "Layer" }, |
566 | | { 0, NULL } |
567 | | }; |
568 | | |
569 | 0 | #define PROCMON_REGISTRY_KEY_SET_INFORMATION_WRITE_TIME_INFO 0 |
570 | 0 | #define PROCMON_REGISTRY_KEY_SET_INFORMATION_WOW64_FLAGS_INFO 1 |
571 | 0 | #define PROCMON_REGISTRY_KEY_SET_INFORMATION_HANDLE_TAGS_INFO 2 |
572 | | |
573 | | static const value_string registry_value_set_information_class_vals[] = { |
574 | | { PROCMON_REGISTRY_KEY_SET_INFORMATION_WRITE_TIME_INFO, "Write Time" }, |
575 | | { PROCMON_REGISTRY_KEY_SET_INFORMATION_WOW64_FLAGS_INFO, "WOW64 Flags" }, |
576 | | { PROCMON_REGISTRY_KEY_SET_INFORMATION_HANDLE_TAGS_INFO, "Set Handle Tags" }, |
577 | | { 0, NULL } |
578 | | }; |
579 | | |
580 | | |
581 | | |
582 | | #define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_BASIC 0 |
583 | 0 | #define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL 1 |
584 | 0 | #define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL 2 |
585 | | #define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL_ALIGN64 3 |
586 | | #define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL_ALIGN64 4 |
587 | | #define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_LAYER 5 |
588 | | |
589 | | static const value_string registry_value_information_class_vals[] = { |
590 | | { PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_BASIC, "Basic" }, |
591 | | { PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL, "Full" }, |
592 | | { PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL, "Partial" }, |
593 | | { PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL_ALIGN64, "Full Align64" }, |
594 | | { PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL_ALIGN64, "Partial Align64" }, |
595 | | { PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_LAYER, "Layer" }, |
596 | | { 0, NULL } |
597 | | }; |
598 | | |
599 | | #define PROCMON_REGISTRY_DISPOSITION_CREATED_NEW_KEY 1 |
600 | | #define PROCMON_REGISTRY_DISPOSITION_OPENED_EXISTING_KEY 2 |
601 | | |
602 | | static const value_string registry_disposition_vals[] = { |
603 | | { PROCMON_REGISTRY_DISPOSITION_CREATED_NEW_KEY, "Created Key" }, |
604 | | { PROCMON_REGISTRY_DISPOSITION_OPENED_EXISTING_KEY, "Open Existing" }, |
605 | | { 0, NULL } |
606 | | }; |
607 | | |
608 | | static int procmon_registry_query_or_enum_key_extra_details(proto_tree* tree, tvbuff_t* tvb, uint32_t information_class) |
609 | 0 | { |
610 | 0 | uint32_t name_size; |
611 | 0 | unsigned offset = 0; |
612 | |
|
613 | 0 | switch (information_class) |
614 | 0 | { |
615 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NAME: |
616 | 0 | proto_tree_add_item_ret_uint(tree, hf_procmon_registry_key_name_size, tvb, offset, 4, ENC_LITTLE_ENDIAN, &name_size); |
617 | 0 | offset += 4; |
618 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_name, tvb, offset, name_size, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
619 | 0 | offset += name_size; |
620 | 0 | break; |
621 | | |
622 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_HANDLE_TAGS: |
623 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_handle_tags, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
624 | 0 | offset += 4; |
625 | 0 | break; |
626 | | |
627 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FLAGS: |
628 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_flags, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
629 | 0 | offset += 4; |
630 | 0 | break; |
631 | | |
632 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_CACHED: |
633 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_last_write_time, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
634 | 0 | offset += 8; |
635 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_title_index, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
636 | 0 | offset += 4; |
637 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_subkeys, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
638 | 0 | offset += 4; |
639 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_max_name_len, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
640 | 0 | offset += 4; |
641 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_values, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
642 | 0 | offset += 4; |
643 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_max_value_name_len, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
644 | 0 | offset += 4; |
645 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_max_value_data_len, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
646 | 0 | offset += 4; |
647 | 0 | break; |
648 | | |
649 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_BASIC: |
650 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_last_write_time, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
651 | 0 | offset += 8; |
652 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_title_index, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
653 | 0 | offset += 4; |
654 | 0 | proto_tree_add_item_ret_uint(tree, hf_procmon_registry_key_name_size, tvb, offset, 4, ENC_LITTLE_ENDIAN, &name_size); |
655 | 0 | offset += 4; |
656 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_name, tvb, offset, name_size, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
657 | 0 | offset += name_size; |
658 | 0 | break; |
659 | | |
660 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FULL: |
661 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_last_write_time, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
662 | 0 | offset += 8; |
663 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_title_index, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
664 | 0 | offset += 4; |
665 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_class_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
666 | 0 | offset += 4; |
667 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_class_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
668 | 0 | offset += 4; |
669 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_subkeys, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
670 | 0 | offset += 4; |
671 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_max_name_len, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
672 | 0 | offset += 4; |
673 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_max_class_len, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
674 | 0 | offset += 4; |
675 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_values, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
676 | 0 | offset += 4; |
677 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_max_value_name_len, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
678 | 0 | offset += 4; |
679 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_max_value_data_len, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
680 | 0 | offset += 4; |
681 | 0 | break; |
682 | | |
683 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NODE: |
684 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_last_write_time, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
685 | 0 | offset += 8; |
686 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_title_index, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
687 | 0 | offset += 4; |
688 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_class_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
689 | 0 | offset += 4; |
690 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_class_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
691 | 0 | offset += 4; |
692 | 0 | proto_tree_add_item_ret_uint(tree, hf_procmon_registry_key_name_size, tvb, offset, 4, ENC_LITTLE_ENDIAN, &name_size); |
693 | 0 | offset += 4; |
694 | 0 | proto_tree_add_item(tree, hf_procmon_registry_key_name, tvb, offset, name_size, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
695 | 0 | offset += name_size; |
696 | 0 | break; |
697 | | |
698 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_VIRTUALIZATION: |
699 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_TRUST: |
700 | 0 | case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_LAYER: |
701 | | //No extra data (or unknown) |
702 | 0 | break; |
703 | 0 | } |
704 | | |
705 | 0 | return offset; |
706 | 0 | } |
707 | | |
708 | | #define PROCMON_REGISTRY_VALUE_REG_TYPE_NONE 0 |
709 | 0 | #define PROCMON_REGISTRY_VALUE_REG_TYPE_SZ 1 |
710 | 0 | #define PROCMON_REGISTRY_VALUE_REG_TYPE_EXPAND_SZ 2 |
711 | 0 | #define PROCMON_REGISTRY_VALUE_REG_TYPE_BINARY 3 |
712 | 0 | #define PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD 4 |
713 | | #define PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD_BIG_ENDIAN 5 |
714 | | #define PROCMON_REGISTRY_VALUE_REG_TYPE_LINK 6 |
715 | 0 | #define PROCMON_REGISTRY_VALUE_REG_TYPE_MULTI_SZ 7 |
716 | | #define PROCMON_REGISTRY_VALUE_REG_TYPE_RESOURCE_LIST 8 |
717 | | #define PROCMON_REGISTRY_VALUE_REG_TYPE_FULL_RESOURCE_DESCRIPTOR 9 |
718 | | #define PROCMON_REGISTRY_VALUE_REG_TYPE_RESOURCE_REQUIREMENTS_LIST 10 |
719 | 0 | #define PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD 11 |
720 | | #define PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD_BIG_ENDIAN 12 |
721 | | |
722 | | static const value_string registry_value_reg_type_vals[] = { |
723 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_NONE, "REG_NONE" }, |
724 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_SZ, "REG_SZ" }, |
725 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_EXPAND_SZ, "REG_EXPAND_SZ" }, |
726 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_BINARY, "REG_BINARY" }, |
727 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD, "REG_DWORD" }, |
728 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD_BIG_ENDIAN, "REG_DWORD_BIG_ENDIAN" }, |
729 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_LINK, "REG_LINK" }, |
730 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_MULTI_SZ, "REG_MULTI_SZ" }, |
731 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_RESOURCE_LIST, "REG_RESOURCE_LIST" }, |
732 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_FULL_RESOURCE_DESCRIPTOR, "REG_FULL_RESOURCE_DESCRIPTOR" }, |
733 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_RESOURCE_REQUIREMENTS_LIST, "REG_RESOURCE_REQUIREMENTS_LIST" }, |
734 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD, "REG_QWORD" }, |
735 | | { PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD_BIG_ENDIAN, "REG_QWORD_BIG_ENDIAN" }, |
736 | | { 0, NULL } |
737 | | }; |
738 | | |
739 | | static int procmon_read_registry_data(proto_tree* tree, packet_info* pinfo, tvbuff_t* tvb, int offset, uint32_t type, uint32_t length) |
740 | 0 | { |
741 | 0 | switch (type) |
742 | 0 | { |
743 | 0 | case PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD: |
744 | 0 | proto_tree_add_item(tree, hf_procmon_registry_value_dword, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
745 | 0 | offset += 4; |
746 | 0 | break; |
747 | 0 | case PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD: |
748 | 0 | proto_tree_add_item(tree, hf_procmon_registry_value_qword, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
749 | 0 | offset += 8; |
750 | 0 | break; |
751 | 0 | case PROCMON_REGISTRY_VALUE_REG_TYPE_SZ: |
752 | 0 | case PROCMON_REGISTRY_VALUE_REG_TYPE_EXPAND_SZ: |
753 | 0 | proto_tree_add_item(tree, hf_procmon_registry_value_sz, tvb, offset, -1, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
754 | 0 | offset += tvb_reported_length(tvb); |
755 | 0 | break; |
756 | 0 | case PROCMON_REGISTRY_VALUE_REG_TYPE_BINARY: |
757 | 0 | proto_tree_add_item(tree, hf_procmon_registry_value_binary, tvb, offset, -1, ENC_NA); |
758 | 0 | offset += tvb_reported_length(tvb); |
759 | 0 | break; |
760 | 0 | case PROCMON_REGISTRY_VALUE_REG_TYPE_MULTI_SZ: |
761 | 0 | { |
762 | 0 | unsigned str_length, total_length = 0; |
763 | 0 | int start_offset = offset; |
764 | 0 | const char* substring; |
765 | 0 | wmem_strbuf_t* full_string = wmem_strbuf_new(pinfo->pool, ""); |
766 | |
|
767 | 0 | while ((total_length < length) && ((substring = (char*)tvb_get_stringz_enc(pinfo->pool, tvb, offset, &str_length, ENC_UTF_16 | ENC_LITTLE_ENDIAN)) != NULL)) |
768 | 0 | { |
769 | 0 | offset += str_length; |
770 | 0 | total_length += str_length; |
771 | 0 | if (strlen(substring) > 0) |
772 | 0 | wmem_strbuf_append_printf(full_string, " %s", substring); |
773 | 0 | else |
774 | 0 | break; |
775 | 0 | } |
776 | |
|
777 | 0 | proto_tree_add_string(tree, hf_procmon_registry_value_multi_sz, tvb, start_offset, offset - start_offset, wmem_strbuf_get_str(full_string)); |
778 | 0 | break; |
779 | 0 | } |
780 | 0 | } |
781 | | |
782 | 0 | return offset; |
783 | 0 | } |
784 | | |
785 | | static int procmon_registry_query_or_enum_value_extra_details(proto_tree* tree, packet_info* pinfo, tvbuff_t* tvb, uint32_t information_class) |
786 | 0 | { |
787 | 0 | unsigned offset = 0; |
788 | 0 | uint32_t length = 0, type, name_size; |
789 | | |
790 | | //Unknown fields |
791 | 0 | offset += 4; |
792 | |
|
793 | 0 | proto_tree_add_item_ret_uint(tree, hf_procmon_registry_value_reg_type, tvb, offset, 4, ENC_LITTLE_ENDIAN, &type); |
794 | 0 | offset += 4; |
795 | |
|
796 | 0 | switch (information_class) |
797 | 0 | { |
798 | 0 | case PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL: |
799 | 0 | proto_tree_add_item(tree, hf_procmon_registry_value_offset_to_data, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
800 | 0 | offset += 4; |
801 | 0 | proto_tree_add_item_ret_uint(tree, hf_procmon_registry_value_length, tvb, offset, 4, ENC_LITTLE_ENDIAN, &length); |
802 | 0 | offset += 4; |
803 | 0 | proto_tree_add_item_ret_uint(tree, hf_procmon_registry_value_name_size, tvb, offset, 4, ENC_LITTLE_ENDIAN, &name_size); |
804 | 0 | offset += 4; |
805 | 0 | proto_tree_add_item(tree, hf_procmon_registry_value_name, tvb, offset, name_size, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
806 | 0 | offset += name_size; |
807 | 0 | break; |
808 | 0 | case PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL: |
809 | 0 | proto_tree_add_item_ret_uint(tree, hf_procmon_registry_value_length, tvb, offset, 4, ENC_LITTLE_ENDIAN, &length); |
810 | 0 | offset += 4; |
811 | 0 | break; |
812 | 0 | } |
813 | | |
814 | 0 | if (length > 0) |
815 | 0 | offset += procmon_read_registry_data(tree, pinfo, tvb, offset, type, length); |
816 | |
|
817 | 0 | return offset; |
818 | 0 | } |
819 | | |
820 | | static bool dissect_procmon_registry_event(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, uint32_t operation, tvbuff_t* extra_details_tvb) |
821 | 0 | { |
822 | 0 | proto_tree* registry_tree; |
823 | 0 | int offset = 0, extra_offset = 0; |
824 | 0 | bool is_value_ascii, is_new_value_ascii; |
825 | 0 | uint32_t information_class, type; |
826 | 0 | uint16_t value_char_count, new_value_char_count; |
827 | 0 | uint32_t registry_access_mask_mapping[4] = { 0x20019, 0x20006, 0x20019, 0xf003f }; |
828 | |
|
829 | 0 | registry_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_registry_event, NULL, "Registry Data"); |
830 | |
|
831 | 0 | switch(operation) { |
832 | 0 | case PROCMON_REGISTRY_OPERATION_OPEN_KEY: |
833 | 0 | case PROCMON_REGISTRY_OPERATION_CREATE_KEY: |
834 | 0 | { |
835 | 0 | static const value_string desired_access_vals[] = { |
836 | 0 | {0xf003f, "All Access"}, |
837 | 0 | {0x2001f, "Read/Write"}, |
838 | 0 | {0x20019, "Read"}, |
839 | 0 | {0x20006, "Write"}, |
840 | 0 | {0x1, "Query Value"}, |
841 | 0 | {0x2, "Set Value"}, |
842 | 0 | {0x4, "Create Sub Key"}, |
843 | 0 | {0x8, "Enumerate Sub Keys"}, |
844 | 0 | {0x10, "Notify"}, |
845 | 0 | {0x20, "Create Link"}, |
846 | 0 | {0x300, "WOW64_Res"}, |
847 | 0 | {0x200, "WOW64_32Key"}, |
848 | 0 | {0x100, "WOW64_64Key"}, |
849 | 0 | {0x10000, "Delete"}, |
850 | 0 | {0x20000, "Read Control"}, |
851 | 0 | {0x40000, "Write DAC"}, |
852 | 0 | {0x80000, "Write Owner"}, |
853 | 0 | {0x100000, "Synchronize"}, |
854 | 0 | {0x1000000, "Access System Security"}, |
855 | 0 | {0x2000000, "Maximum Allowed"}, |
856 | 0 | { 0, NULL } |
857 | 0 | }; |
858 | 0 | uint32_t desired_access; |
859 | |
|
860 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
861 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
862 | 0 | &is_value_ascii, &value_char_count); |
863 | 0 | offset += 2; |
864 | | |
865 | | //Unknown fields |
866 | 0 | offset += 2; |
867 | |
|
868 | 0 | desired_access = tvb_get_letohl(tvb, offset); |
869 | 0 | dissect_procmon_access_mask(tvb, pinfo, registry_tree, offset, hf_procmon_registry_desired_access, 4, registry_access_mask_mapping, desired_access_vals); |
870 | 0 | offset += 4; |
871 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
872 | |
|
873 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
874 | 0 | { |
875 | 0 | if (desired_access & 0x2000000) |
876 | 0 | dissect_procmon_access_mask(extra_details_tvb, pinfo, registry_tree, extra_offset, hf_procmon_registry_granted_access, 4, registry_access_mask_mapping, desired_access_vals); |
877 | |
|
878 | 0 | extra_offset += 4; |
879 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_disposition, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN); |
880 | 0 | extra_offset += 4; |
881 | 0 | } |
882 | 0 | break; |
883 | 0 | } |
884 | 0 | case PROCMON_REGISTRY_OPERATION_CLOSE_KEY: |
885 | 0 | case PROCMON_REGISTRY_OPERATION_FLUSH_KEY: |
886 | 0 | case PROCMON_REGISTRY_OPERATION_UNLOAD_KEY: |
887 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
888 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
889 | 0 | &is_value_ascii, &value_char_count); |
890 | 0 | offset += 2; |
891 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
892 | 0 | break; |
893 | | |
894 | 0 | case PROCMON_REGISTRY_OPERATION_QUERY_KEY: |
895 | 0 | { |
896 | 0 | proto_item* info_item; |
897 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
898 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
899 | 0 | &is_value_ascii, &value_char_count); |
900 | 0 | offset += 2; |
901 | | |
902 | | //Unknown fields |
903 | 0 | offset += 2; |
904 | |
|
905 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
906 | 0 | offset += 4; |
907 | 0 | info_item = proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_key_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN, &information_class); |
908 | 0 | if (try_val_to_str(information_class, registry_key_information_class_vals) == NULL) |
909 | 0 | expert_add_info_format(pinfo, info_item, &ei_procmon_unknown_operation, "Unknown Registry Key Information Class: %u", information_class); |
910 | 0 | offset += 4; |
911 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
912 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
913 | 0 | extra_offset += procmon_registry_query_or_enum_key_extra_details(registry_tree, extra_details_tvb, information_class); |
914 | 0 | break; |
915 | 0 | } |
916 | 0 | case PROCMON_REGISTRY_OPERATION_QUERY_VALUE: |
917 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
918 | 0 | hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value, |
919 | 0 | &is_value_ascii, &value_char_count); |
920 | 0 | offset += 2; |
921 | | |
922 | | //Unknown fields |
923 | 0 | offset += 2; |
924 | |
|
925 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
926 | 0 | offset += 4; |
927 | 0 | proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_value_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN, &information_class); |
928 | 0 | offset += 4; |
929 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value); |
930 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
931 | 0 | extra_offset += procmon_registry_query_or_enum_value_extra_details(registry_tree, pinfo, extra_details_tvb, information_class); |
932 | 0 | break; |
933 | | |
934 | 0 | case PROCMON_REGISTRY_OPERATION_ENUM_KEY: |
935 | 0 | { |
936 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
937 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
938 | 0 | &is_value_ascii, &value_char_count); |
939 | 0 | offset += 2; |
940 | | |
941 | | //Unknown fields |
942 | 0 | offset += 2; |
943 | |
|
944 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
945 | 0 | offset += 4; |
946 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_index, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
947 | 0 | offset += 4; |
948 | 0 | proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_key_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN, &information_class); |
949 | 0 | offset += 4; |
950 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
951 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
952 | 0 | extra_offset += procmon_registry_query_or_enum_key_extra_details(registry_tree, extra_details_tvb, information_class); |
953 | 0 | break; |
954 | 0 | } |
955 | 0 | case PROCMON_REGISTRY_OPERATION_ENUM_VALUE: |
956 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
957 | 0 | hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value, |
958 | 0 | &is_value_ascii, &value_char_count); |
959 | 0 | offset += 2; |
960 | | |
961 | | //Unknown fields |
962 | 0 | offset += 2; |
963 | |
|
964 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
965 | 0 | offset += 4; |
966 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_index, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
967 | 0 | offset += 4; |
968 | 0 | proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_value_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN, &information_class); |
969 | 0 | offset += 4; |
970 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value); |
971 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
972 | 0 | extra_offset += procmon_registry_query_or_enum_value_extra_details(registry_tree, pinfo, extra_details_tvb, information_class); |
973 | 0 | break; |
974 | | |
975 | 0 | case PROCMON_REGISTRY_OPERATION_SET_VALUE: |
976 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
977 | 0 | hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value, |
978 | 0 | &is_value_ascii, &value_char_count); |
979 | 0 | offset += 2; |
980 | | |
981 | | //Unknown fields |
982 | 0 | offset += 2; |
983 | |
|
984 | 0 | proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_type, tvb, offset, 4, ENC_LITTLE_ENDIAN, &type); |
985 | 0 | offset += 4; |
986 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
987 | 0 | offset += 4; |
988 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_data_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
989 | 0 | offset += 4; |
990 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value); |
991 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
992 | 0 | extra_offset += procmon_read_registry_data(registry_tree, pinfo, extra_details_tvb, extra_offset, type, tvb_reported_length(extra_details_tvb)); |
993 | 0 | break; |
994 | 0 | case PROCMON_REGISTRY_OPERATION_SET_INFO_KEY: |
995 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
996 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
997 | 0 | &is_value_ascii, &value_char_count); |
998 | 0 | offset += 2; |
999 | | |
1000 | | //Unknown fields |
1001 | 0 | offset += 2; |
1002 | |
|
1003 | 0 | proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_key_set_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN, &information_class); |
1004 | 0 | offset += 4; |
1005 | | |
1006 | | //Unknown fields |
1007 | 0 | offset += 4; |
1008 | |
|
1009 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 2, ENC_LITTLE_ENDIAN); |
1010 | 0 | offset += 2; |
1011 | | |
1012 | | //Unknown fields |
1013 | 0 | offset += 2; |
1014 | | |
1015 | | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
1016 | |
|
1017 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
1018 | 0 | { |
1019 | 0 | switch (information_class) |
1020 | 0 | { |
1021 | 0 | case PROCMON_REGISTRY_KEY_SET_INFORMATION_WRITE_TIME_INFO: |
1022 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_key_set_information_write_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
1023 | 0 | extra_offset += 8; |
1024 | 0 | break; |
1025 | 0 | case PROCMON_REGISTRY_KEY_SET_INFORMATION_WOW64_FLAGS_INFO: |
1026 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_key_set_information_wow64_flags, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN); |
1027 | 0 | extra_offset += 4; |
1028 | 0 | break; |
1029 | 0 | case PROCMON_REGISTRY_KEY_SET_INFORMATION_HANDLE_TAGS_INFO: |
1030 | 0 | proto_tree_add_item(registry_tree, hf_procmon_registry_key_set_information_handle_tags, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN); |
1031 | 0 | extra_offset += 4; |
1032 | 0 | break; |
1033 | 0 | } |
1034 | 0 | } |
1035 | 0 | break; |
1036 | | |
1037 | 0 | case PROCMON_REGISTRY_OPERATION_DELETE_KEY: |
1038 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
1039 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
1040 | 0 | &is_value_ascii, &value_char_count); |
1041 | 0 | offset += 2; |
1042 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
1043 | 0 | break; |
1044 | | |
1045 | 0 | case PROCMON_REGISTRY_OPERATION_DELETE_VALUE: |
1046 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
1047 | 0 | hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value, |
1048 | 0 | &is_value_ascii, &value_char_count); |
1049 | 0 | offset += 2; |
1050 | | |
1051 | | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value); |
1052 | 0 | break; |
1053 | | |
1054 | 0 | case PROCMON_REGISTRY_OPERATION_LOAD_KEY: |
1055 | 0 | case PROCMON_REGISTRY_OPERATION_RENAME_KEY: |
1056 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
1057 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
1058 | 0 | &is_value_ascii, &value_char_count); |
1059 | 0 | offset += 2; |
1060 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
1061 | 0 | hf_procmon_registry_new_key_size, hf_procmon_registry_new_key_is_ascii, hf_procmon_registry_new_key_char_count, ett_procmon_registry_new_key, |
1062 | 0 | &is_new_value_ascii, &new_value_char_count); |
1063 | 0 | offset += 2; |
1064 | 0 | offset = dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
1065 | 0 | /* offset += */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_new_value_ascii, new_value_char_count, hf_procmon_registry_new_key); |
1066 | 0 | break; |
1067 | | |
1068 | 0 | case PROCMON_REGISTRY_OPERATION_QUERY_MULTIPLE_VALUE: |
1069 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
1070 | 0 | hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value, |
1071 | 0 | &is_value_ascii, &value_char_count); |
1072 | 0 | offset += 2; |
1073 | | |
1074 | | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value); |
1075 | 0 | break; |
1076 | | |
1077 | 0 | case PROCMON_REGISTRY_OPERATION_SET_KEY_SECURITY: |
1078 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
1079 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
1080 | 0 | &is_value_ascii, &value_char_count); |
1081 | 0 | offset += 2; |
1082 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
1083 | 0 | break; |
1084 | | |
1085 | 0 | case PROCMON_REGISTRY_OPERATION_QUERY_KEY_SECURITY: |
1086 | 0 | dissect_procmon_detail_string_info(tvb, registry_tree, offset, |
1087 | 0 | hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key, |
1088 | 0 | &is_value_ascii, &value_char_count); |
1089 | 0 | offset += 2; |
1090 | 0 | /* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key); |
1091 | 0 | break; |
1092 | 0 | } |
1093 | | |
1094 | 0 | return (extra_offset != 0); |
1095 | 0 | } |
1096 | | |
1097 | | #define PROCMON_FILESYSTEM_OPERATION_VOLUME_DISMOUNT 0 |
1098 | | #define PROCMON_FILESYSTEM_OPERATION_VOLUME_MOUNT 1 |
1099 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_MDL_WRITE_COMPLETE 2 |
1100 | | #define PROCMON_FILESYSTEM_OPERATION_WRITE_FILE2 3 |
1101 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_MDL_READ_COMPLETE 4 |
1102 | | #define PROCMON_FILESYSTEM_OPERATION_READ_FILE2 5 |
1103 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_OPEN 6 |
1104 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_CHECK_IF_POSSIBLE 7 |
1105 | | #define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_12 8 |
1106 | | #define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_11 9 |
1107 | | #define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_10 10 |
1108 | | #define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_9 11 |
1109 | | #define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_8 12 |
1110 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_NOTIFY_STREAM_FO_CREATION 13 |
1111 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_CC_FLUSH 14 |
1112 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_ACQUIRE_FOR_CC_FLUSH 15 |
1113 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_MOD_WRITE 16 |
1114 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_ACQUIRE_FOR_MOD_WRITE 17 |
1115 | | #define PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION 18 |
1116 | 0 | #define PROCMON_FILESYSTEM_OPERATION_CREATE_FILE_MAPPING 19 |
1117 | 0 | #define PROCMON_FILESYSTEM_OPERATION_CREATE_FILE 20 |
1118 | | #define PROCMON_FILESYSTEM_OPERATION_CREATE_PIPE 21 |
1119 | | #define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_CLOSE 22 |
1120 | 0 | #define PROCMON_FILESYSTEM_OPERATION_READ_FILE 23 |
1121 | 0 | #define PROCMON_FILESYSTEM_OPERATION_WRITE_FILE 24 |
1122 | 0 | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE 25 |
1123 | 0 | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE 26 |
1124 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_EA_FILE 27 |
1125 | | #define PROCMON_FILESYSTEM_OPERATION_SET_EA_FILE 28 |
1126 | | #define PROCMON_FILESYSTEM_OPERATION_FLUSH_BUFFERS_FILE 29 |
1127 | 0 | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION 30 |
1128 | 0 | #define PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION 31 |
1129 | 0 | #define PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL 32 |
1130 | 0 | #define PROCMON_FILESYSTEM_OPERATION_FILE_SYSTEM_CONTROL 33 |
1131 | 0 | #define PROCMON_FILESYSTEM_OPERATION_DEVICE_IO_CONTROL 34 |
1132 | | #define PROCMON_FILESYSTEM_OPERATION_INTERNAL_DEVICE_IO_CONTROL 35 |
1133 | | #define PROCMON_FILESYSTEM_OPERATION_SHUTDOWN 36 |
1134 | 0 | #define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE 37 |
1135 | | #define PROCMON_FILESYSTEM_OPERATION_CLOSE_FILE 38 |
1136 | | #define PROCMON_FILESYSTEM_OPERATION_CREATE_MAIL_SLOT 39 |
1137 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_SECURITY_FILE 40 |
1138 | | #define PROCMON_FILESYSTEM_OPERATION_SET_SECURITY_FILE 41 |
1139 | | #define PROCMON_FILESYSTEM_OPERATION_POWER 42 |
1140 | | #define PROCMON_FILESYSTEM_OPERATION_SYSTEM_CONTROL 43 |
1141 | | #define PROCMON_FILESYSTEM_OPERATION_DEVICE_CHANGE 44 |
1142 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_FILE_QUOTA 45 |
1143 | | #define PROCMON_FILESYSTEM_OPERATION_SET_FILE_QUOTA 46 |
1144 | 0 | #define PROCMON_FILESYSTEM_OPERATION_PLUG_AND_PLAY 47 |
1145 | | |
1146 | | static const value_string filesystem_operation_vals[] = { |
1147 | | { PROCMON_FILESYSTEM_OPERATION_VOLUME_DISMOUNT, "Volume Dismount" }, |
1148 | | { PROCMON_FILESYSTEM_OPERATION_VOLUME_MOUNT, "Volume Mount" }, |
1149 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_MDL_WRITE_COMPLETE, "Fast I/O MDL Write Complete" }, |
1150 | | { PROCMON_FILESYSTEM_OPERATION_WRITE_FILE2, "Write File 2" }, |
1151 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_MDL_READ_COMPLETE, "Fast I/O MDL Read Complete" }, |
1152 | | { PROCMON_FILESYSTEM_OPERATION_READ_FILE2, "Read File 2" }, |
1153 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_OPEN, "Query Open" }, |
1154 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_CHECK_IF_POSSIBLE, "Fast I/O Check If Possible" }, |
1155 | | { PROCMON_FILESYSTEM_OPERATION_IRP_MJ_12, "IRP_MJ_CLEANUP" }, |
1156 | | { PROCMON_FILESYSTEM_OPERATION_IRP_MJ_11, "IRP_MJ_SET_INFORMATION" }, |
1157 | | { PROCMON_FILESYSTEM_OPERATION_IRP_MJ_10, "IRP_MJ_QUERY_INFORMATION" }, |
1158 | | { PROCMON_FILESYSTEM_OPERATION_IRP_MJ_9, "IRP_MJ_FLUSH_BUFFERS" }, |
1159 | | { PROCMON_FILESYSTEM_OPERATION_IRP_MJ_8, "IRP_MJ_DIRECTORY_CONTROL" }, |
1160 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_NOTIFY_STREAM_FO_CREATION, "Fast I/O Notify Stream File Object Creation" }, |
1161 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_CC_FLUSH, "Fast I/O Release For Cache Manager Flush" }, |
1162 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_ACQUIRE_FOR_CC_FLUSH, "Fast I/O Acquire For Cache Manager Flush" }, |
1163 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_MOD_WRITE, "Fast I/O Release For Modified Write" }, |
1164 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_ACQUIRE_FOR_MOD_WRITE, "Fast I/O Acquire For Modified Write" }, |
1165 | | { PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION, "Fast I/O Release For Section Synchronization" }, |
1166 | | { PROCMON_FILESYSTEM_OPERATION_CREATE_FILE_MAPPING, "Create File Mapping" }, |
1167 | | { PROCMON_FILESYSTEM_OPERATION_CREATE_FILE, "Create File" }, |
1168 | | { PROCMON_FILESYSTEM_OPERATION_CREATE_PIPE, "Create Pipe" }, |
1169 | | { PROCMON_FILESYSTEM_OPERATION_IRP_MJ_CLOSE, "IRP_MJ_CLOSE" }, |
1170 | | { PROCMON_FILESYSTEM_OPERATION_READ_FILE, "Read File" }, |
1171 | | { PROCMON_FILESYSTEM_OPERATION_WRITE_FILE, "Write File" }, |
1172 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE, "Query Information File" }, |
1173 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE, "Set Information File" }, |
1174 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_EA_FILE, "Query EA File" }, |
1175 | | { PROCMON_FILESYSTEM_OPERATION_SET_EA_FILE, "Set EA File" }, |
1176 | | { PROCMON_FILESYSTEM_OPERATION_FLUSH_BUFFERS_FILE, "Flush Buffers File" }, |
1177 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION, "Query Volume Information" }, |
1178 | | { PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION, "Set Volume Information" }, |
1179 | | { PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL, "Directory Control" }, |
1180 | | { PROCMON_FILESYSTEM_OPERATION_FILE_SYSTEM_CONTROL, "File System Control" }, |
1181 | | { PROCMON_FILESYSTEM_OPERATION_DEVICE_IO_CONTROL, "Device I/O Control" }, |
1182 | | { PROCMON_FILESYSTEM_OPERATION_INTERNAL_DEVICE_IO_CONTROL, "Internal Device I/O Control" }, |
1183 | | { PROCMON_FILESYSTEM_OPERATION_SHUTDOWN, "Shutdown" }, |
1184 | | { PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE, "Lock/Unlock File" }, |
1185 | | { PROCMON_FILESYSTEM_OPERATION_CLOSE_FILE, "Close File" }, |
1186 | | { PROCMON_FILESYSTEM_OPERATION_CREATE_MAIL_SLOT, "Create Mail Slot" }, |
1187 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_SECURITY_FILE, "Query Security File" }, |
1188 | | { PROCMON_FILESYSTEM_OPERATION_SET_SECURITY_FILE, "Set Security File" }, |
1189 | | { PROCMON_FILESYSTEM_OPERATION_POWER, "Power" }, |
1190 | | { PROCMON_FILESYSTEM_OPERATION_SYSTEM_CONTROL, "System Control" }, |
1191 | | { PROCMON_FILESYSTEM_OPERATION_DEVICE_CHANGE, "Device Change" }, |
1192 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_FILE_QUOTA, "Query File Quota" }, |
1193 | | { PROCMON_FILESYSTEM_OPERATION_SET_FILE_QUOTA, "Set File Quota" }, |
1194 | | { PROCMON_FILESYSTEM_OPERATION_PLUG_AND_PLAY, "Plug and Play" }, |
1195 | | { 0, NULL } |
1196 | | }; |
1197 | | |
1198 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_BASIC 0x04 |
1199 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STANDARD 0x05 |
1200 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_INTERNAL 0x06 |
1201 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_EA 0x07 |
1202 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NAME 0x09 |
1203 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_POSITION 0x0E |
1204 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ALL 0x12 |
1205 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_END_OF_FILE 0x14 |
1206 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STREAM 0x16 |
1207 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_COMPRESSION 0x1C |
1208 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID 0x1D |
1209 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_MOVE_CLUSTER 0x1F |
1210 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NETWORK_OPEN 0x22 |
1211 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ATTRIBUTE_TAG 0x23 |
1212 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_BOTH_DIRECTORY 0x25 |
1213 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_VALID_DATA_LENGTH 0x27 |
1214 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_SHORT_NAME 0x28 |
1215 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_IO_PRIORITY_HINT 0x2B |
1216 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINKS 0x2E |
1217 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NAMES 0x2F |
1218 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NORMALIZED_NAME 0x30 |
1219 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NETWORK_PHYSICAL_NAME 0x31 |
1220 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_GLOBAL_TX_DIRECTORY 0x32 |
1221 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_IS_REMOTE_DEVICE 0x33 |
1222 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ATTRIBUTE_CACHE 0x34 |
1223 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NUMA_NODE 0x35 |
1224 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STANDARD_LINK 0x36 |
1225 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_REMOTE_PROTOCOL 0x37 |
1226 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_RENAME_BYPASS_ACCESS 0x38 |
1227 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINK_BYPASS_ACCESS 0x39 |
1228 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_VOLUME_NAME 0x3A |
1229 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_INFO 0x3B |
1230 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_EXTD_DIRECTORY 0x3C |
1231 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_HARD_LINK_FULL_ID 0x3E |
1232 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_EXTD_BOTH_DIRECTORY 0x3F |
1233 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_DESIRED_STORAGE_CLASS 0x43 |
1234 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STAT 0x44 |
1235 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_MEMORY_PARTITION 0x45 |
1236 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_SAT_LX 0x46 |
1237 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_CASE_SENSITIVE 0x47 |
1238 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINK_EX 0x48 |
1239 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STORAGE_RESERVED_ID 0x4A |
1240 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_CASE_SENSITIVE_FORCE_ACCESS 0x4B |
1241 | | |
1242 | | static const value_string filesystem_operation_query_info_vals[] = { |
1243 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_BASIC, "Basic"}, |
1244 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STANDARD, "Standard"}, |
1245 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_INTERNAL, "Internal"}, |
1246 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_EA, "EA"}, |
1247 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NAME, "Name"}, |
1248 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_POSITION, "Position"}, |
1249 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ALL, "All"}, |
1250 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_END_OF_FILE, "End of File"}, |
1251 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STREAM, "Stream"}, |
1252 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_COMPRESSION, "Compression"}, |
1253 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID, "ID"}, |
1254 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_MOVE_CLUSTER, "Move Cluster"}, |
1255 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NETWORK_OPEN, "Network Open"}, |
1256 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ATTRIBUTE_TAG, "Attribute Tag"}, |
1257 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_BOTH_DIRECTORY,"ID Both Directory"}, |
1258 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_VALID_DATA_LENGTH,"Valid Data Length"}, |
1259 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_SHORT_NAME, "Short Name"}, |
1260 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_IO_PRIORITY_HINT, "I/O Priority Hint"}, |
1261 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINKS, "Links"}, |
1262 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NAMES, "Names"}, |
1263 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NORMALIZED_NAME, "Normalized Name"}, |
1264 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NETWORK_PHYSICAL_NAME,"Network Physical Name"}, |
1265 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_GLOBAL_TX_DIRECTORY,"ID Global TX Directory"}, |
1266 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_IS_REMOTE_DEVICE, "Is Remote Device"}, |
1267 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ATTRIBUTE_CACHE, "Attribute Cache"}, |
1268 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NUMA_NODE, "NUMA Node"}, |
1269 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STANDARD_LINK, "Standard Link"}, |
1270 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_REMOTE_PROTOCOL, "Remote Protocol"}, |
1271 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_RENAME_BYPASS_ACCESS, "Rename Bypass Access"}, |
1272 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINK_BYPASS_ACCESS, "Link Bypass Access"}, |
1273 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_VOLUME_NAME, "Volume Name"}, |
1274 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_INFO, "ID Info"}, |
1275 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_EXTD_DIRECTORY, "ID Extended Directory"}, |
1276 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_HARD_LINK_FULL_ID, "Hard Link Full ID"}, |
1277 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_EXTD_BOTH_DIRECTORY, "ID Extended Both Directory"}, |
1278 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_DESIRED_STORAGE_CLASS, "Desired Storage Class"}, |
1279 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STAT, "Stat"}, |
1280 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_MEMORY_PARTITION, "Memory Partition"}, |
1281 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_SAT_LX, "SAT LX"}, |
1282 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_CASE_SENSITIVE, "Case Sensitive"}, |
1283 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINK_EX, "Link Ex"}, |
1284 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STORAGE_RESERVED_ID,"Storage Reserved ID"}, |
1285 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_CASE_SENSITIVE_FORCE_ACCESS,"Case Sensitive Force Access"}, |
1286 | | { 0, NULL } |
1287 | | }; |
1288 | | |
1289 | | |
1290 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_BASIC 0x04 |
1291 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME 0x0A |
1292 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_LINK 0x0B |
1293 | 0 | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION 0x0D |
1294 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_POSITION 0x0E |
1295 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_ALLOCATION 0x13 |
1296 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_END_OF_FILE 0x14 |
1297 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_STREAM 0x16 |
1298 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_PIPE 0x17 |
1299 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_VALID_DATA_LENGTH 0x27 |
1300 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_SHORT_NAME 0x28 |
1301 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_REPLACE_COMPLETION 0x3D |
1302 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION_EX 0x40 |
1303 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME_EX 0x41 |
1304 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME_EX_BYPASS_ACCESS 0x42 |
1305 | | #define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_STORAGE_RESERVE_ID 0x4A |
1306 | | |
1307 | | static const value_string filesystem_operation_set_info_vals[] = { |
1308 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_BASIC, "Basic" }, |
1309 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME, "Rename" }, |
1310 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_LINK, "Link" }, |
1311 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION, "Disposition" }, |
1312 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_POSITION, "Position" }, |
1313 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_ALLOCATION, "Allocation" }, |
1314 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_END_OF_FILE, "End of File" }, |
1315 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_STREAM, "Stream" }, |
1316 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_PIPE, "Pipe" }, |
1317 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_VALID_DATA_LENGTH, "Valid Data Length" }, |
1318 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_SHORT_NAME, "Short name" }, |
1319 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_REPLACE_COMPLETION,"Replace Completion" }, |
1320 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION_EX, "DispositionEx" }, |
1321 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME_EX, "RenameEx" }, |
1322 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME_EX_BYPASS_ACCESS, "RenameEx Bypass Access" }, |
1323 | | { PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_STORAGE_RESERVE_ID,"Storage Reserve ID" }, |
1324 | | { 0, NULL } |
1325 | | }; |
1326 | | |
1327 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_INFORMATION 0x1 |
1328 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_LABEL 0x2 |
1329 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_SIZE 0x3 |
1330 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_DEVICE 0x4 |
1331 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_ATTRIBUTE 0x5 |
1332 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_CONTROL 0x6 |
1333 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_FULL_SIZE 0x7 |
1334 | | #define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_OBJECT_ID 0x8 |
1335 | | |
1336 | | static const value_string filesystem_operation_query_volume_info_vals[] = { |
1337 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_INFORMATION, "Query Information" }, |
1338 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_LABEL, "Query Label" }, |
1339 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_SIZE, "Query Size" }, |
1340 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_DEVICE, "Query Device" }, |
1341 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_ATTRIBUTE, "Query Attribute" }, |
1342 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_CONTROL, "Query Control" }, |
1343 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_FULL_SIZE, "Query Full Size" }, |
1344 | | { PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_OBJECT_ID, "Query Object ID" }, |
1345 | | { 0, NULL } |
1346 | | }; |
1347 | | |
1348 | | #define PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_CONTROL 0x01 |
1349 | | #define PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_LABEL 0x02 |
1350 | | #define PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_OBJECT_ID 0x08 |
1351 | | |
1352 | | static const value_string filesystem_operation_set_volume_info_vals[] = { |
1353 | | { PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_CONTROL, "Control" }, |
1354 | | { PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_LABEL, "Label" }, |
1355 | | { PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_OBJECT_ID, "Object ID" }, |
1356 | | { 0, NULL } |
1357 | | }; |
1358 | | |
1359 | 0 | #define PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_QUERY 0x01 |
1360 | 0 | #define PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_NOTIFY_CHANGE 0x02 |
1361 | | |
1362 | | static const value_string filesystem_operation_directory_control_vals[] = { |
1363 | | { PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_QUERY, "Query" }, |
1364 | | { PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_NOTIFY_CHANGE, "Notify Change" }, |
1365 | | { 0, NULL } |
1366 | | }; |
1367 | | |
1368 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_START_DEVICE 0x00 |
1369 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_REMOVE_DEVICE 0x01 |
1370 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_REMOVE_DEVICE 0x02 |
1371 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_CANCEL_REMOVE_DEVICE 0x03 |
1372 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_STOP_DEVICE 0x04 |
1373 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_STOP_DEVICE 0x05 |
1374 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_CANCEL_STOP_DEVICE 0x06 |
1375 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_DEVICE_RELATIONS 0x07 |
1376 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_INTERFACE 0x08 |
1377 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_CAPABILITIES 0x09 |
1378 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_RESOURCES 0x0A |
1379 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_RESOURCE_REQUIREMENTS 0x0B |
1380 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_DEVICE_TEXT 0x0C |
1381 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_FILTER_RESOURCE_REQUIREMENTS 0x0D |
1382 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_READ_CONFIG 0x0F |
1383 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_WRITE_CONFIG 0x10 |
1384 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_EJECT 0x11 |
1385 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_SET_LOCK 0x12 |
1386 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_ID2 0x13 |
1387 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_PNP_DEVICE_STATE 0x14 |
1388 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_BUS_INFORMATION 0x15 |
1389 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_DEVICE_USAGE_NOTIFICATION 0x16 |
1390 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_SURPRISE_REMOVAL 0x17 |
1391 | | #define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_LEGACY_BUS_INFORMATION 0x18 |
1392 | | |
1393 | | static const value_string filesystem_operation_pnp_vals[] = { |
1394 | | { PROCMON_FILESYSTEM_OPERATION_PNP_START_DEVICE, "Start Device" }, |
1395 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_REMOVE_DEVICE, "Query Remove Device" }, |
1396 | | { PROCMON_FILESYSTEM_OPERATION_PNP_REMOVE_DEVICE, "Remove Device" }, |
1397 | | { PROCMON_FILESYSTEM_OPERATION_PNP_CANCEL_REMOVE_DEVICE, "Cancel Remove Device" }, |
1398 | | { PROCMON_FILESYSTEM_OPERATION_PNP_STOP_DEVICE, "Stop Device" }, |
1399 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_STOP_DEVICE, "Query Stop Device" }, |
1400 | | { PROCMON_FILESYSTEM_OPERATION_PNP_CANCEL_STOP_DEVICE, "Cancel Stop Device" }, |
1401 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_DEVICE_RELATIONS, "Query Device Relations" }, |
1402 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_INTERFACE, "Query Interface" }, |
1403 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_CAPABILITIES, "Query Capabilities" }, |
1404 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_RESOURCES, "Query Resources" }, |
1405 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_RESOURCE_REQUIREMENTS, "Query Resource Requirements" }, |
1406 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_DEVICE_TEXT, "Query Device Text" }, |
1407 | | { PROCMON_FILESYSTEM_OPERATION_PNP_FILTER_RESOURCE_REQUIREMENTS,"Filter Resource Requirements" }, |
1408 | | { PROCMON_FILESYSTEM_OPERATION_PNP_READ_CONFIG, "Read Config" }, |
1409 | | { PROCMON_FILESYSTEM_OPERATION_PNP_WRITE_CONFIG, "Write Config" }, |
1410 | | { PROCMON_FILESYSTEM_OPERATION_PNP_EJECT, "Eject" }, |
1411 | | { PROCMON_FILESYSTEM_OPERATION_PNP_SET_LOCK, "Set Lock" }, |
1412 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_ID2, "Query ID2" }, |
1413 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_PNP_DEVICE_STATE, "Query PnP Device State" }, |
1414 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_BUS_INFORMATION, "Query Bus Information" }, |
1415 | | { PROCMON_FILESYSTEM_OPERATION_PNP_DEVICE_USAGE_NOTIFICATION, "Device Usage Notification" }, |
1416 | | { PROCMON_FILESYSTEM_OPERATION_PNP_SURPRISE_REMOVAL, "Surprise Removal" }, |
1417 | | { PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_LEGACY_BUS_INFORMATION, "Query Legacy Bus Information" }, |
1418 | | { 0, NULL } |
1419 | | }; |
1420 | | |
1421 | | #define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_LOCK 0x01 |
1422 | | #define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_SINGLE 0x02 |
1423 | | #define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_ALL 0x03 |
1424 | | #define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_BY_KEY 0x04 |
1425 | | |
1426 | | static const value_string filesystem_operation_lock_unlock_file_vals[] = { |
1427 | | { PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_LOCK, "Lock" }, |
1428 | | { PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_SINGLE, "Unlock Single" }, |
1429 | | { PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_ALL, "Unlock All" }, |
1430 | | { PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_BY_KEY, "Unlock By Key" }, |
1431 | | { 0, NULL } |
1432 | | }; |
1433 | | |
1434 | | #define PROCMON_FILESYSTEM_DISPOSITION_SUPERSEDE 0x00 |
1435 | | #define PROCMON_FILESYSTEM_DISPOSITION_OPEN 0x01 |
1436 | | #define PROCMON_FILESYSTEM_DISPOSITION_CREATE 0x02 |
1437 | | #define PROCMON_FILESYSTEM_DISPOSITION_OPEN_IF 0x03 |
1438 | | #define PROCMON_FILESYSTEM_DISPOSITION_OVERWRITE 0x04 |
1439 | | #define PROCMON_FILESYSTEM_DISPOSITION_OVERWRITE_IF 0x05 |
1440 | | |
1441 | | static const value_string filesystem_disposition_vals[] = { |
1442 | | { PROCMON_FILESYSTEM_DISPOSITION_SUPERSEDE, "Supersede" }, |
1443 | | { PROCMON_FILESYSTEM_DISPOSITION_OPEN, "Open" }, |
1444 | | { PROCMON_FILESYSTEM_DISPOSITION_CREATE, "Create" }, |
1445 | | { PROCMON_FILESYSTEM_DISPOSITION_OPEN_IF, "Open If" }, |
1446 | | { PROCMON_FILESYSTEM_DISPOSITION_OVERWRITE, "Overwrite" }, |
1447 | | { PROCMON_FILESYSTEM_DISPOSITION_OVERWRITE_IF, "Overwrite If" }, |
1448 | | { 0, NULL } |
1449 | | }; |
1450 | | |
1451 | | static const value_string filesystem_open_result_vals[] = { |
1452 | | { 0, "Superseded" }, |
1453 | | { 1, "Opened" }, |
1454 | | { 2, "Created" }, |
1455 | | { 3, "Overwritten" }, |
1456 | | { 4, "Exists" }, |
1457 | | { 5, "Does Not Exists" }, |
1458 | | { 0, NULL } |
1459 | | }; |
1460 | | |
1461 | | static const value_string filesystem_readwrite_priority_vals[] = { |
1462 | | { 0, "" }, |
1463 | | { 1, "Very Low" }, |
1464 | | { 2, "Low" }, |
1465 | | { 3, "Normal" }, |
1466 | | { 4, "High" }, |
1467 | | { 5, "Critical" }, |
1468 | | { 0, NULL } |
1469 | | }; |
1470 | | |
1471 | | static const value_string ioctl_code_vals[] = { |
1472 | | {0x24058, "IOCTL_CDROM_GET_CONFIGURATION"}, |
1473 | | {0x24800, "IOCTL_CDROM_CHECK_VERIFY"}, |
1474 | | {0x24804, "IOCTL_CDROM_MEDIA_REMOVAL"}, |
1475 | | {0x24808, "IOCTL_CDROM_EJECT_MEDIA"}, |
1476 | | {0x2480c, "IOCTL_CDROM_LOAD_MEDIA"}, |
1477 | | {0x41018, "IOCTL_SCSI_GET_ADDRESS"}, |
1478 | | {0x41020, "IOCTL_SCSI_GET_DUMP_POINTERS"}, |
1479 | | {0x41024, "IOCTL_SCSI_FREE_DUMP_POINTERS"}, |
1480 | | {0x4d004, "IOCTL_SCSI_PASS_THROUGH"}, |
1481 | | {0x4d014, "IOCTL_SCSI_PASS_THROUGH_DIRECT"}, |
1482 | | {0x60190, "FSCTL_DFS_TRANSLATE_PATH"}, |
1483 | | {0x60194, "FSCTL_DFS_GET_REFERRALS"}, |
1484 | | {0x60198, "FSCTL_DFS_REPORT_INCONSISTENCY"}, |
1485 | | {0x6019c, "FSCTL_DFS_IS_SHARE_IN_DFS"}, |
1486 | | {0x601a0, "FSCTL_DFS_IS_ROOT"}, |
1487 | | {0x601a4, "FSCTL_DFS_GET_VERSION"}, |
1488 | | {0x70000, "IOCTL_DISK_GET_DRIVE_GEOMETRY"}, |
1489 | | {0x70014, "IOCTL_DISK_VERIFY"}, |
1490 | | {0x70020, "IOCTL_DISK_PERFORMANCE"}, |
1491 | | {0x70024, "IOCTL_DISK_IS_WRITABLE"}, |
1492 | | {0x70028, "IOCTL_DISK_LOGGING"}, |
1493 | | {0x70030, "IOCTL_DISK_HISTOGRAM_STRUCTURE"}, |
1494 | | {0x70034, "IOCTL_DISK_HISTOGRAM_DATA"}, |
1495 | | {0x70038, "IOCTL_DISK_HISTOGRAM_RESET"}, |
1496 | | {0x7003c, "IOCTL_DISK_REQUEST_STRUCTURE"}, |
1497 | | {0x70040, "IOCTL_DISK_REQUEST_DATA"}, |
1498 | | {0x70048, "IOCTL_DISK_GET_PARTITION_INFO_EX"}, |
1499 | | {0x70050, "IOCTL_DISK_GET_DRIVE_LAYOUT_EX"}, |
1500 | | {0x70060, "IOCTL_DISK_PERFORMANCE_OFF"}, |
1501 | | {0x700a0, "IOCTL_DISK_GET_DRIVE_GEOMETRY_EX"}, |
1502 | | {0x700f0, "IOCTL_DISK_GET_DISK_ATTRIBUTES"}, |
1503 | | {0x70140, "IOCTL_DISK_UPDATE_PROPERTIES"}, |
1504 | | {0x70214, "IOCTL_DISK_GET_CLUSTER_INFO"}, |
1505 | | {0x70c00, "IOCTL_DISK_GET_MEDIA_TYPES"}, |
1506 | | {0x74004, "IOCTL_DISK_GET_PARTITION_INFO"}, |
1507 | | {0x7400c, "IOCTL_DISK_GET_DRIVE_LAYOUT"}, |
1508 | | {0x7405c, "IOCTL_DISK_GET_LENGTH_INFO"}, |
1509 | | {0x74080, "SMART_GET_VERSION"}, |
1510 | | {0x740d4, "IOCTL_DISK_GET_CACHE_INFORMATION"}, |
1511 | | {0x74800, "IOCTL_DISK_CHECK_VERIFY"}, |
1512 | | {0x74804, "IOCTL_DISK_MEDIA_REMOVAL"}, |
1513 | | {0x74808, "IOCTL_DISK_EJECT_MEDIA"}, |
1514 | | {0x7480c, "IOCTL_DISK_LOAD_MEDIA"}, |
1515 | | {0x74810, "IOCTL_DISK_RESERVE"}, |
1516 | | {0x74814, "IOCTL_DISK_RELEASE"}, |
1517 | | {0x74818, "IOCTL_DISK_FIND_NEW_DEVICES"}, |
1518 | | {0x7c008, "IOCTL_DISK_SET_PARTITION_INFO"}, |
1519 | | {0x7c010, "IOCTL_DISK_SET_DRIVE_LAYOUT"}, |
1520 | | {0x7c018, "IOCTL_DISK_FORMAT_TRACKS"}, |
1521 | | {0x7c01c, "IOCTL_DISK_REASSIGN_BLOCKS"}, |
1522 | | {0x7c02c, "IOCTL_DISK_FORMAT_TRACKS_EX"}, |
1523 | | {0x7c04c, "IOCTL_DISK_SET_PARTITION_INFO_EX"}, |
1524 | | {0x7c054, "IOCTL_DISK_SET_DRIVE_LAYOUT_EX"}, |
1525 | | {0x7c058, "IOCTL_DISK_CREATE_DISK"}, |
1526 | | {0x7c084, "SMART_SEND_DRIVE_COMMAND"}, |
1527 | | {0x7c088, "SMART_RCV_DRIVE_DATA"}, |
1528 | | {0x7c0a4, "IOCTL_DISK_REASSIGN_BLOCKS_EX"}, |
1529 | | {0x7c0c8, "IOCTL_DISK_UPDATE_DRIVE_SIZE"}, |
1530 | | {0x7c0d0, "IOCTL_DISK_GROW_PARTITION"}, |
1531 | | {0x7c0d8, "IOCTL_DISK_SET_CACHE_INFORMATION"}, |
1532 | | {0x7c0f4, "IOCTL_DISK_SET_DISK_ATTRIBUTES"}, |
1533 | | {0x7c218, "IOCTL_DISK_SET_CLUSTER_INFO"}, |
1534 | | {0x90000, "FSCTL_REQUEST_OPLOCK_LEVEL_1"}, |
1535 | | {0x90004, "FSCTL_REQUEST_OPLOCK_LEVEL_2"}, |
1536 | | {0x90008, "FSCTL_REQUEST_BATCH_OPLOCK"}, |
1537 | | {0x9000c, "FSCTL_OPLOCK_BREAK_ACKNOWLEDGE"}, |
1538 | | {0x90010, "FSCTL_OPBATCH_ACK_CLOSE_PENDING"}, |
1539 | | {0x90014, "FSCTL_OPLOCK_BREAK_NOTIFY"}, |
1540 | | {0x90018, "FSCTL_LOCK_VOLUME"}, |
1541 | | {0x9001c, "FSCTL_UNLOCK_VOLUME"}, |
1542 | | {0x90020, "FSCTL_DISMOUNT_VOLUME"}, |
1543 | | {0x90028, "FSCTL_IS_VOLUME_MOUNTED"}, |
1544 | | {0x9002c, "FSCTL_IS_PATHNAME_VALID"}, |
1545 | | {0x90030, "FSCTL_MARK_VOLUME_DIRTY"}, |
1546 | | {0x9003b, "FSCTL_QUERY_RETRIEVAL_POINTERS"}, |
1547 | | {0x9003c, "FSCTL_GET_COMPRESSION"}, |
1548 | | {0x90050, "FSCTL_OPLOCK_BREAK_ACK_NO_2"}, |
1549 | | {0x90058, "FSCTL_QUERY_FAT_BPB"}, |
1550 | | {0x9005c, "FSCTL_REQUEST_FILTER_OPLOCK"}, |
1551 | | {0x90060, "FSCTL_FILESYSTEM_GET_STATISTICS"}, |
1552 | | {0x90064, "FSCTL_GET_NTFS_VOLUME_DATA"}, |
1553 | | {0x90068, "FSCTL_GET_NTFS_FILE_RECORD"}, |
1554 | | {0x9006f, "FSCTL_GET_VOLUME_BITMAP"}, |
1555 | | {0x90073, "FSCTL_GET_RETRIEVAL_POINTERS"}, |
1556 | | {0x90074, "FSCTL_MOVE_FILE"}, |
1557 | | {0x90078, "FSCTL_IS_VOLUME_DIRTY"}, |
1558 | | {0x90083, "FSCTL_ALLOW_EXTENDED_DASD_IO"}, |
1559 | | {0x90087, "FSCTL_READ_PROPERTY_DATA"}, |
1560 | | {0x9008b, "FSCTL_WRITE_PROPERTY_DATA"}, |
1561 | | {0x9008f, "FSCTL_FIND_FILES_BY_SID"}, |
1562 | | {0x90097, "FSCTL_DUMP_PROPERTY_DATA"}, |
1563 | | {0x90098, "FSCTL_SET_OBJECT_ID"}, |
1564 | | {0x9009c, "FSCTL_GET_OBJECT_ID"}, |
1565 | | {0x900a0, "FSCTL_DELETE_OBJECT_ID"}, |
1566 | | {0x900a4, "FSCTL_SET_REPARSE_POINT"}, |
1567 | | {0x900a8, "FSCTL_GET_REPARSE_POINT"}, |
1568 | | {0x900ac, "FSCTL_DELETE_REPARSE_POINT"}, |
1569 | | {0x900b3, "FSCTL_ENUM_USN_DATA"}, |
1570 | | {0x900bb, "FSCTL_READ_USN_JOURNAL"}, |
1571 | | {0x900bc, "FSCTL_SET_OBJECT_ID_EXTENDED"}, |
1572 | | {0x900c0, "FSCTL_CREATE_OR_GET_OBJECT_ID"}, |
1573 | | {0x900c4, "FSCTL_SET_SPARSE"}, |
1574 | | {0x900d7, "FSCTL_SET_ENCRYPTION"}, |
1575 | | {0x900db, "FSCTL_ENCRYPTION_FSCTL_IO"}, |
1576 | | {0x900df, "FSCTL_WRITE_RAW_ENCRYPTED" }, |
1577 | | {0x900e3, "FSCTL_READ_RAW_ENCRYPTED" }, |
1578 | | {0x900e7, "FSCTL_CREATE_USN_JOURNAL" }, |
1579 | | {0x900eb, "FSCTL_READ_FILE_USN_DATA" }, |
1580 | | {0x900ef, "FSCTL_WRITE_USN_CLOSE_RECORD" }, |
1581 | | {0x900f0, "FSCTL_EXTEND_VOLUME" }, |
1582 | | {0x900f4, "FSCTL_QUERY_USN_JOURNAL" }, |
1583 | | {0x900f8, "FSCTL_DELETE_USN_JOURNAL" }, |
1584 | | {0x900fc, "FSCTL_MARK_HANDLE" }, |
1585 | | {0x90100, "FSCTL_SIS_COPYFILE" }, |
1586 | | {0x90120, "FSCTL_FILE_PREFETCH" }, |
1587 | | {0x901af, "CSC_FSCTL_OPERATION_QUERY_HANDLE" }, |
1588 | | {0x901f0, "FSCTL_QUERY_DEPENDENT_VOLUME" }, |
1589 | | {0x90230, "FSCTL_GET_BOOT_AREA_INFO" }, |
1590 | | {0x90240, "FSCTL_REQUEST_OPLOCK" }, |
1591 | | {0x90244, "FSCTL_CSV_TUNNEL_REQUEST" }, |
1592 | | {0x9024c, "FSCTL_QUERY_FILE_SYSTEM_RECOGNITION" }, |
1593 | | {0x90254, "FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT" }, |
1594 | | {0x90258, "FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME" }, |
1595 | | {0x9025c, "FSCTL_IS_FILE_ON_CSV_VOLUME" }, |
1596 | | {0x90260, "FSCTL_CORRUPTION_HANDLING" }, |
1597 | | {0x90270, "FSCTL_SET_PURGE_FAILURE_MODE" }, |
1598 | | {0x90277, "FSCTL_QUERY_FILE_LAYOUT" }, |
1599 | | {0x90278, "FSCTL_IS_VOLUME_OWNED_BYCSVFS" }, |
1600 | | {0x9027c, "FSCTL_GET_INTEGRITY_INFORMATION" }, |
1601 | | {0x90284, "FSCTL_QUERY_FILE_REGIONS" }, |
1602 | | {0x902b0, "FSCTL_SCRUB_DATA" }, |
1603 | | {0x902b8, "FSCTL_DISABLE_LOCAL_BUFFERING" }, |
1604 | | {0x9030c, "FSCTL_SET_EXTERNAL_BACKING" }, |
1605 | | {0x90310, "FSCTL_GET_EXTERNAL_BACKING" }, |
1606 | | {0x940b7, "FSCTL_SECURITY_ID_CHECK" }, |
1607 | | {0x940cf, "FSCTL_QUERY_ALLOCATED_RANGES" }, |
1608 | | {0x941e4, "FSCTL_TXFS_LIST_TRANSACTIONS" }, |
1609 | | {0x94264, "FSCTL_OFFLOAD_READ" }, |
1610 | | {0x980c8, "FSCTL_SET_ZERO_DATA" }, |
1611 | | {0x980d0, "FSCTL_ENABLE_UPGRADE" }, |
1612 | | {0x98208, "FSCTL_FILE_LEVEL_TRIM" }, |
1613 | | {0x98268, "FSCTL_OFFLOAD_WRITE" }, |
1614 | | {0x9c040, "FSCTL_SET_COMPRESSION" }, |
1615 | | {0x9c104, "FSCTL_SIS_LINK_FILES" }, |
1616 | | {0x9c108, "FSCTL_HSM_MSG" }, |
1617 | | {0x9c2b4, "FSCTL_REPAIR_COPIES" }, |
1618 | | {0xc4003, "FSCTL_MAILSLOT_PEEK" }, |
1619 | | {0x110000, "FSCTL_PIPE_ASSIGN_EVENT" }, |
1620 | | {0x110004, "FSCTL_PIPE_DISCONNECT" }, |
1621 | | {0x110008, "FSCTL_PIPE_LISTEN" }, |
1622 | | {0x110010, "FSCTL_PIPE_QUERY_EVENT" }, |
1623 | | {0x110018, "FSCTL_PIPE_WAIT" }, |
1624 | | {0x11001c, "FSCTL_PIPE_IMPERSONATE" }, |
1625 | | {0x110020, "FSCTL_PIPE_SET_CLIENT_PROCESS" }, |
1626 | | {0x110024, "FSCTL_QUERY_CLIENT_PROCESS" }, |
1627 | | {0x11400c, "FSCTL_PIPE_PEEK" }, |
1628 | | {0x116000, "FSCTL_PIPE_INTERNAL_READ" }, |
1629 | | {0x119ff8, "FSCTL_PIPE_INTERNAL_WRITE" }, |
1630 | | {0x11c017, "FSCTL_PIPE_TRANSCEIVE" }, |
1631 | | {0x11dfff, "FSCTL_PIPE_INTERNAL_TRANSCEIVE" }, |
1632 | | {0x140191, "FSCTL_LMR_START" }, |
1633 | | {0x140193, "IOCTL_SMBMRX_START" }, |
1634 | | {0x140194, "FSCTL_LMR_STOP" }, |
1635 | | {0x140197, "IOCTL_SMBMRX_STOP" }, |
1636 | | {0x140198, "IOCTL_SMBMRX_GETSTATE" }, |
1637 | | {0x140199, "FSCTL_NETWORK_SET_CONFIGURATION_INFO" }, |
1638 | | {0x14019e, "FSCTL_NETWORK_GET_CONFIGURATION_INFO" }, |
1639 | | {0x1401a3, "FSCTL_NETWORK_GET_CONNECTION_INFO" }, |
1640 | | {0x1401a7, "FSCTL_NETWORK_ENUMERATE_CONNECTIONS" }, |
1641 | | {0x1401ab, "FSCTL_LMR_FORCE_DISCONNECT" }, |
1642 | | {0x1401ac, "FSCTL_NETWORK_DELETE_CONNECTION" }, |
1643 | | {0x1401b0, "FSCTL_LMR_BIND_TO_TRANSPORT" }, |
1644 | | {0x1401b4, "FSCTL_LMR_UNBIND_FROM_TRANSPORT" }, |
1645 | | {0x1401bb, "FSCTL_LMR_ENUMERATE_TRANSPORTS" }, |
1646 | | {0x1401c4, "FSCTL_LMR_GET_HINT_SIZE" }, |
1647 | | {0x1401c8, "FSCTL_LMR_TRANSACT" }, |
1648 | | {0x1401cc, "FSCTL_LMR_ENUMERATE_PRINT_INFO" }, |
1649 | | {0x1401d0, "FSCTL_NETWORK_GET_STATISTICS" }, |
1650 | | {0x1401d4, "FSCTL_LMR_START_SMBTRACE" }, |
1651 | | {0x1401d8, "FSCTL_LMR_END_SMBTRACE" }, |
1652 | | {0x1401dc, "FSCTL_LMR_START_RBR" }, |
1653 | | {0x1401e0, "FSCTL_NETWORK_SET_DOMAIN_NAME" }, |
1654 | | {0x1401e4, "FSCTL_LMR_SET_SERVER_GUID" }, |
1655 | | {0x1401e8, "FSCTL_LMR_QUERY_TARGET_INFO" }, |
1656 | | {0x1401ec, "FSCTL_LMR_QUERY_DEBUG_INFO" }, |
1657 | | {0x1401f4, "IOCTL_SMBMRX_ADDCONN" }, |
1658 | | {0x1401f8, "IOCTL_SMBMRX_DELCONN" }, |
1659 | | {0x140378, "IOCTL_UMRX_RELEASE_THREADS" }, |
1660 | | {0x14037e, "IOCTL_UMRX_GET_REQUEST" }, |
1661 | | {0x140382, "IOCTL_UMRX_RESPONSE_AND_REQUEST" }, |
1662 | | {0x140386, "IOCTL_UMRX_RESPONSE" }, |
1663 | | {0x140388, "IOCTL_UMRX_GET_LOCK_OWNER" }, |
1664 | | {0x14038c, "IOCTL_LMR_QUERY_REMOTE_SERVER_NAME" }, |
1665 | | {0x140390, "IOCTL_LMR_DISABLE_LOCAL_BUFFERING" }, |
1666 | | {0x140394, "IOCTL_UMRX_PREPARE_QUEUE" }, |
1667 | | {0x140397, "IOCTL_LMR_LWIO_POSTIO" }, |
1668 | | {0x14039b, "IOCTL_LMR_LWIO_PREIO" }, |
1669 | | {0x1403e8, "FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT" }, |
1670 | | {0x140fdb, "IOCTL_SHADOW_END_REINT" }, |
1671 | | {0x140fff, "IOCTL_GETSHADOW" }, |
1672 | | {0x2d0800, "IOCTL_STORAGE_CHECK_VERIFY2" }, |
1673 | | {0x2d080c, "IOCTL_STORAGE_LOAD_MEDIA2" }, |
1674 | | {0x2d0940, "IOCTL_STORAGE_EJECTION_CONTROL" }, |
1675 | | {0x2d0944, "IOCTL_STORAGE_MCN_CONTROL" }, |
1676 | | {0x2d0c00, "IOCTL_STORAGE_GET_MEDIA_TYPES" }, |
1677 | | {0x2d0c04, "IOCTL_STORAGE_GET_MEDIA_TYPES_EX" }, |
1678 | | {0x2d0c10, "IOCTL_STORAGE_GET_MEDIA_SERIAL_NUMBER" }, |
1679 | | {0x2d0c14, "IOCTL_STORAGE_GET_HOTPLUG_INFO" }, |
1680 | | {0x2d1080, "IOCTL_STORAGE_GET_DEVICE_NUMBER" }, |
1681 | | {0x2d1100, "IOCTL_STORAGE_PREDICT_FAILURE" }, |
1682 | | {0x2d1400, "IOCTL_STORAGE_QUERY_PROPERTY" }, |
1683 | | {0x2d4800, "IOCTL_STORAGE_CHECK_VERIFY" }, |
1684 | | {0x2d4804, "IOCTL_STORAGE_MEDIA_REMOVAL" }, |
1685 | | {0x2d4808, "IOCTL_STORAGE_EJECT_MEDIA" }, |
1686 | | {0x2d480c, "IOCTL_STORAGE_LOAD_MEDIA" }, |
1687 | | {0x2d4810, "IOCTL_STORAGE_RESERVE" }, |
1688 | | {0x2d4814, "IOCTL_STORAGE_RELEASE" }, |
1689 | | {0x2d4818, "IOCTL_STORAGE_FIND_NEW_DEVICES" }, |
1690 | | {0x2d5000, "IOCTL_STORAGE_RESET_BUS" }, |
1691 | | {0x2d5004, "IOCTL_STORAGE_RESET_DEVICE" }, |
1692 | | {0x2d5014, "IOCTL_STORAGE_BREAK_RESERVATION" }, |
1693 | | {0x2d5018, "IOCTL_STORAGE_PERSISTENT_RESERVE_IN" }, |
1694 | | {0x2d5140, "IOCTL_STORAGE_READ_CAPACITY" }, |
1695 | | {0x2d518c, "IOCTL_STORAGE_QUERY_DEPENDENT_DISK" }, |
1696 | | {0x2dcc18, "IOCTL_STORAGE_SET_HOTPLUG_INFO" }, |
1697 | | {0x2dd01c, "IOCTL_STORAGE_PERSISTENT_RESERVE_OUT" }, |
1698 | | {0x38a813, "IOCTL_CHANNEL_GET_SNDCHANNEL" }, |
1699 | | {0x4d0000, "IOCTL_MOUNTDEV_QUERY_UNIQUE_ID" }, |
1700 | | {0x4d0004, "IOCTL_MOUNTDEV_UNIQUE_ID_CHANGE_NOTIFY" }, |
1701 | | {0x4d0008, "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, |
1702 | | {0x4d000c, "IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME" }, |
1703 | | {0x4d0010, "IOCTL_MOUNTDEV_LINK_CREATED" }, |
1704 | | {0x4d0014, "IOCTL_MOUNTDEV_LINK_DELETED" }, |
1705 | | {0x530018, "IOCTL_VOLSNAP_QUERY_NAMES_OF_SNAPSHOTS" }, |
1706 | | {0x530024, "IOCTL_VOLSNAP_QUERY_DIFF_AREA" }, |
1707 | | {0x53002c, "IOCTL_VOLSNAP_QUERY_DIFF_AREA_SIZES" }, |
1708 | | {0x530034, "IOCTL_VOLSNAP_AUTO_CLEANUP" }, |
1709 | | {0x53003c, "IOCTL_VOLSNAP_QUERY_REVERT" }, |
1710 | | {0x530040, "IOCTL_VOLSNAP_REVERT_CLEANUP" }, |
1711 | | {0x530048, "IOCTL_VOLSNAP_QUERY_REVERT_PROGRESS" }, |
1712 | | {0x53004c, "IOCTL_VOLSNAP_CANCEL_REVERT" }, |
1713 | | {0x530050, "IOCTL_VOLSNAP_QUERY_EPIC" }, |
1714 | | {0x53005e, "IOCTL_VOLSNAP_QUERY_COPY_FREE_BITMAP" }, |
1715 | | {0x530190, "IOCTL_VOLSNAP_QUERY_ORIGINAL_VOLUME_NAME" }, |
1716 | | {0x53019c, "IOCTL_VOLSNAP_QUERY_CONFIG_INFO" }, |
1717 | | {0x5301a0, "IOCTL_VOLSNAP_HAS_CHANGED" }, |
1718 | | {0x5301a4, "IOCTL_VOLSNAP_SET_SNAPSHOT_PRIORITY" }, |
1719 | | {0x5301a8, "IOCTL_VOLSNAP_QUERY_SNAPSHOT_PRIORITY" }, |
1720 | | {0x5301ae, "IOCTL_VOLSNAP_QUERY_DELTA_BITMAP" }, |
1721 | | {0x5301b2, "IOCTL_VOLSNAP_QUERY_SNAPSHOT_SUPPLEMENTAL" }, |
1722 | | {0x5301b6, "IOCTL_VOLSNAP_QUERY_COPIED_BITMAP" }, |
1723 | | {0x5301b8, "IOCTL_VOLSNAP_QUERY_MOVE_LIST" }, |
1724 | | {0x5301be, "IOCTL_VOLSNAP_QUERY_PRE_COPIED_BITMAP" }, |
1725 | | {0x5301c2, "IOCTL_VOLSNAP_QUERY_USED_PRE_COPIED_BITMAP" }, |
1726 | | {0x5301c6, "IOCTL_VOLSNAP_QUERY_DEFRAG_PRE_COPIED_BITMAP" }, |
1727 | | {0x5301ca, "IOCTL_VOLSNAP_QUERY_FREESPACE_PRE_COPIED_BITMAP" }, |
1728 | | {0x5301ce, "IOCTL_VOLSNAP_QUERY_HOTBLOCKS_PRE_COPIED_BITMAP" }, |
1729 | | {0x5301d0, "IOCTL_VOLSNAP_QUERY_DIFF_AREA_FILE_SIZES" }, |
1730 | | {0x534054, "IOCTL_VOLSNAP_QUERY_OFFLINE" }, |
1731 | | {0x534058, "IOCTL_VOLSNAP_QUERY_DIFF_AREA_MINIMUM_SIZE" }, |
1732 | | {0x534064, "IOCTL_VOLSNAP_BLOCK_DELETE_IN_THE_MIDDLE" }, |
1733 | | {0x534070, "IOCTL_VOLSNAP_QUERY_APPLICATION_FLAGS" }, |
1734 | | {0x534080, "IOCTL_VOLSNAP_QUERY_PERFORMANCE_COUNTERS" }, |
1735 | | {0x534088, "IOCTL_VOLSNAP_QUERY_PRE_COPY_AMOUNTS" }, |
1736 | | {0x53408c, "IOCTL_VOLSNAP_QUERY_DEFAULT_PRE_COPY_AMOUNTS" }, |
1737 | | {0x53c000, "IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES" }, |
1738 | | {0x53c004, "IOCTL_VOLSNAP_RELEASE_WRITES" }, |
1739 | | {0x53c008, "IOCTL_VOLSNAP_PREPARE_FOR_SNAPSHOT" }, |
1740 | | {0x53c00c, "IOCTL_VOLSNAP_ABORT_PREPARED_SNAPSHOT" }, |
1741 | | {0x53c010, "IOCTL_VOLSNAP_COMMIT_SNAPSHOT" }, |
1742 | | {0x53c014, "IOCTL_VOLSNAP_END_COMMIT_SNAPSHOT" }, |
1743 | | {0x53c01c, "IOCTL_VOLSNAP_CLEAR_DIFF_AREA" }, |
1744 | | {0x53c020, "IOCTL_VOLSNAP_ADD_VOLUME_TO_DIFF_AREA" }, |
1745 | | {0x53c028, "IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE" }, |
1746 | | {0x53c030, "IOCTL_VOLSNAP_DELETE_OLDEST_SNAPSHOT" }, |
1747 | | {0x53c038, "IOCTL_VOLSNAP_DELETE_SNAPSHOT" }, |
1748 | | {0x53c044, "IOCTL_VOLSNAP_REVERT" }, |
1749 | | {0x53c068, "IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE_TEMP" }, |
1750 | | {0x53c06c, "IOCTL_VOLSNAP_SET_APPLICATION_FLAGS" }, |
1751 | | {0x53c07c, "IOCTL_VOLSNAP_SET_BC_FAILURE_MODE" }, |
1752 | | {0x53c084, "IOCTL_VOLSNAP_SET_PRE_COPY_AMOUNTS" }, |
1753 | | {0x53c090, "IOCTL_VOLSNAP_PRE_EXPOSE_DEVICES" }, |
1754 | | {0x53c198, "IOCTL_VOLSNAP_SET_APPLICATION_INFO" }, |
1755 | | {0x560000, "IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS" }, |
1756 | | {0x560038, "IOCTL_VOLUME_GET_GPT_ATTRIBUTES" }, |
1757 | | {0x700010, "IOCTL_DISK_QUERY_DEVICE_STATE" }, |
1758 | | {0x704008, "IOCTL_DISK_QUERY_DISK_SIGNATURE" }, |
1759 | | { 0, NULL } |
1760 | | }; |
1761 | | static value_string_ext ioctl_code_vals_ext = VALUE_STRING_EXT_INIT(ioctl_code_vals); |
1762 | | |
1763 | | |
1764 | | static const value_string sync_type_vals[] = { |
1765 | | { 0x0, "Other" }, |
1766 | | { 0x1, "Create Section" }, |
1767 | | { 0, NULL } |
1768 | | }; |
1769 | | |
1770 | | static const value_string page_protection_vals[] = { |
1771 | | { 0x0, "None" }, |
1772 | | { 0x01, "No Access" }, |
1773 | | { 0x02, "Read Only" }, |
1774 | | { 0x04, "Read/Write" }, |
1775 | | { 0x08, "Write Copy" }, |
1776 | | { 0x10, "Execute" }, |
1777 | | { 0x20, "Execute Read" }, |
1778 | | { 0x40, "Execute Read/Write" }, |
1779 | | { 0x200, "No Cache" }, |
1780 | | { 0, NULL } |
1781 | | }; |
1782 | | |
1783 | | static const value_string file_information_class_vals[] = { |
1784 | | {0, "Unknown"}, |
1785 | | {1, "File Directory Information"}, |
1786 | | {2, "File Full Directory Information"}, |
1787 | | {3, "File Both Directory Information"}, |
1788 | | {4, "File Basic Information"}, |
1789 | | {5, "File Standard Information"}, |
1790 | | {6, "File Internal Information"}, |
1791 | | {7, "File Ea Information"}, |
1792 | | {8, "File Access Information"}, |
1793 | | {9, "File Name Information"}, |
1794 | | {10, "File Rename Information"}, |
1795 | | {11, "File Link Information"}, |
1796 | | {12, "File Names Information"}, |
1797 | | {13, "File Disposition Information"}, |
1798 | | {14, "File Position Information"}, |
1799 | | {15, "File Full Ea Information"}, |
1800 | | {16, "File Mode Information"}, |
1801 | | {17, "File Alignment Information"}, |
1802 | | {18, "File All Information"}, |
1803 | | {19, "File Allocation Information"}, |
1804 | | {20, "File End Of File Information"}, |
1805 | | {21, "File Alternate Name Information"}, |
1806 | | {22, "File Stream Information"}, |
1807 | | {23, "File Pipe Information"}, |
1808 | | {24, "File Pipe Local Information"}, |
1809 | | {25, "File Pipe Remote Information"}, |
1810 | | {26, "File Mailslot Query Information"}, |
1811 | | {27, "File Mailslot Set Information"}, |
1812 | | {28, "File Compression Information"}, |
1813 | | {29, "File ObjectId Information"}, |
1814 | | {30, "File Completion Information"}, |
1815 | | {31, "File Move Cluster Information"}, |
1816 | | {32, "File Quota Information"}, |
1817 | | {33, "File Reparse Point Information"}, |
1818 | | {34, "File Network Open Information"}, |
1819 | | {35, "File Attribute Tag Information"}, |
1820 | | {36, "File Tracking Information"}, |
1821 | | {37, "File Id Both Directory Information"}, |
1822 | | {38, "File Id Full Directory Information"}, |
1823 | | {39, "File Valid Data Length Information"}, |
1824 | | {40, "File Short Name Information"}, |
1825 | | {41, "File Io Completion Notification Information"}, |
1826 | | {42, "File Io Status Block Range Information"}, |
1827 | | {43, "File Io Priority Hint Information"}, |
1828 | | {44, "File Sfio Reserve Information"}, |
1829 | | {45, "File Sfio Volume Information"}, |
1830 | | {46, "File Hard Link Information"}, |
1831 | | {47, "File Process Ids Using File Information"}, |
1832 | | {48, "File Normalized Name Information"}, |
1833 | | {49, "File Network Physical Name Information"}, |
1834 | | {50, "File Id Global Tx Directory Information"}, |
1835 | | {51, "File Is Remote Device Information"}, |
1836 | | {52, "File Unused Information"}, |
1837 | | {53, "File Numa Node Information"}, |
1838 | | {54, "File Standard Link Information"}, |
1839 | | {55, "File Remote Protocol Information"}, |
1840 | | {56, "File Rename Information Bypass Access Check"}, |
1841 | | {57, "File Link Information Bypass Access Check"}, |
1842 | | {58, "File Volume Name Information"}, |
1843 | | {59, "File Id Information"}, |
1844 | | {60, "File Id Extended Directory Information"}, |
1845 | | {61, "File Replace Completion Information"}, |
1846 | | {62, "File Hard Link Full Id Information"}, |
1847 | | {63, "File Id Extended Both Directory Information"}, |
1848 | | {64, "File Disposition Information Ex"}, |
1849 | | {65, "File Rename Information Ex"}, |
1850 | | {66, "File Rename Information Ex Bypass Access Check"}, |
1851 | | {67, "File Desired Storage Class Information"}, |
1852 | | {68, "File Stat Information"}, |
1853 | | {69, "File Memory Partition Information"}, |
1854 | | {70, "File Maximum Information"}, |
1855 | | {71, "SeShutdownPrivilege"}, |
1856 | | {72, "SeChangeNotifyPrivilege"}, |
1857 | | {73, "SeUndockPrivilege"}, |
1858 | | {74, "SeIncreaseWorkingSetPrivilege"}, |
1859 | | {75, "SeTimeZonePrivilege"}, |
1860 | | { 0, NULL } |
1861 | | }; |
1862 | | static value_string_ext file_information_class_vals_ext = VALUE_STRING_EXT_INIT(file_information_class_vals); |
1863 | | |
1864 | | |
1865 | | static bool dissect_procmon_filesystem_event(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, uint32_t operation, tvbuff_t* extra_details_tvb) |
1866 | 0 | { |
1867 | 0 | proto_tree* filesystem_tree; |
1868 | 0 | int offset = 0, extra_offset = 0; |
1869 | 0 | uint32_t sub_operation, ioctl_value = 0, file_information_class = 0; |
1870 | 0 | int size_of_pointer; |
1871 | 0 | bool is_path_ascii; |
1872 | 0 | uint16_t path_char_count; |
1873 | 0 | const value_string* sub_op_vals = NULL; |
1874 | 0 | uint32_t file_system_access_mask_mapping[4] = {0x120089, 0x120116, 0x1200a0, 0x1f01ff}; |
1875 | 0 | static const value_string file_system_access_mask_vals[] = { |
1876 | 0 | {0x1f01ff, "All Access"}, |
1877 | 0 | {0x1201bf, "Generic Read/Write/Execute"}, |
1878 | 0 | {0x12019f, "Generic Read/Write"}, |
1879 | 0 | {0x1200a9, "Generic Read/Execute"}, |
1880 | 0 | {0x1201b6, "Generic Write/Execute"}, |
1881 | 0 | {0x120089, "Generic Read"}, |
1882 | 0 | {0x120116, "Generic Write"}, |
1883 | 0 | {0x1200a0, "Generic Execute"}, |
1884 | 0 | {0x1, "Read Data/List Directory"}, |
1885 | 0 | {0x2, "Write Data/Add File"}, |
1886 | 0 | {0x4, "Append Data/Add Subdirectory/Create Pipe Instance"}, |
1887 | 0 | {0x8, "Read EA"}, |
1888 | 0 | {0x10, "Write EA"}, |
1889 | 0 | {0x20, "Execute/Traverse"}, |
1890 | 0 | {0x40, "Delete Child"}, |
1891 | 0 | {0x80, "Read Attributes"}, |
1892 | 0 | {0x100, "Write Attributes"}, |
1893 | 0 | {0x10000, "Delete"}, |
1894 | 0 | {0x20000, "Read Control"}, |
1895 | 0 | {0x40000, "Write DAC"}, |
1896 | 0 | {0x80000, "Write Owner"}, |
1897 | 0 | {0x100000, "Synchronize"}, |
1898 | 0 | {0x1000000, "Access System Security"}, |
1899 | 0 | {0x2000000, "Maximum Allowed"}, |
1900 | 0 | { 0, NULL } |
1901 | 0 | }; |
1902 | 0 | static const value_string file_system_io_flags_vals[] = { |
1903 | 0 | {0x10, "Buffered"}, |
1904 | 0 | {0x1, "Non-cached"}, |
1905 | 0 | {0x2, "Paging I/O"}, |
1906 | 0 | {0x4, "Synchronous"}, |
1907 | 0 | {0x40, "Synchronous Paging I/O"}, |
1908 | 0 | {0x400000, "Write Through"}, |
1909 | 0 | { 0, NULL } |
1910 | 0 | }; |
1911 | |
|
1912 | 0 | if (pinfo->pseudo_header->procmon.system_bitness) |
1913 | 0 | { |
1914 | 0 | size_of_pointer = 8; |
1915 | 0 | } |
1916 | 0 | else |
1917 | 0 | { |
1918 | 0 | size_of_pointer = 4; |
1919 | 0 | } |
1920 | |
|
1921 | 0 | filesystem_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_filesystem_event, NULL, "File System Data"); |
1922 | | |
1923 | | /* Handle the cases where the Sub operation value string is based on the operation */ |
1924 | 0 | sub_operation = tvb_get_uint8(tvb, offset); |
1925 | 0 | switch(operation) |
1926 | 0 | { |
1927 | 0 | case PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE: |
1928 | 0 | sub_op_vals = filesystem_operation_query_info_vals; |
1929 | 0 | break; |
1930 | 0 | case PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE: |
1931 | 0 | sub_op_vals = filesystem_operation_set_info_vals; |
1932 | 0 | break; |
1933 | 0 | case PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION: |
1934 | 0 | sub_op_vals = filesystem_operation_query_volume_info_vals; |
1935 | 0 | break; |
1936 | 0 | case PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION: |
1937 | 0 | sub_op_vals = filesystem_operation_set_volume_info_vals; |
1938 | 0 | break; |
1939 | 0 | case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL: |
1940 | 0 | sub_op_vals = filesystem_operation_directory_control_vals; |
1941 | 0 | break; |
1942 | 0 | case PROCMON_FILESYSTEM_OPERATION_PLUG_AND_PLAY: |
1943 | 0 | sub_op_vals = filesystem_operation_pnp_vals; |
1944 | 0 | break; |
1945 | 0 | case PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE: |
1946 | 0 | sub_op_vals = filesystem_operation_lock_unlock_file_vals; |
1947 | 0 | break; |
1948 | 0 | } |
1949 | 0 | if (sub_op_vals != NULL) |
1950 | 0 | { |
1951 | 0 | proto_tree_add_uint_format_value(filesystem_tree, hf_procmon_filesystem_suboperation, tvb, offset, 1, sub_operation, "%s (%u)", |
1952 | 0 | val_to_str_const(sub_operation, sub_op_vals, "Unknown"), sub_operation); |
1953 | 0 | } |
1954 | 0 | else |
1955 | 0 | { |
1956 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_suboperation, tvb, offset, 1, ENC_LITTLE_ENDIAN); |
1957 | 0 | } |
1958 | 0 | offset += 1; |
1959 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, offset, 3, ENC_NA); |
1960 | 0 | offset += 3; |
1961 | |
|
1962 | 0 | switch(operation) |
1963 | 0 | { |
1964 | 0 | case PROCMON_FILESYSTEM_OPERATION_CREATE_FILE: |
1965 | 0 | { |
1966 | 0 | static const value_string file_system_create_file_options_vals[] = { |
1967 | 0 | {0x1, "Directory"}, |
1968 | 0 | {0x2, "Write Through"}, |
1969 | 0 | {0x4, "Sequential Access"}, |
1970 | 0 | {0x8, "No Buffering"}, |
1971 | 0 | {0x10, "Synchronous IO Alert"}, |
1972 | 0 | {0x20, "Synchronous IO Non-Alert"}, |
1973 | 0 | {0x40, "Non-Directory File"}, |
1974 | 0 | {0x80, "Create Tree Connection"}, |
1975 | 0 | {0x100, "Complete If Oplocked"}, |
1976 | 0 | {0x200, "No EA Knowledge"}, |
1977 | 0 | {0x400, "Open for Recovery"}, |
1978 | 0 | {0x800, "Random Access"}, |
1979 | 0 | {0x1000, "Delete On Close"}, |
1980 | 0 | {0x2000, "Open By ID"}, |
1981 | 0 | {0x4000, "Open For Backup"}, |
1982 | 0 | {0x8000, "No Compression"}, |
1983 | 0 | {0x100000, "Reserve OpFilter"}, |
1984 | 0 | {0x200000, "Open Reparse Point"}, |
1985 | 0 | {0x400000, "Open No Recall"}, |
1986 | 0 | {0x800000, "Open For Free Space Query"}, |
1987 | 0 | {0x10000, "Open Requiring Oplock"}, |
1988 | 0 | {0x20000, "Disallow Exclusive"}, |
1989 | 0 | { 0, NULL } |
1990 | 0 | }; |
1991 | |
|
1992 | 0 | static const value_string file_system_create_file_attribute_vals[] = { |
1993 | 0 | {0x1, "R"}, |
1994 | 0 | {0x2, "H"}, |
1995 | 0 | {0x4, "S"}, |
1996 | 0 | {0x10, "D"}, |
1997 | 0 | {0x20, "A"}, |
1998 | 0 | {0x40, "D"}, |
1999 | 0 | {0x80, "N"}, |
2000 | 0 | {0x100, "T"}, |
2001 | 0 | {0x200, "SF"}, |
2002 | 0 | {0x400, "RP"}, |
2003 | 0 | {0x800, "C"}, |
2004 | 0 | {0x1000, "O"}, |
2005 | 0 | {0x2000, "NCI"}, |
2006 | 0 | {0x4000, "E"}, |
2007 | 0 | {0x10000, "V"}, |
2008 | 0 | { 0, NULL } |
2009 | 0 | }; |
2010 | |
|
2011 | 0 | static const value_string file_system_create_file_shared_mode_vals[] = { |
2012 | 0 | {0x1, "Read"}, |
2013 | 0 | {0x2, "Write"}, |
2014 | 0 | {0x4, "Delete"}, |
2015 | 0 | { 0, NULL } |
2016 | 0 | }; |
2017 | |
|
2018 | 0 | int create_file_offset; |
2019 | 0 | if (size_of_pointer == 4) |
2020 | 0 | { |
2021 | 0 | create_file_offset = offset+16; |
2022 | 0 | } |
2023 | 0 | else |
2024 | 0 | { |
2025 | 0 | create_file_offset = offset+20; //Padding for 64-bit |
2026 | 0 | } |
2027 | |
|
2028 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_disposition, tvb, create_file_offset, 1, ENC_LITTLE_ENDIAN); |
2029 | 0 | create_file_offset += 1; |
2030 | 0 | dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, create_file_offset, hf_procmon_filesystem_create_file_options, 3, NULL, file_system_create_file_options_vals); |
2031 | 0 | create_file_offset += 3; |
2032 | |
|
2033 | 0 | if (size_of_pointer == 8) |
2034 | 0 | create_file_offset += 4; //Padding for 64-bit |
2035 | |
|
2036 | 0 | uint16_t attributes = tvb_get_letohs(tvb, create_file_offset); |
2037 | 0 | if (attributes == 0) |
2038 | 0 | { |
2039 | 0 | proto_tree_add_uint_format_value(filesystem_tree, hf_procmon_filesystem_create_file_attributes, tvb, create_file_offset, 2, attributes, "N/A"); |
2040 | 0 | } |
2041 | 0 | else |
2042 | 0 | { |
2043 | 0 | dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, create_file_offset, hf_procmon_filesystem_create_file_attributes, 3, NULL, file_system_create_file_attribute_vals); |
2044 | 0 | } |
2045 | 0 | create_file_offset += 2; |
2046 | 0 | dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, create_file_offset, hf_procmon_filesystem_create_file_share_mode, 2, NULL, file_system_create_file_shared_mode_vals); |
2047 | 0 | create_file_offset += 2; |
2048 | | |
2049 | | //Unknown fields |
2050 | 0 | create_file_offset += (4 + size_of_pointer*2); |
2051 | |
|
2052 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_allocation, tvb, create_file_offset, 4, ENC_LITTLE_ENDIAN); |
2053 | | /* create_file_offset += 4; */ |
2054 | |
|
2055 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
2056 | 0 | { |
2057 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_open_result, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN); |
2058 | 0 | extra_offset += 4; |
2059 | 0 | } |
2060 | |
|
2061 | 0 | break; |
2062 | 0 | } |
2063 | 0 | case PROCMON_FILESYSTEM_OPERATION_READ_FILE: |
2064 | 0 | case PROCMON_FILESYSTEM_OPERATION_WRITE_FILE: |
2065 | 0 | { |
2066 | 0 | int file_offset = offset; |
2067 | | //Unknown fields |
2068 | 0 | file_offset += 4; |
2069 | |
|
2070 | 0 | dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, file_offset, hf_procmon_filesystem_readwrite_file_io_flags, 4, NULL, file_system_io_flags_vals); |
2071 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_readwrite_file_priority, tvb, file_offset, 4, ENC_LITTLE_ENDIAN); |
2072 | 0 | file_offset += 4; |
2073 | | |
2074 | | //Unknown fields |
2075 | 0 | file_offset += 4; |
2076 | |
|
2077 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_readwrite_file_length, tvb, file_offset, 4, ENC_LITTLE_ENDIAN); |
2078 | 0 | file_offset += 4; |
2079 | 0 | if (size_of_pointer == 8) |
2080 | 0 | file_offset += 4; //Padding for 64-bit |
2081 | | |
2082 | | //Unknown fields |
2083 | 0 | file_offset += 4; |
2084 | 0 | if (size_of_pointer == 8) |
2085 | 0 | file_offset += 4; //Padding for 64-bit |
2086 | |
|
2087 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_readwrite_file_offset, tvb, file_offset, 8, ENC_LITTLE_ENDIAN); |
2088 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
2089 | 0 | { |
2090 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_readwrite_file_result_length, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN); |
2091 | 0 | extra_offset += 4; |
2092 | 0 | } |
2093 | |
|
2094 | 0 | break; |
2095 | 0 | } |
2096 | 0 | case PROCMON_FILESYSTEM_OPERATION_FILE_SYSTEM_CONTROL: |
2097 | 0 | case PROCMON_FILESYSTEM_OPERATION_DEVICE_IO_CONTROL: |
2098 | 0 | { |
2099 | 0 | int control_offset = offset; |
2100 | | //Unknown fields |
2101 | 0 | control_offset += 8; |
2102 | |
|
2103 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_write_length, tvb, control_offset, 4, ENC_LITTLE_ENDIAN); |
2104 | 0 | control_offset += 4; |
2105 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_read_length, tvb, control_offset, 4, ENC_LITTLE_ENDIAN); |
2106 | 0 | control_offset += 4; |
2107 | |
|
2108 | 0 | if (size_of_pointer == 8) |
2109 | 0 | control_offset += 4; //Padding for 64-bit |
2110 | | |
2111 | | //Unknown fields |
2112 | 0 | control_offset += 4; |
2113 | 0 | if (size_of_pointer == 8) |
2114 | 0 | control_offset += 4; //Padding for 64-bit |
2115 | |
|
2116 | 0 | ioctl_value = tvb_get_letohl(tvb, control_offset); |
2117 | 0 | if (try_val_to_str_ext(ioctl_value, &ioctl_code_vals_ext) == NULL) |
2118 | 0 | { |
2119 | 0 | proto_tree_add_uint_format_value(filesystem_tree, hf_procmon_filesystem_ioctl_ioctl, tvb, control_offset, 4, ioctl_value, |
2120 | 0 | "0x%08x (Device:0x%08x Function:%d Method: %d)", ioctl_value, ioctl_value >> 16, (ioctl_value >> 2) & 0xfff, ioctl_value & 3); |
2121 | 0 | } |
2122 | 0 | else |
2123 | 0 | { |
2124 | 0 | proto_tree_add_uint(filesystem_tree, hf_procmon_filesystem_ioctl_ioctl, tvb, control_offset, 4, ioctl_value); |
2125 | 0 | } |
2126 | | /* control_offset += 4; */ |
2127 | 0 | break; |
2128 | 0 | } |
2129 | 0 | case PROCMON_FILESYSTEM_OPERATION_CREATE_FILE_MAPPING: |
2130 | 0 | { |
2131 | 0 | int mapping_offset = offset; |
2132 | | //Unknown fields |
2133 | 0 | mapping_offset += 12; |
2134 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_mapping_sync_type, tvb, mapping_offset, 4, ENC_LITTLE_ENDIAN); |
2135 | 0 | mapping_offset += 4; |
2136 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_mapping_page_protection, tvb, mapping_offset, 4, ENC_LITTLE_ENDIAN); |
2137 | 0 | break; |
2138 | 0 | } |
2139 | 0 | case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL: |
2140 | 0 | { |
2141 | 0 | int control_offset = offset; |
2142 | 0 | switch(sub_operation) |
2143 | 0 | { |
2144 | 0 | case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_QUERY: |
2145 | | //Unknown fields |
2146 | 0 | control_offset += 16; |
2147 | 0 | if (size_of_pointer == 8) |
2148 | 0 | control_offset += 4; //Padding for 64-bit |
2149 | | //Unknown fields |
2150 | 0 | control_offset += 4; |
2151 | 0 | if (size_of_pointer == 8) |
2152 | 0 | control_offset += 4; //Padding for 64-bit |
2153 | |
|
2154 | 0 | proto_tree_add_item_ret_uint(filesystem_tree, hf_procmon_filesystem_directory_control_file_information_class, tvb, control_offset, 4, ENC_LITTLE_ENDIAN, &file_information_class); |
2155 | 0 | if (tvb_reported_length(extra_details_tvb) > 0) |
2156 | 0 | { |
2157 | 0 | uint32_t name_length, next_entry_offset; |
2158 | 0 | switch (file_information_class) |
2159 | 0 | { |
2160 | 0 | case 1: // File Directory Information |
2161 | 0 | case 2: // File Full Directory Information |
2162 | 0 | case 3: // File Both Directory Information |
2163 | 0 | case 12: // File Names Information |
2164 | 0 | case 37: // File Id Both Directory Information |
2165 | 0 | case 38: // File Id Full Directory Information |
2166 | 0 | do |
2167 | 0 | { |
2168 | 0 | int start_extra_offset = extra_offset; |
2169 | 0 | proto_item* information_item; |
2170 | 0 | proto_tree* information_tree = proto_tree_add_subtree(filesystem_tree, extra_details_tvb, extra_offset, 0, ett_procmon_filesystem_information, &information_item, "Information"); |
2171 | |
|
2172 | 0 | proto_tree_add_item_ret_uint(information_tree, hf_procmon_filesystem_directory_control_query_next_entry_offset, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN, &next_entry_offset); |
2173 | 0 | extra_offset += 4; |
2174 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_file_index, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN); |
2175 | 0 | extra_offset += 4; |
2176 | 0 | if (file_information_class == 12) |
2177 | 0 | { |
2178 | | // File Names Information |
2179 | 0 | proto_tree_add_item_ret_uint(information_tree, hf_procmon_filesystem_directory_control_query_name_length, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN, &name_length); |
2180 | 0 | extra_offset += 4; |
2181 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
2182 | 0 | extra_offset += name_length; |
2183 | 0 | proto_item_set_len(information_item, extra_offset-start_extra_offset); |
2184 | 0 | if ((int)next_entry_offset > extra_offset - start_extra_offset) |
2185 | 0 | { |
2186 | 0 | uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset); |
2187 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA); |
2188 | 0 | extra_offset += next_extry_padding_length; |
2189 | 0 | } |
2190 | 0 | continue; |
2191 | 0 | } |
2192 | | |
2193 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_creation_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
2194 | 0 | extra_offset += 8; |
2195 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_last_access_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
2196 | 0 | extra_offset += 8; |
2197 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_last_write_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
2198 | 0 | extra_offset += 8; |
2199 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_change_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
2200 | 0 | extra_offset += 8; |
2201 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_end_of_file, extra_details_tvb, extra_offset, 8, ENC_LITTLE_ENDIAN); |
2202 | 0 | extra_offset += 8; |
2203 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_allocation_size, extra_details_tvb, extra_offset, 8, ENC_LITTLE_ENDIAN); |
2204 | 0 | extra_offset += 8; |
2205 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_file_attributes, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN); |
2206 | 0 | extra_offset += 4; |
2207 | 0 | proto_tree_add_item_ret_uint(information_tree, hf_procmon_filesystem_directory_control_query_name_length, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN, &name_length); |
2208 | 0 | extra_offset += 4; |
2209 | 0 | if (file_information_class == 1) |
2210 | 0 | { |
2211 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
2212 | 0 | extra_offset += name_length; |
2213 | 0 | proto_item_set_len(information_item, extra_offset - start_extra_offset); |
2214 | 0 | if ((int)next_entry_offset > extra_offset - start_extra_offset) |
2215 | 0 | { |
2216 | 0 | uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset); |
2217 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA); |
2218 | 0 | extra_offset += next_extry_padding_length; |
2219 | 0 | } |
2220 | 0 | continue; |
2221 | 0 | } |
2222 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_file_ea_size, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN); |
2223 | 0 | extra_offset += 4; |
2224 | 0 | if (file_information_class == 2) |
2225 | 0 | { |
2226 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
2227 | 0 | extra_offset += name_length; |
2228 | 0 | proto_item_set_len(information_item, extra_offset - start_extra_offset); |
2229 | 0 | if ((int)next_entry_offset > extra_offset - start_extra_offset) |
2230 | 0 | { |
2231 | 0 | uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset); |
2232 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA); |
2233 | 0 | extra_offset += next_extry_padding_length; |
2234 | 0 | } |
2235 | 0 | continue; |
2236 | 0 | } |
2237 | 0 | if (file_information_class == 38) |
2238 | 0 | { |
2239 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_file_id, extra_details_tvb, extra_offset, 8, ENC_LITTLE_ENDIAN); |
2240 | 0 | extra_offset += 8; |
2241 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
2242 | 0 | extra_offset += name_length; |
2243 | 0 | proto_item_set_len(information_item, extra_offset - start_extra_offset); |
2244 | 0 | if ((int)next_entry_offset > extra_offset - start_extra_offset) |
2245 | 0 | { |
2246 | 0 | uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset); |
2247 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA); |
2248 | 0 | extra_offset += next_extry_padding_length; |
2249 | 0 | } |
2250 | 0 | continue; |
2251 | 0 | } |
2252 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_short_name_length, extra_details_tvb, extra_offset, 1, ENC_LITTLE_ENDIAN); |
2253 | 0 | extra_offset += 1; |
2254 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, 1, ENC_NA); |
2255 | 0 | extra_offset += 1; |
2256 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_short_name, extra_details_tvb, extra_offset, 24, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
2257 | 0 | extra_offset += 24; |
2258 | 0 | if (file_information_class == 3) |
2259 | 0 | { |
2260 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
2261 | 0 | extra_offset += name_length; |
2262 | 0 | proto_item_set_len(information_item, extra_offset - start_extra_offset); |
2263 | 0 | if ((int)next_entry_offset > extra_offset - start_extra_offset) |
2264 | 0 | { |
2265 | 0 | uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset); |
2266 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA); |
2267 | 0 | extra_offset += next_extry_padding_length; |
2268 | 0 | } |
2269 | 0 | continue; |
2270 | 0 | } |
2271 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, 2, ENC_NA); |
2272 | 0 | extra_offset += 2; |
2273 | 0 | proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_16 | ENC_LITTLE_ENDIAN); |
2274 | 0 | extra_offset += name_length; |
2275 | 0 | proto_item_set_len(information_item, extra_offset - start_extra_offset); |
2276 | 0 | if ((int)next_entry_offset > extra_offset - start_extra_offset) |
2277 | 0 | { |
2278 | 0 | uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset); |
2279 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA); |
2280 | 0 | extra_offset += next_extry_padding_length; |
2281 | 0 | } |
2282 | 0 | } |
2283 | 0 | while ((tvb_reported_length_remaining(extra_details_tvb, extra_offset) > 0) && (next_entry_offset != 0)); |
2284 | 0 | break; |
2285 | 0 | } |
2286 | 0 | } |
2287 | 0 | break; |
2288 | 0 | case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_NOTIFY_CHANGE: |
2289 | 0 | { |
2290 | 0 | static const value_string file_system_create_notify_change_flags_vals[] = { |
2291 | 0 | {0x1, "FILE_NOTIFY_CHANGE_FILE_NAME"}, |
2292 | 0 | {0x2, "FILE_NOTIFY_CHANGE_DIR_NAME"}, |
2293 | 0 | {0x3, "FILE_NOTIFY_CHANGE_NAME"}, |
2294 | 0 | {0x4, "FILE_NOTIFY_CHANGE_ATTRIBUTES"}, |
2295 | 0 | {0x8, "FILE_NOTIFY_CHANGE_SIZE"}, |
2296 | 0 | {0x10, "FILE_NOTIFY_CHANGE_LAST_WRITE"}, |
2297 | 0 | {0x20, "FILE_NOTIFY_CHANGE_LAST_ACCESS"}, |
2298 | 0 | {0x40, "FILE_NOTIFY_CHANGE_CREATION"}, |
2299 | 0 | {0x80, "FILE_NOTIFY_CHANGE_EA"}, |
2300 | 0 | {0x100, "FILE_NOTIFY_CHANGE_SECURITY"}, |
2301 | 0 | {0x200, "FILE_NOTIFY_CHANGE_STREAM_NAME"}, |
2302 | 0 | {0x400, "FILE_NOTIFY_CHANGE_STREAM_SIZE"}, |
2303 | 0 | {0x800, "FILE_NOTIFY_CHANGE_STREAM_WRITE"}, |
2304 | 0 | { 0, NULL } |
2305 | 0 | }; |
2306 | | |
2307 | | //Unknown fields |
2308 | 0 | control_offset += 16; |
2309 | 0 | if (size_of_pointer == 8) |
2310 | 0 | control_offset += 4; //Padding for 64-bit |
2311 | |
|
2312 | 0 | dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, control_offset, hf_procmon_filesystem_directory_control_notify_change_flags, 4, NULL, file_system_create_notify_change_flags_vals); |
2313 | 0 | break; |
2314 | 0 | } |
2315 | 0 | default: |
2316 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_details, tvb, offset, 5 * size_of_pointer + 20, ENC_NA); |
2317 | 0 | break; |
2318 | 0 | } |
2319 | 0 | break; |
2320 | 0 | } |
2321 | 0 | default: |
2322 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_details, tvb, offset, 5 * size_of_pointer + 20, ENC_NA); |
2323 | 0 | break; |
2324 | 0 | } |
2325 | 0 | offset += (5 * size_of_pointer + 20); |
2326 | |
|
2327 | 0 | dissect_procmon_detail_string_info(tvb, filesystem_tree, offset, |
2328 | 0 | hf_procmon_filesystem_path_size, hf_procmon_filesystem_path_is_ascii, hf_procmon_filesystem_path_char_count, ett_procmon_filesystem_path, |
2329 | 0 | &is_path_ascii, &path_char_count); |
2330 | 0 | offset += 2; |
2331 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, offset, 2, ENC_NA); |
2332 | 0 | offset += 2; |
2333 | 0 | offset = dissect_procmon_detail_string(tvb, filesystem_tree, offset, is_path_ascii, path_char_count, hf_procmon_filesystem_path); |
2334 | |
|
2335 | 0 | switch(operation) |
2336 | 0 | { |
2337 | 0 | case PROCMON_FILESYSTEM_OPERATION_CREATE_FILE: |
2338 | 0 | { |
2339 | 0 | uint32_t sid_length; |
2340 | 0 | dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, offset, hf_procmon_filesystem_create_file_access_mask, 4, file_system_access_mask_mapping, file_system_access_mask_vals); |
2341 | 0 | offset += 4; |
2342 | 0 | proto_tree_add_item_ret_uint(filesystem_tree, hf_procmon_filesystem_create_file_impersonating_sid_length, tvb, offset, 1, ENC_LITTLE_ENDIAN, &sid_length); |
2343 | 0 | offset += 1; |
2344 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, offset, 3, ENC_NA); |
2345 | 0 | offset += 3; |
2346 | 0 | if (sid_length > 0) |
2347 | 0 | { |
2348 | 0 | uint32_t revision, count, value; |
2349 | 0 | uint64_t identifier_authority; |
2350 | 0 | int sid_offset = offset; |
2351 | 0 | proto_item* sid_item; |
2352 | 0 | wmem_strbuf_t* impersonating_strbuf = wmem_strbuf_new(pinfo->pool, "S-"); |
2353 | 0 | proto_tree* impersonating_tree = proto_tree_add_subtree(filesystem_tree, tvb, sid_offset, sid_length, ett_procmon_filesystem_create_file_impersonating, &sid_item, "Impersonating SID"); |
2354 | 0 | proto_tree_add_item_ret_uint(impersonating_tree, hf_procmon_filesystem_create_file_sid_revision, tvb, sid_offset, 1, ENC_LITTLE_ENDIAN, &revision); |
2355 | 0 | sid_offset += 1; |
2356 | 0 | proto_tree_add_item_ret_uint(impersonating_tree, hf_procmon_filesystem_create_file_sid_count, tvb, sid_offset, 1, ENC_LITTLE_ENDIAN, &count); |
2357 | 0 | sid_offset += 1; |
2358 | 0 | proto_tree_add_item_ret_uint64(impersonating_tree, hf_procmon_filesystem_create_file_sid_authority, tvb, sid_offset, 6, ENC_BIG_ENDIAN, &identifier_authority); |
2359 | 0 | sid_offset += 6; |
2360 | 0 | wmem_strbuf_append_printf(impersonating_strbuf, "%u-%012" PRIx64, revision, identifier_authority); |
2361 | 0 | for (uint32_t i = 0; i < count; i++) |
2362 | 0 | { |
2363 | 0 | proto_tree_add_item_ret_uint(impersonating_tree, hf_procmon_filesystem_create_file_sid_value, tvb, sid_offset, 4, ENC_LITTLE_ENDIAN, &value); |
2364 | 0 | wmem_strbuf_append_printf(impersonating_strbuf, "-%08x", value); |
2365 | 0 | sid_offset += 4; |
2366 | 0 | } |
2367 | 0 | proto_item* sid_string_item = proto_tree_add_string(impersonating_tree, hf_procmon_filesystem_create_file_impersonating, tvb, offset, sid_offset - offset, wmem_strbuf_get_str(impersonating_strbuf)); |
2368 | 0 | PROTO_ITEM_SET_GENERATED(sid_string_item); |
2369 | 0 | proto_item_append_text(sid_item, " (%s)", wmem_strbuf_get_str(impersonating_strbuf)); |
2370 | 0 | } |
2371 | 0 | break; |
2372 | 0 | } |
2373 | 0 | case PROCMON_FILESYSTEM_OPERATION_FILE_SYSTEM_CONTROL: |
2374 | 0 | case PROCMON_FILESYSTEM_OPERATION_DEVICE_IO_CONTROL: |
2375 | 0 | switch (ioctl_value) |
2376 | 0 | { |
2377 | 0 | case 0x94264: // FSCTL_OFFLOAD_READ |
2378 | 0 | offset += 8; |
2379 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_offset, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
2380 | 0 | offset += 8; |
2381 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_length, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
2382 | | /* offset += 8; */ |
2383 | 0 | break; |
2384 | 0 | case 0x98268: // FSCTL_OFFLOAD_WRITE |
2385 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_offset, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
2386 | 0 | offset += 8; |
2387 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_length, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
2388 | | /* offset += 8; */ |
2389 | 0 | break; |
2390 | 0 | } |
2391 | 0 | break; |
2392 | | |
2393 | 0 | case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL: |
2394 | 0 | { |
2395 | 0 | int control_offset = offset; |
2396 | 0 | switch (sub_operation) |
2397 | 0 | { |
2398 | 0 | case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_QUERY: |
2399 | 0 | { |
2400 | 0 | dissect_procmon_detail_string_info(tvb, filesystem_tree, control_offset, |
2401 | 0 | hf_procmon_filesystem_directory_size, hf_procmon_filesystem_directory_is_ascii, hf_procmon_filesystem_directory_char_count, ett_procmon_filesystem_directory, |
2402 | 0 | &is_path_ascii, &path_char_count); |
2403 | 0 | control_offset += 2; |
2404 | 0 | /* control_offset = */ dissect_procmon_detail_string(tvb, filesystem_tree, control_offset, is_path_ascii, path_char_count, hf_procmon_filesystem_directory); |
2405 | 0 | break; |
2406 | 0 | } |
2407 | 0 | case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_NOTIFY_CHANGE: |
2408 | 0 | { |
2409 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, control_offset, 2, ENC_NA); |
2410 | | /* control_offset += 2; */ |
2411 | 0 | break; |
2412 | 0 | } |
2413 | 0 | } |
2414 | | |
2415 | | |
2416 | 0 | break; |
2417 | 0 | } |
2418 | 0 | case PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE: |
2419 | 0 | switch (sub_operation) |
2420 | 0 | { |
2421 | 0 | case PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION: |
2422 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_set_info_file_disposition_delete, tvb, offset, 1, ENC_LITTLE_ENDIAN); |
2423 | 0 | offset += 1; |
2424 | 0 | proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, offset, 3, ENC_NA); |
2425 | | /* offset += 3; */ |
2426 | 0 | break; |
2427 | 0 | } |
2428 | 0 | break; |
2429 | | |
2430 | 0 | default: |
2431 | 0 | break; |
2432 | 0 | } |
2433 | | |
2434 | 0 | return (extra_offset > 0); |
2435 | 0 | } |
2436 | | |
2437 | 0 | #define PROCMON_PROFILING_OPERATION_THREAD 0x0000 |
2438 | 0 | #define PROCMON_PROFILING_OPERATION_PROCESS 0x0001 |
2439 | 0 | #define PROCMON_PROFILING_OPERATION_DEBUG_OUTPUT 0x0002 |
2440 | | |
2441 | | static const value_string profiling_operation_vals[] = { |
2442 | | { PROCMON_PROFILING_OPERATION_THREAD, "Thread" }, |
2443 | | { PROCMON_PROFILING_OPERATION_PROCESS, "Process" }, |
2444 | | { PROCMON_PROFILING_OPERATION_DEBUG_OUTPUT, "Debug Output" }, |
2445 | | { 0, NULL } |
2446 | | }; |
2447 | | |
2448 | | static bool dissect_procmon_profiling_event(tvbuff_t* tvb, packet_info* pinfo _U_, proto_tree* tree, uint32_t operation, tvbuff_t* extra_details_tvb _U_) |
2449 | 0 | { |
2450 | 0 | unsigned offset = 0; |
2451 | |
|
2452 | 0 | proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_profiling_event, NULL, "Profiling Data"); |
2453 | |
|
2454 | 0 | switch(operation) |
2455 | 0 | { |
2456 | 0 | case PROCMON_PROFILING_OPERATION_THREAD: |
2457 | 0 | case PROCMON_PROFILING_OPERATION_PROCESS: |
2458 | 0 | case PROCMON_PROFILING_OPERATION_DEBUG_OUTPUT: |
2459 | | //Unknown |
2460 | 0 | break; |
2461 | 0 | default: |
2462 | 0 | break; |
2463 | 0 | } |
2464 | | |
2465 | 0 | return false; |
2466 | 0 | } |
2467 | | |
2468 | | #define PROCMON_NETWORK_OPERATION_UNKNOWN 0x0000 |
2469 | | #define PROCMON_NETWORK_OPERATION_OTHER 0x0001 |
2470 | | #define PROCMON_NETWORK_OPERATION_SEND 0x0002 |
2471 | | #define PROCMON_NETWORK_OPERATION_RECEIVE 0x0003 |
2472 | | #define PROCMON_NETWORK_OPERATION_ACCEPT 0x0004 |
2473 | | #define PROCMON_NETWORK_OPERATION_CONNECT 0x0005 |
2474 | | #define PROCMON_NETWORK_OPERATION_DISCONNECT 0x0006 |
2475 | | #define PROCMON_NETWORK_OPERATION_RECONNECT 0x0007 |
2476 | | #define PROCMON_NETWORK_OPERATION_RETRANSMIT 0x0008 |
2477 | | #define PROCMON_NETWORK_OPERATION_TCP_COPY 0x0009 |
2478 | | |
2479 | | static const value_string network_operation_vals[] = { |
2480 | | { PROCMON_NETWORK_OPERATION_UNKNOWN, "Unknown" }, |
2481 | | { PROCMON_NETWORK_OPERATION_OTHER, "Other" }, |
2482 | | { PROCMON_NETWORK_OPERATION_SEND, "Send" }, |
2483 | | { PROCMON_NETWORK_OPERATION_RECEIVE, "Receive" }, |
2484 | | { PROCMON_NETWORK_OPERATION_ACCEPT, "Accept" }, |
2485 | | { PROCMON_NETWORK_OPERATION_CONNECT, "Connect" }, |
2486 | | { PROCMON_NETWORK_OPERATION_DISCONNECT, "Disconnect" }, |
2487 | | { PROCMON_NETWORK_OPERATION_RECONNECT, "Reconnect" }, |
2488 | | { PROCMON_NETWORK_OPERATION_RETRANSMIT, "Retransmit" }, |
2489 | | { PROCMON_NETWORK_OPERATION_TCP_COPY, "TCP Copy" }, |
2490 | | { 0, NULL } |
2491 | | }; |
2492 | | |
2493 | | static const true_false_string tfs_tcp_udp = { "TCP", "UDP" }; |
2494 | | |
2495 | 0 | #define NETWORK_FLAG_IS_SRC_IPv4_MASK 0x0001 |
2496 | 0 | #define NETWORK_FLAG_IS_DEST_IPv4_MASK 0x0002 |
2497 | | #define NETWORK_FLAG_IS_TCP_MASK 0x0004 |
2498 | | |
2499 | | static bool dissect_procmon_network_event(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, uint32_t operation _U_, tvbuff_t* extra_details_tvb _U_) |
2500 | 0 | { |
2501 | 0 | proto_tree* network_event_tree; |
2502 | 0 | unsigned offset = 0; |
2503 | 0 | uint16_t flags; |
2504 | 0 | int detail_offset; |
2505 | 0 | unsigned detail_length; |
2506 | 0 | const char* detail_substring; |
2507 | 0 | wmem_strbuf_t* details = wmem_strbuf_new(pinfo->pool, ""); |
2508 | 0 | static int* const network_flags_vals[] = { |
2509 | 0 | &hf_procmon_network_flags_is_src_ipv4, |
2510 | 0 | &hf_procmon_network_flags_is_dst_ipv4, |
2511 | 0 | &hf_procmon_network_flags_tcp_udp, |
2512 | 0 | NULL |
2513 | 0 | }; |
2514 | |
|
2515 | 0 | network_event_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_network_event, NULL, "Network Data"); |
2516 | |
|
2517 | 0 | proto_tree_add_bitmask_with_flags(network_event_tree, tvb, offset, hf_procmon_network_flags, ett_procmon_network_flags, network_flags_vals, ENC_LITTLE_ENDIAN, BMT_NO_APPEND); |
2518 | 0 | flags = tvb_get_letohs(tvb, offset); |
2519 | 0 | offset += 2; |
2520 | | |
2521 | | //Unknown fields |
2522 | 0 | offset += 2; |
2523 | |
|
2524 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
2525 | 0 | offset += 4; |
2526 | 0 | if (flags & NETWORK_FLAG_IS_SRC_IPv4_MASK) |
2527 | 0 | { |
2528 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_src_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN); |
2529 | 0 | offset += 4; |
2530 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_padding, tvb, offset, 12, ENC_NA); |
2531 | 0 | offset += 12; |
2532 | 0 | } |
2533 | 0 | else |
2534 | 0 | { |
2535 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_src_ipv6, tvb, offset, IPv6_ADDR_SIZE, ENC_NA); |
2536 | 0 | offset += IPv6_ADDR_SIZE; |
2537 | 0 | } |
2538 | 0 | if (flags & NETWORK_FLAG_IS_DEST_IPv4_MASK) |
2539 | 0 | { |
2540 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_dest_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN); |
2541 | 0 | offset += 4; |
2542 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_padding, tvb, offset, 12, ENC_NA); |
2543 | 0 | offset += 12; |
2544 | 0 | } |
2545 | 0 | else |
2546 | 0 | { |
2547 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_dest_ipv6, tvb, offset, IPv6_ADDR_SIZE, ENC_NA); |
2548 | 0 | offset += IPv6_ADDR_SIZE; |
2549 | 0 | } |
2550 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_src_port, tvb, offset, 2, ENC_LITTLE_ENDIAN); |
2551 | 0 | offset += 2; |
2552 | 0 | proto_tree_add_item(network_event_tree, hf_procmon_network_dest_port, tvb, offset, 2, ENC_LITTLE_ENDIAN); |
2553 | 0 | offset += 2; |
2554 | 0 | detail_offset = offset; |
2555 | 0 | while (((detail_substring = (char*)tvb_get_stringz_enc(pinfo->pool, tvb, offset, &detail_length, ENC_UTF_16 | ENC_LITTLE_ENDIAN)) != NULL) && (strlen(detail_substring) > 0)) |
2556 | 0 | { |
2557 | 0 | wmem_strbuf_append_printf(details, " %s", detail_substring); |
2558 | 0 | offset += detail_length; |
2559 | 0 | } |
2560 | | //Include the NULL string at the end of the list |
2561 | 0 | offset += 2; |
2562 | 0 | proto_tree_add_string(network_event_tree, hf_procmon_network_details, tvb, detail_offset, offset-detail_offset, wmem_strbuf_get_str(details)); |
2563 | |
|
2564 | 0 | return false; |
2565 | 0 | } |
2566 | | |
2567 | | static procmon_process_t *get_procmon_process(packet_info *pinfo, uint32_t process_index) |
2568 | 0 | { |
2569 | 0 | if (process_index >= pinfo->pseudo_header->procmon.process_index_map_size) |
2570 | 0 | { |
2571 | 0 | return NULL; |
2572 | 0 | } |
2573 | | |
2574 | 0 | uint32_t proc_array_idx = pinfo->pseudo_header->procmon.process_index_map[process_index]; |
2575 | 0 | if (proc_array_idx >= pinfo->pseudo_header->procmon.process_array_size) |
2576 | 0 | { |
2577 | 0 | return NULL; |
2578 | 0 | } |
2579 | | |
2580 | 0 | return &pinfo->pseudo_header->procmon.process_array[proc_array_idx]; |
2581 | 0 | } |
2582 | | |
2583 | | static int |
2584 | | dissect_procmon_event(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) |
2585 | 0 | { |
2586 | 0 | proto_item *ti, *ti_event, *ti_operation; |
2587 | 0 | proto_tree *procmon_tree, *header_tree, *stack_trace_tree; |
2588 | 0 | int offset = 0; |
2589 | 0 | uint32_t event_class, operation; |
2590 | 0 | uint32_t details_size, extra_details_offset; |
2591 | 0 | uint16_t extra_details_size = 0; |
2592 | 0 | int hf_operation; |
2593 | 0 | const value_string* operation_vs = NULL; |
2594 | 0 | bool handle_extra_details = false; |
2595 | 0 | tvbuff_t *details_tvb, *extra_details_tvb; |
2596 | |
|
2597 | 0 | col_set_str(pinfo->cinfo, COL_PROTOCOL, "MS Procmon"); |
2598 | 0 | col_clear(pinfo->cinfo, COL_INFO); |
2599 | 0 | col_set_str(pinfo->cinfo, COL_INFO, "MS Procmon Event"); |
2600 | |
|
2601 | 0 | ti = proto_tree_add_item(tree, proto_procmon, tvb, 0, -1, ENC_NA); |
2602 | 0 | procmon_tree = proto_item_add_subtree(ti, ett_procmon); |
2603 | |
|
2604 | 0 | header_tree = proto_tree_add_subtree(procmon_tree, tvb, offset, 52, ett_procmon_header, NULL, "Event Header"); |
2605 | |
|
2606 | 0 | uint32_t process_index = tvb_get_letohl(tvb, offset); |
2607 | 0 | procmon_process_t *proc = get_procmon_process(pinfo, process_index); |
2608 | 0 | if (proc) { |
2609 | 0 | proto_tree_add_uint(header_tree, hf_procmon_process_id, tvb, offset, 4, proc->process_id); |
2610 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_name, tvb, offset, 4, proc->process_name); |
2611 | 0 | proto_tree_add_uint(header_tree, hf_procmon_process_parent_pid, tvb, offset, 4, proc->parent_process_id); |
2612 | 0 | procmon_process_t *parent_proc = get_procmon_process(pinfo, proc->parent_process_index); |
2613 | 0 | if (parent_proc) { |
2614 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_parent_name, tvb, offset, 4, parent_proc->process_name); |
2615 | 0 | } |
2616 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_image_path, tvb, offset, 4, proc->image_path); |
2617 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_command_line, tvb, offset, 4, proc->command_line); |
2618 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_user_name, tvb, offset, 4, proc->user_name); |
2619 | 0 | proto_tree_add_time(header_tree, hf_procmon_process_start_time, tvb, offset, 4, &proc->start_time); |
2620 | 0 | proto_tree_add_time(header_tree, hf_procmon_process_end_time, tvb, offset, 4, &proc->end_time); |
2621 | 0 | proto_tree_add_uint(header_tree, hf_procmon_process_session_number, tvb, offset, 4, proc->session_number); |
2622 | 0 | proto_tree_add_uint64(header_tree, hf_procmon_process_authentication_id, tvb, offset, 4, proc->authentication_id); |
2623 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_integrity, tvb, offset, 4, proc->integrity); |
2624 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_company, tvb, offset, 4, proc->company); |
2625 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_version, tvb, offset, 4, proc->version); |
2626 | 0 | proto_tree_add_string(header_tree, hf_procmon_process_description, tvb, offset, 4, proc->description); |
2627 | 0 | proto_tree_add_boolean(header_tree, hf_procmon_process_is_virtualized, tvb, offset, 4, proc->is_virtualized); |
2628 | 0 | proto_tree_add_boolean(header_tree, hf_procmon_process_is_64_bit, tvb, offset, 4, proc->is_64_bit); |
2629 | 0 | pinfo->user_name = proc->user_name; |
2630 | 0 | col_clear(pinfo->cinfo, COL_INFO); |
2631 | 0 | col_add_fstr(pinfo->cinfo, COL_INFO, "%s ", proc->process_name); |
2632 | 0 | col_set_fence(pinfo->cinfo, COL_INFO); |
2633 | |
|
2634 | 0 | if (proc->num_modules > 0) { |
2635 | 0 | for (uint32_t idx = 0; idx < proc->num_modules; idx++) { |
2636 | 0 | proto_tree *modules_tree = proto_tree_add_subtree_format(header_tree, tvb, offset, 4, ett_procmon_process_modules, NULL, "Module %u: %s", idx + 1, proc->modules[idx].image_path); |
2637 | 0 | proto_tree_add_uint64(modules_tree, hf_procmon_module_base_address, tvb, offset, 4, proc->modules[idx].base_address); |
2638 | 0 | proto_tree_add_uint(modules_tree, hf_procmon_module_size, tvb, offset, 4, proc->modules[idx].size); |
2639 | 0 | proto_tree_add_string(modules_tree, hf_procmon_module_image_path, tvb, offset, 4, proc->modules[idx].image_path); |
2640 | 0 | proto_tree_add_string(modules_tree, hf_procmon_module_version, tvb, offset, 4, proc->modules[idx].version); |
2641 | 0 | proto_tree_add_string(modules_tree, hf_procmon_module_company, tvb, offset, 4, proc->modules[idx].company); |
2642 | 0 | proto_tree_add_string(modules_tree, hf_procmon_module_description, tvb, offset, 4, proc->modules[idx].description); |
2643 | | // proto_tree_add_time(modules_tree, hf_procmon_module_timestamp, tvb, offset, 4, &proc->modules[idx].timestamp); |
2644 | 0 | } |
2645 | 0 | } |
2646 | 0 | } else { |
2647 | 0 | proto_item *index_item = proto_tree_add_item(header_tree, hf_procmon_process_index, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
2648 | 0 | expert_add_info_format(pinfo, index_item, &ei_procmon_unknown_index, "Unknown process index: %u", process_index); |
2649 | 0 | } |
2650 | |
|
2651 | 0 | offset += 4; |
2652 | 0 | proto_tree_add_item(header_tree, hf_procmon_thread_id, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
2653 | 0 | offset += 4; |
2654 | 0 | ti_event = proto_tree_add_item_ret_uint(header_tree, hf_procmon_event_class, tvb, offset, 4, ENC_LITTLE_ENDIAN, &event_class); |
2655 | 0 | offset += 4; |
2656 | |
|
2657 | 0 | switch (event_class) |
2658 | 0 | { |
2659 | 0 | case PROCMON_EVENT_CLASS_TYPE_PROCESS: |
2660 | 0 | operation_vs = process_operation_vals; |
2661 | 0 | hf_operation = hf_procmon_process_operation; |
2662 | 0 | break; |
2663 | 0 | case PROCMON_EVENT_CLASS_TYPE_REGISTRY: |
2664 | 0 | operation_vs = registry_operation_vals; |
2665 | 0 | hf_operation = hf_procmon_registry_operation; |
2666 | 0 | break; |
2667 | 0 | case PROCMON_EVENT_CLASS_TYPE_FILE_SYSTEM: |
2668 | 0 | operation_vs = filesystem_operation_vals; |
2669 | 0 | hf_operation = hf_procmon_filesystem_operation; |
2670 | 0 | break; |
2671 | 0 | case PROCMON_EVENT_CLASS_TYPE_PROFILING: |
2672 | 0 | operation_vs = profiling_operation_vals; |
2673 | 0 | hf_operation = hf_procmon_profiling_operation; |
2674 | 0 | break; |
2675 | 0 | case PROCMON_EVENT_CLASS_TYPE_NETWORK: |
2676 | 0 | operation_vs = network_operation_vals; |
2677 | 0 | hf_operation = hf_procmon_network_operation; |
2678 | 0 | break; |
2679 | 0 | default: |
2680 | 0 | hf_operation = hf_procmon_operation_type; |
2681 | 0 | break; |
2682 | 0 | } |
2683 | 0 | ti_operation = proto_tree_add_item_ret_uint(header_tree, hf_operation, tvb, offset, 2, ENC_LITTLE_ENDIAN, &operation); |
2684 | 0 | offset += 2; |
2685 | |
|
2686 | 0 | if (operation_vs != NULL) |
2687 | 0 | { |
2688 | 0 | const char* event_class_str = val_to_str_const(event_class, event_class_vals, "Unknown"); |
2689 | 0 | const char* operation_str = try_val_to_str(operation, operation_vs); |
2690 | 0 | if (operation_str == NULL) |
2691 | 0 | { |
2692 | 0 | expert_add_info_format(pinfo, ti_operation, &ei_procmon_unknown_operation, "Unknown %s operation: 0x%04x", event_class_str, operation); |
2693 | 0 | col_add_fstr(pinfo->cinfo, COL_INFO, "%s Operation: Unknown (0x%04x)", event_class_str, operation); |
2694 | 0 | } |
2695 | 0 | else |
2696 | 0 | { |
2697 | 0 | col_add_fstr(pinfo->cinfo, COL_INFO, "%s Operation: %s", event_class_str, operation_str); |
2698 | 0 | } |
2699 | 0 | } |
2700 | | |
2701 | | //Next 6 bytes are unknown |
2702 | 0 | offset += 6; |
2703 | 0 | proto_tree_add_item(header_tree, hf_procmon_duration, tvb, offset, 8, ENC_LITTLE_ENDIAN); |
2704 | 0 | offset += 8; |
2705 | 0 | proto_tree_add_item(header_tree, hf_procmon_timestamp, tvb, offset, 8, ENC_TIME_WINDOWS|ENC_LITTLE_ENDIAN); |
2706 | 0 | offset += 8; |
2707 | 0 | proto_tree_add_item(header_tree, hf_procmon_event_result, tvb, offset, 4, ENC_LITTLE_ENDIAN); |
2708 | 0 | offset += 4; |
2709 | 0 | proto_tree_add_item(header_tree, hf_procmon_stack_trace_depth, tvb, offset, 2, ENC_LITTLE_ENDIAN); |
2710 | 0 | offset += 2; |
2711 | | //Next 2 bytes are unknown |
2712 | 0 | offset += 2; |
2713 | 0 | proto_tree_add_item_ret_uint(header_tree, hf_procmon_details_size, tvb, offset, 4, ENC_LITTLE_ENDIAN, &details_size); |
2714 | 0 | offset += 4; |
2715 | 0 | proto_tree_add_item_ret_uint(header_tree, hf_procmon_extra_details_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN, &extra_details_offset); |
2716 | 0 | offset += 4; |
2717 | | |
2718 | | //Stack trace size part of the record |
2719 | 0 | #define PROCMON_MAX_STACK_TRACE_COUNT 100 // Arbitrary. |
2720 | 0 | uint32_t full_stack_trace_size; // Host byte order. |
2721 | 0 | tvb_memcpy(tvb, &full_stack_trace_size, offset, 4); |
2722 | 0 | int size_of_pointer = pinfo->pseudo_header->procmon.system_bitness ? 8 : 4; |
2723 | 0 | unsigned max_stack_trace_size = PROCMON_MAX_STACK_TRACE_COUNT * size_of_pointer; |
2724 | 0 | unsigned stack_trace_size = MIN(full_stack_trace_size, max_stack_trace_size); |
2725 | |
|
2726 | 0 | offset += 4; |
2727 | 0 | int stack_offset = offset; |
2728 | 0 | if (stack_trace_size > 0) |
2729 | 0 | { |
2730 | 0 | stack_trace_tree = proto_tree_add_subtree(procmon_tree, tvb, offset, stack_trace_size, ett_procmon_stack_trace, NULL, "Stack Trace"); |
2731 | 0 | for (uint32_t i = 0; i < stack_trace_size; i += size_of_pointer) |
2732 | 0 | { |
2733 | 0 | proto_tree_add_item(stack_trace_tree, hf_procmon_stack_trace_address, tvb, offset, size_of_pointer, ENC_LITTLE_ENDIAN); |
2734 | 0 | offset += size_of_pointer; |
2735 | 0 | } |
2736 | 0 | } |
2737 | | // XXX Add truncation / mismatched size expert item |
2738 | 0 | offset = stack_offset + full_stack_trace_size; |
2739 | |
|
2740 | 0 | details_tvb = tvb_new_subset_length(tvb, offset, details_size); |
2741 | 0 | offset += details_size; |
2742 | 0 | if (extra_details_offset > 0) |
2743 | 0 | { |
2744 | 0 | extra_details_size = tvb_get_letohs(tvb, offset); |
2745 | 0 | offset += 2; |
2746 | 0 | } |
2747 | |
|
2748 | 0 | extra_details_tvb = tvb_new_subset_length(tvb, offset, extra_details_size); |
2749 | 0 | switch(event_class) |
2750 | 0 | { |
2751 | 0 | case PROCMON_EVENT_CLASS_TYPE_PROCESS: |
2752 | 0 | handle_extra_details = dissect_procmon_process_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb); |
2753 | 0 | break; |
2754 | 0 | case PROCMON_EVENT_CLASS_TYPE_REGISTRY: |
2755 | 0 | handle_extra_details = dissect_procmon_registry_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb); |
2756 | 0 | break; |
2757 | 0 | case PROCMON_EVENT_CLASS_TYPE_FILE_SYSTEM: |
2758 | 0 | handle_extra_details = dissect_procmon_filesystem_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb); |
2759 | 0 | break; |
2760 | 0 | case PROCMON_EVENT_CLASS_TYPE_PROFILING: |
2761 | 0 | handle_extra_details = dissect_procmon_profiling_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb); |
2762 | 0 | break; |
2763 | 0 | case PROCMON_EVENT_CLASS_TYPE_NETWORK: |
2764 | 0 | handle_extra_details = dissect_procmon_network_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb); |
2765 | 0 | break; |
2766 | 0 | default: |
2767 | 0 | expert_add_info(pinfo, ti_event, &ei_procmon_unknown_event_class); |
2768 | 0 | proto_tree_add_item(procmon_tree, hf_procmon_detail_data, details_tvb, 0, details_size, ENC_NA); |
2769 | 0 | break; |
2770 | 0 | } |
2771 | | |
2772 | 0 | if ((extra_details_size > 0) && (!handle_extra_details)) |
2773 | 0 | { |
2774 | 0 | proto_tree_add_item(procmon_tree, hf_procmon_extra_detail_data, tvb, offset, extra_details_size, ENC_NA); |
2775 | 0 | offset += extra_details_size; |
2776 | 0 | } |
2777 | |
|
2778 | 0 | return offset; |
2779 | 0 | } |
2780 | | |
2781 | | /* |
2782 | | * Register the protocol with Wireshark. |
2783 | | */ |
2784 | | void |
2785 | | event_register_procmon(void) |
2786 | 0 | { |
2787 | 0 | static hf_register_info hf[] = { |
2788 | 0 | { &hf_procmon_process_index, |
2789 | 0 | { "Process Index", "procmon.process_index", |
2790 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
2791 | 0 | }, |
2792 | 0 | { &hf_procmon_process_id, |
2793 | 0 | { "Process ID", "procmon.process.id", |
2794 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
2795 | 0 | }, |
2796 | 0 | { &hf_procmon_process_name, |
2797 | 0 | { "Process Name", "procmon.process.name", |
2798 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2799 | 0 | }, |
2800 | 0 | { &hf_procmon_process_parent_name, |
2801 | 0 | { "Parent Process Name", "procmon.process.parent_name", |
2802 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2803 | 0 | }, |
2804 | 0 | { &hf_procmon_process_image_path, |
2805 | 0 | { "Image Path", "procmon.process.image_path", |
2806 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2807 | 0 | }, |
2808 | 0 | { &hf_procmon_process_command_line, |
2809 | 0 | { "Command Line", "procmon.process.command_line", |
2810 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2811 | 0 | }, |
2812 | 0 | { &hf_procmon_process_user_name, |
2813 | 0 | { "User Name", "procmon.process.user_name", |
2814 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2815 | 0 | }, |
2816 | 0 | { &hf_procmon_process_start_time, |
2817 | 0 | { "Process Start Time", "procmon.process.start_time", |
2818 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
2819 | 0 | }, |
2820 | 0 | { &hf_procmon_process_end_time, |
2821 | 0 | { "Process End Time", "procmon.process.end_time", |
2822 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
2823 | 0 | }, |
2824 | 0 | { &hf_procmon_process_session_number, |
2825 | 0 | { "Process Session Number", "procmon.process.session_number", |
2826 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
2827 | 0 | }, |
2828 | 0 | { &hf_procmon_process_authentication_id, |
2829 | 0 | { "Process Authentication ID", "procmon.process.authentication_id", |
2830 | 0 | FT_UINT64, BASE_HEX, NULL, 0, NULL, HFILL } |
2831 | 0 | }, |
2832 | 0 | { &hf_procmon_process_integrity, |
2833 | 0 | { "Process Integrity", "procmon.process.integrity", |
2834 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2835 | 0 | }, |
2836 | 0 | { &hf_procmon_process_company, |
2837 | 0 | { "Process Company", "procmon.process.company", |
2838 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2839 | 0 | }, |
2840 | 0 | { &hf_procmon_process_version, |
2841 | 0 | { "Process Version", "procmon.process.version", |
2842 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2843 | 0 | }, |
2844 | 0 | { &hf_procmon_process_description, |
2845 | 0 | { "Process Description", "procmon.process.description", |
2846 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2847 | 0 | }, |
2848 | 0 | { &hf_procmon_process_is_virtualized, |
2849 | 0 | { "Process Is Virtualized", "procmon.process.is_virtualized", |
2850 | 0 | FT_BOOLEAN, BASE_NONE, NULL, 0, NULL, HFILL } |
2851 | 0 | }, |
2852 | 0 | { &hf_procmon_process_is_64_bit, |
2853 | 0 | { "Process Is 64-bit", "procmon.process.is_64_bit", |
2854 | 0 | FT_BOOLEAN, BASE_NONE, TFS(&process_architecture_tfs), 0, NULL, HFILL } |
2855 | 0 | }, |
2856 | 0 | { &hf_procmon_module_base_address, |
2857 | 0 | { "Module Base Address", "procmon.module.base_address", |
2858 | 0 | FT_UINT64, BASE_HEX, NULL, 0, NULL, HFILL } |
2859 | 0 | }, |
2860 | 0 | { &hf_procmon_module_size, |
2861 | 0 | { "Module Size", "procmon.module.size", |
2862 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
2863 | 0 | }, |
2864 | 0 | { &hf_procmon_module_image_path, |
2865 | 0 | { "Module Image Path", "procmon.module.image_path", |
2866 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2867 | 0 | }, |
2868 | 0 | { &hf_procmon_module_version, |
2869 | 0 | { "Module Version", "procmon.module.version", |
2870 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2871 | 0 | }, |
2872 | 0 | { &hf_procmon_module_company, |
2873 | 0 | { "Module Company", "procmon.module.company", |
2874 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2875 | 0 | }, |
2876 | 0 | { &hf_procmon_module_description, |
2877 | 0 | { "Module Description", "procmon.module.description", |
2878 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2879 | 0 | }, |
2880 | 0 | { &hf_procmon_module_timestamp, |
2881 | 0 | { "Module Timestamp", "procmon.module.timestamp", |
2882 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
2883 | 0 | }, |
2884 | 0 | { &hf_procmon_thread_id, |
2885 | 0 | { "Thread ID", "procmon.thread_id", |
2886 | 0 | FT_UINT32, BASE_DEC_HEX, NULL, 0, NULL, HFILL } |
2887 | 0 | }, |
2888 | 0 | { &hf_procmon_event_class, |
2889 | 0 | { "Event Class", "procmon.event_class", |
2890 | 0 | FT_UINT32, BASE_DEC, VALS(event_class_vals), 0, NULL, HFILL} |
2891 | 0 | }, |
2892 | 0 | { &hf_procmon_operation_type, |
2893 | 0 | { "Operation Type", "procmon.operation_type", |
2894 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
2895 | 0 | }, |
2896 | 0 | { &hf_procmon_duration, |
2897 | 0 | { "Duration", "procmon.duration", |
2898 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
2899 | 0 | }, |
2900 | 0 | { &hf_procmon_timestamp, |
2901 | 0 | { "Timestamp", "procmon.timestamp", |
2902 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
2903 | 0 | }, |
2904 | 0 | { &hf_procmon_event_result, |
2905 | 0 | { "Event Result", "procmon.event_result", |
2906 | 0 | FT_UINT32, BASE_DEC_HEX, VALS(system_error_code_vals), 0, NULL, HFILL } |
2907 | 0 | }, |
2908 | 0 | { &hf_procmon_stack_trace_depth, |
2909 | 0 | { "Stack Trace Depth", "procmon.stack_trace_depth", |
2910 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
2911 | 0 | }, |
2912 | 0 | { &hf_procmon_details_size, |
2913 | 0 | { "Details Size", "procmon.details_size", |
2914 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
2915 | 0 | }, |
2916 | 0 | { &hf_procmon_extra_details_offset, |
2917 | 0 | { "Extra Details Offset", "procmon.extra_details_offset", |
2918 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
2919 | 0 | }, |
2920 | 0 | { &hf_procmon_stack_trace_address, |
2921 | 0 | { "Stack trace address", "procmon.stack_trace_address", |
2922 | 0 | FT_UINT64, BASE_HEX, NULL, 0, NULL, HFILL } |
2923 | 0 | }, |
2924 | 0 | { &hf_procmon_detail_data, |
2925 | 0 | { "Detail Data", "procmon.detail_data", |
2926 | 0 | FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL } |
2927 | 0 | }, |
2928 | 0 | { &hf_procmon_extra_detail_data, |
2929 | 0 | { "Extra detail data", "procmon.extra_detail_data", |
2930 | 0 | FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL } |
2931 | 0 | }, |
2932 | 0 | { &hf_procmon_process_operation, |
2933 | 0 | { "Operation Type", "procmon.process.operation_type", |
2934 | 0 | FT_UINT16, BASE_DEC, VALS(process_operation_vals), 0, NULL, HFILL} |
2935 | 0 | }, |
2936 | 0 | { &hf_procmon_process_pid, |
2937 | 0 | { "PID", "procmon.process.pid", |
2938 | 0 | FT_UINT32, BASE_DEC_HEX, NULL, 0, NULL, HFILL } |
2939 | 0 | }, |
2940 | 0 | { &hf_procmon_process_path, |
2941 | 0 | { "Path", "procmon.process.path", |
2942 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2943 | 0 | }, |
2944 | 0 | { &hf_procmon_process_path_size, |
2945 | 0 | { "Path Size", "procmon.process.path.size", |
2946 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
2947 | 0 | }, |
2948 | 0 | { &hf_procmon_process_path_is_ascii, |
2949 | 0 | { "Is ASCII", "procmon.process.path.is_ascii", |
2950 | 0 | FT_BOOLEAN, 16, NULL, STRING_IS_ASCII_MASK, NULL, HFILL } |
2951 | 0 | }, |
2952 | 0 | { &hf_procmon_process_path_char_count, |
2953 | 0 | { "Char Count", "procmon.process.path.char_count", |
2954 | 0 | FT_UINT16, BASE_DEC, NULL, STRING_CHAR_COUNT_MASK, NULL, HFILL } |
2955 | 0 | }, |
2956 | 0 | { &hf_procmon_process_commandline, |
2957 | 0 | { "Commandline", "procmon.process.commandline", |
2958 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
2959 | 0 | }, |
2960 | 0 | { &hf_procmon_process_commandline_size, |
2961 | 0 | { "Commandline Size", "procmon.process.commandline.size", |
2962 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
2963 | 0 | }, |
2964 | 0 | { &hf_procmon_process_commandline_is_ascii, |
2965 | 0 | { "Is ASCII", "procmon.process.commandline.is_ascii", |
2966 | 0 | FT_BOOLEAN, 16, NULL, STRING_IS_ASCII_MASK, NULL, HFILL } |
2967 | 0 | }, |
2968 | 0 | { &hf_procmon_process_commandline_char_count, |
2969 | 0 | { "Char Count", "procmon.process.commandline.char_count", |
2970 | 0 | FT_UINT16, BASE_DEC, NULL, STRING_CHAR_COUNT_MASK, NULL, HFILL } |
2971 | 0 | }, |
2972 | 0 | { &hf_procmon_process_exit_status, |
2973 | 0 | { "Exit Status", "procmon.process.exit_status", |
2974 | 0 | FT_UINT32, BASE_DEC_HEX, NULL, 0, NULL, HFILL } |
2975 | 0 | }, |
2976 | 0 | { &hf_procmon_process_kernel_time, |
2977 | 0 | { "Kernel time", "procmon.process.kernel_time", |
2978 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
2979 | 0 | }, |
2980 | 0 | { &hf_procmon_process_user_time, |
2981 | 0 | { "User time", "procmon.process.user_time", |
2982 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
2983 | 0 | }, |
2984 | 0 | { &hf_procmon_process_working_set, |
2985 | 0 | { "Working Set", "procmon.process.working_set", |
2986 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
2987 | 0 | }, |
2988 | 0 | { &hf_procmon_process_peak_working_set, |
2989 | 0 | { "Peak Working Set", "procmon.process.peak_working_set", |
2990 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
2991 | 0 | }, |
2992 | 0 | { &hf_procmon_process_private_bytes, |
2993 | 0 | { "Private Bytes", "procmon.process.private_bytes", |
2994 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
2995 | 0 | }, |
2996 | 0 | { &hf_procmon_process_peak_private_bytes, |
2997 | 0 | { "Peak Private Bytes", "procmon.process.peak_private_bytes", |
2998 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
2999 | 0 | }, |
3000 | 0 | { &hf_procmon_process_thread_id, |
3001 | 0 | { "Thread ID", "procmon.process.thread_id", |
3002 | 0 | FT_UINT32, BASE_DEC_HEX, NULL, 0, NULL, HFILL } |
3003 | 0 | }, |
3004 | 0 | { &hf_procmon_process_image_base, |
3005 | 0 | { "Image Base", "procmon.process.image_base", |
3006 | 0 | FT_UINT64, BASE_HEX, NULL, 0, NULL, HFILL } |
3007 | 0 | }, |
3008 | 0 | { &hf_procmon_process_image_size, |
3009 | 0 | { "Image Size", "procmon.process.image_size", |
3010 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3011 | 0 | }, |
3012 | 0 | { &hf_procmon_process_parent_pid, |
3013 | 0 | { "Parent PID", "procmon.process.parent_pid", |
3014 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3015 | 0 | }, |
3016 | 0 | { &hf_procmon_process_curdir, |
3017 | 0 | { "Current Directory", "procmon.process.curdir", |
3018 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3019 | 0 | }, |
3020 | 0 | { &hf_procmon_process_curdir_size, |
3021 | 0 | { "Current Directory Size", "procmon.process.curdir.size", |
3022 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
3023 | 0 | }, |
3024 | 0 | { &hf_procmon_process_curdir_is_ascii, |
3025 | 0 | { "Is ASCII", "procmon.process.curdir.is_ascii", |
3026 | 0 | FT_BOOLEAN, 16, NULL, STRING_IS_ASCII_MASK, NULL, HFILL } |
3027 | 0 | }, |
3028 | 0 | { &hf_procmon_process_curdir_char_count, |
3029 | 0 | { "Char Count", "procmon.process.curdir.char_count", |
3030 | 0 | FT_UINT16, BASE_DEC, NULL, STRING_CHAR_COUNT_MASK, NULL, HFILL } |
3031 | 0 | }, |
3032 | 0 | { &hf_procmon_process_environment_char_count, |
3033 | 0 | { "Environment Size", "procmon.process.environment.char_count", |
3034 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3035 | 0 | }, |
3036 | 0 | { &hf_procmon_process_environment, |
3037 | 0 | { "Environment", "procmon.process.environment", |
3038 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3039 | 0 | }, |
3040 | 0 | { &hf_procmon_registry_operation, |
3041 | 0 | { "Operation Type", "procmon.registry.operation_type", |
3042 | 0 | FT_UINT16, BASE_DEC, VALS(registry_operation_vals), 0, NULL, HFILL } |
3043 | 0 | }, |
3044 | 0 | { &hf_procmon_registry_desired_access, |
3045 | 0 | { "Desired Access", "procmon.registry.desired_access", |
3046 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3047 | 0 | }, |
3048 | 0 | { &hf_procmon_registry_granted_access, |
3049 | 0 | { "Granted Access", "procmon.registry.granted_access", |
3050 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3051 | 0 | }, |
3052 | 0 | { &hf_procmon_registry_disposition, |
3053 | 0 | { "Disposition", "procmon.registry.disposition", |
3054 | 0 | FT_UINT32, BASE_DEC, VALS(registry_disposition_vals), 0, NULL, HFILL} |
3055 | 0 | }, |
3056 | 0 | { &hf_procmon_registry_key, |
3057 | 0 | { "Key", "procmon.registry.key", |
3058 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3059 | 0 | }, |
3060 | 0 | { &hf_procmon_registry_key_size, |
3061 | 0 | { "Key Size", "procmon.registry.key.size", |
3062 | 0 | FT_UINT16, BASE_DEC_HEX, NULL, 0, NULL, HFILL } |
3063 | 0 | }, |
3064 | 0 | { &hf_procmon_registry_key_is_ascii, |
3065 | 0 | { "Is ASCII", "procmon.registry.key.is_ascii", |
3066 | 0 | FT_BOOLEAN, 16, NULL, STRING_IS_ASCII_MASK, NULL, HFILL } |
3067 | 0 | }, |
3068 | 0 | { &hf_procmon_registry_key_char_count, |
3069 | 0 | { "Char Count", "procmon.registry.key.char_count", |
3070 | 0 | FT_UINT16, BASE_DEC, NULL, STRING_CHAR_COUNT_MASK, NULL, HFILL } |
3071 | 0 | }, |
3072 | 0 | { &hf_procmon_registry_new_key, |
3073 | 0 | { "New Key", "procmon.registry.new_key", |
3074 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3075 | 0 | }, |
3076 | 0 | { &hf_procmon_registry_new_key_size, |
3077 | 0 | { "New Key Size", "procmon.registry.new_key.size", |
3078 | 0 | FT_UINT16, BASE_DEC_HEX, NULL, 0, NULL, HFILL } |
3079 | 0 | }, |
3080 | 0 | { &hf_procmon_registry_new_key_is_ascii, |
3081 | 0 | { "Is ASCII", "procmon.registry.new_key.is_ascii", |
3082 | 0 | FT_BOOLEAN, 16, NULL, STRING_IS_ASCII_MASK, NULL, HFILL } |
3083 | 0 | }, |
3084 | 0 | { &hf_procmon_registry_new_key_char_count, |
3085 | 0 | { "Char Count", "procmon.registry.new_key.char_count", |
3086 | 0 | FT_UINT16, BASE_DEC, NULL, STRING_CHAR_COUNT_MASK, NULL, HFILL } |
3087 | 0 | }, |
3088 | 0 | { &hf_procmon_registry_value, |
3089 | 0 | { "Value", "procmon.registry.value", |
3090 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3091 | 0 | }, |
3092 | 0 | { &hf_procmon_registry_value_size, |
3093 | 0 | { "Value Size", "procmon.registry.value.size", |
3094 | 0 | FT_UINT16, BASE_DEC_HEX, NULL, 0, NULL, HFILL } |
3095 | 0 | }, |
3096 | 0 | { &hf_procmon_registry_value_is_ascii, |
3097 | 0 | { "Is ASCII", "procmon.registry.value.is_ascii", |
3098 | 0 | FT_BOOLEAN, 16, NULL, STRING_IS_ASCII_MASK, NULL, HFILL } |
3099 | 0 | }, |
3100 | 0 | { &hf_procmon_registry_value_char_count, |
3101 | 0 | { "Char Count", "procmon.registry.value.char_count", |
3102 | 0 | FT_UINT16, BASE_DEC, NULL, STRING_CHAR_COUNT_MASK, NULL, HFILL } |
3103 | 0 | }, |
3104 | 0 | { &hf_procmon_registry_length, |
3105 | 0 | { "Length", "procmon.registry.length", |
3106 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3107 | 0 | }, |
3108 | 0 | { &hf_procmon_registry_key_information_class, |
3109 | 0 | { "Information Class", "procmon.registry.key.information_class", |
3110 | 0 | FT_UINT32, BASE_DEC, VALS(registry_key_information_class_vals), 0, NULL, HFILL} |
3111 | 0 | }, |
3112 | 0 | { &hf_procmon_registry_key_set_information_class, |
3113 | 0 | { "Information Class", "procmon.registry.key.set_information_class", |
3114 | 0 | FT_UINT32, BASE_DEC, VALS(registry_value_set_information_class_vals), 0, NULL, HFILL} |
3115 | 0 | }, |
3116 | 0 | { &hf_procmon_registry_value_information_class, |
3117 | 0 | { "Information Class", "procmon.registry.value.information_class", |
3118 | 0 | FT_UINT32, BASE_DEC, VALS(registry_value_information_class_vals), 0, NULL, HFILL} |
3119 | 0 | }, |
3120 | 0 | { &hf_procmon_registry_index, |
3121 | 0 | { "Index", "procmon.registry.index", |
3122 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3123 | 0 | }, |
3124 | 0 | { &hf_procmon_registry_type, |
3125 | 0 | { "Type", "procmon.registry.type", |
3126 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3127 | 0 | }, |
3128 | 0 | { &hf_procmon_registry_data_length, |
3129 | 0 | { "Data Length", "procmon.registry.data_length", |
3130 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3131 | 0 | }, |
3132 | 0 | { &hf_procmon_registry_key_name_size, |
3133 | 0 | { "Name Size", "procmon.registry.key.name_size", |
3134 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3135 | 0 | }, |
3136 | 0 | { &hf_procmon_registry_key_name, |
3137 | 0 | { "Name", "procmon.registry.key.name", |
3138 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3139 | 0 | }, |
3140 | 0 | { &hf_procmon_registry_key_handle_tags, |
3141 | 0 | { "Handle Tags", "procmon.registry.key.handle_tags", |
3142 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3143 | 0 | }, |
3144 | 0 | { &hf_procmon_registry_key_flags, |
3145 | 0 | { "Flags", "procmon.registry.key.flags", |
3146 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3147 | 0 | }, |
3148 | 0 | { &hf_procmon_registry_key_last_write_time, |
3149 | 0 | { "Last Write Time", "procmon.registry.key.last_write_time", |
3150 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
3151 | 0 | }, |
3152 | 0 | { &hf_procmon_registry_key_title_index, |
3153 | 0 | { "Title Index", "procmon.registry.key.title_index", |
3154 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3155 | 0 | }, |
3156 | 0 | { &hf_procmon_registry_key_subkeys, |
3157 | 0 | { "Subkeys", "procmon.registry.key.subkeys", |
3158 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3159 | 0 | }, |
3160 | 0 | { &hf_procmon_registry_key_max_name_len, |
3161 | 0 | { "Max Name Length", "procmon.registry.key.max_name_len", |
3162 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3163 | 0 | }, |
3164 | 0 | { &hf_procmon_registry_key_values, |
3165 | 0 | { "Values", "procmon.registry.key.values", |
3166 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3167 | 0 | }, |
3168 | 0 | { &hf_procmon_registry_key_max_value_name_len, |
3169 | 0 | { "Max Value Name Length", "procmon.registry.key.max_value_name_len", |
3170 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3171 | 0 | }, |
3172 | 0 | { &hf_procmon_registry_key_max_value_data_len, |
3173 | 0 | { "Max Value Data Length", "procmon.registry.key.max_value_data_len", |
3174 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3175 | 0 | }, |
3176 | 0 | { &hf_procmon_registry_key_class_offset, |
3177 | 0 | { "Class Offset", "procmon.registry.key.class_offset", |
3178 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3179 | 0 | }, |
3180 | 0 | { &hf_procmon_registry_key_class_length, |
3181 | 0 | { "Class Length", "procmon.registry.key.class_length", |
3182 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3183 | 0 | }, |
3184 | 0 | { &hf_procmon_registry_key_max_class_len, |
3185 | 0 | { "Max Class Length", "procmon.registry.key.max_class_len", |
3186 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3187 | 0 | }, |
3188 | 0 | { &hf_procmon_registry_value_reg_type, |
3189 | 0 | { "Registry Type", "procmon.registry.value.reg_type", |
3190 | 0 | FT_UINT32, BASE_DEC, VALS(registry_value_reg_type_vals), 0, NULL, HFILL} |
3191 | 0 | }, |
3192 | 0 | { &hf_procmon_registry_value_offset_to_data, |
3193 | 0 | { "Offset to Data", "procmon.registry.value.offset_to_data", |
3194 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3195 | 0 | }, |
3196 | 0 | { &hf_procmon_registry_value_length, |
3197 | 0 | { "Length", "procmon.registry.value.length", |
3198 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3199 | 0 | }, |
3200 | 0 | { &hf_procmon_registry_value_name_size, |
3201 | 0 | { "Name Size", "procmon.registry.value.name_size", |
3202 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3203 | 0 | }, |
3204 | 0 | { &hf_procmon_registry_value_name, |
3205 | 0 | { "Name", "procmon.registry.value.name", |
3206 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3207 | 0 | }, |
3208 | 0 | { &hf_procmon_registry_value_dword, |
3209 | 0 | { "DWORD", "procmon.registry.value.dword", |
3210 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3211 | 0 | }, |
3212 | 0 | { &hf_procmon_registry_value_qword, |
3213 | 0 | { "QWORD", "procmon.registry.value.qword", |
3214 | 0 | FT_UINT64, BASE_HEX, NULL, 0, NULL, HFILL } |
3215 | 0 | }, |
3216 | 0 | { &hf_procmon_registry_value_sz, |
3217 | 0 | { "SZ", "procmon.registry.value.sz", |
3218 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3219 | 0 | }, |
3220 | 0 | { &hf_procmon_registry_value_binary, |
3221 | 0 | { "Binary", "procmon.registry.value.binary", |
3222 | 0 | FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL } |
3223 | 0 | }, |
3224 | 0 | { &hf_procmon_registry_value_multi_sz, |
3225 | 0 | { "MultiSZ", "procmon.registry.value.multi_sz", |
3226 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3227 | 0 | }, |
3228 | 0 | { &hf_procmon_registry_key_set_information_write_time, |
3229 | 0 | { "Last Write Time", "procmon.registry.key.set_information.write_time", |
3230 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
3231 | 0 | }, |
3232 | 0 | { &hf_procmon_registry_key_set_information_wow64_flags, |
3233 | 0 | { "WOW64 Flags", "procmon.registry.key.set_information.wow64_flags", |
3234 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3235 | 0 | }, |
3236 | 0 | { &hf_procmon_registry_key_set_information_handle_tags, |
3237 | 0 | { "Handle Tags", "procmon.registry.key.set_information.handle_tags", |
3238 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3239 | 0 | }, |
3240 | 0 | { &hf_procmon_filesystem_operation, |
3241 | 0 | { "Operation Type", "procmon.filesystem.operation_type", |
3242 | 0 | FT_UINT16, BASE_DEC, VALS(filesystem_operation_vals), 0, NULL, HFILL } |
3243 | 0 | }, |
3244 | 0 | { &hf_procmon_filesystem_suboperation, |
3245 | 0 | { "Suboperation", "procmon.filesystem.suboperation", |
3246 | 0 | FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL } |
3247 | 0 | }, |
3248 | 0 | { &hf_procmon_filesystem_padding, |
3249 | 0 | { "Padding", "procmon.filesystem.padding", |
3250 | 0 | FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL } |
3251 | 0 | }, |
3252 | 0 | { &hf_procmon_filesystem_details, |
3253 | 0 | { "Details", "procmon.filesystem.details", |
3254 | 0 | FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL } |
3255 | 0 | }, |
3256 | 0 | { &hf_procmon_filesystem_path, |
3257 | 0 | { "Path", "procmon.filesystem.path", |
3258 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3259 | 0 | }, |
3260 | 0 | { &hf_procmon_filesystem_path_size, |
3261 | 0 | { "Path Size", "procmon.filesystem.path.size", |
3262 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
3263 | 0 | }, |
3264 | 0 | { &hf_procmon_filesystem_path_is_ascii, |
3265 | 0 | { "Is ASCII", "procmon.filesystem.path.is_ascii", |
3266 | 0 | FT_BOOLEAN, 16, NULL, STRING_IS_ASCII_MASK, NULL, HFILL } |
3267 | 0 | }, |
3268 | 0 | { &hf_procmon_filesystem_path_char_count, |
3269 | 0 | { "Char Count", "procmon.filesystem.path.char_count", |
3270 | 0 | FT_UINT16, BASE_DEC, NULL, STRING_CHAR_COUNT_MASK, NULL, HFILL } |
3271 | 0 | }, |
3272 | 0 | { &hf_procmon_filesystem_create_file_access_mask, |
3273 | 0 | { "File Access Mask", "procmon.filesystem.create_file.access_mask", |
3274 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3275 | 0 | }, |
3276 | 0 | { &hf_procmon_filesystem_create_file_impersonating_sid_length, |
3277 | 0 | { "Impersonating SID Length", "procmon.filesystem.create_file.impersonating_sid_length", |
3278 | 0 | FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL } |
3279 | 0 | }, |
3280 | 0 | { &hf_procmon_filesystem_create_file_impersonating, |
3281 | 0 | { "Impersonating", "procmon.filesystem.create_file.impersonating", |
3282 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3283 | 0 | }, |
3284 | 0 | { &hf_procmon_filesystem_create_file_disposition, |
3285 | 0 | { "Disposition", "procmon.filesystem.create_file.disposition", |
3286 | 0 | FT_UINT8, BASE_DEC, VALS(filesystem_disposition_vals), 0, NULL, HFILL} |
3287 | 0 | }, |
3288 | 0 | { &hf_procmon_filesystem_create_file_options, |
3289 | 0 | { "Options", "procmon.filesystem.create_file.options", |
3290 | 0 | FT_UINT24, BASE_HEX, NULL, 0, NULL, HFILL } |
3291 | 0 | }, |
3292 | 0 | { &hf_procmon_filesystem_create_file_attributes, |
3293 | 0 | { "Attributes", "procmon.filesystem.create_file.attributes", |
3294 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
3295 | 0 | }, |
3296 | 0 | { &hf_procmon_filesystem_create_file_share_mode, |
3297 | 0 | { "Share Mode", "procmon.filesystem.create_file.share_mode", |
3298 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
3299 | 0 | }, |
3300 | 0 | { &hf_procmon_filesystem_create_file_allocation, |
3301 | 0 | { "Allocation", "procmon.filesystem.create_file.allocation", |
3302 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3303 | 0 | }, |
3304 | 0 | { &hf_procmon_filesystem_create_file_sid_revision, |
3305 | 0 | { "Revision", "procmon.filesystem.create_file.sid.revision", |
3306 | 0 | FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL } |
3307 | 0 | }, |
3308 | 0 | { &hf_procmon_filesystem_create_file_sid_count, |
3309 | 0 | { "Count", "procmon.filesystem.create_file.sid.count", |
3310 | 0 | FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL } |
3311 | 0 | }, |
3312 | 0 | { &hf_procmon_filesystem_create_file_sid_authority, |
3313 | 0 | { "Authority", "procmon.filesystem.create_file.sid.authority", |
3314 | 0 | FT_UINT48, BASE_HEX, NULL, 0, NULL, HFILL } |
3315 | 0 | }, |
3316 | 0 | { &hf_procmon_filesystem_create_file_sid_value, |
3317 | 0 | { "Value", "procmon.filesystem.create_file.sid.value", |
3318 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3319 | 0 | }, |
3320 | 0 | { &hf_procmon_filesystem_create_file_open_result, |
3321 | 0 | { "Open Result", "procmon.filesystem.create_file.open_result", |
3322 | 0 | FT_UINT32, BASE_DEC, VALS(filesystem_open_result_vals), 0, NULL, HFILL} |
3323 | 0 | }, |
3324 | 0 | { &hf_procmon_filesystem_readwrite_file_io_flags, |
3325 | 0 | { "IO Flags", "procmon.filesystem.readwrite_file.io_flags", |
3326 | 0 | FT_UINT32, BASE_HEX, NULL, 0x00EFFFFF, NULL, HFILL } |
3327 | 0 | }, |
3328 | 0 | { &hf_procmon_filesystem_readwrite_file_priority, |
3329 | 0 | { "Priority", "procmon.filesystem.readwrite_file.priority", |
3330 | 0 | FT_UINT32, BASE_HEX, VALS(filesystem_readwrite_priority_vals), 0x00E00000, NULL, HFILL} |
3331 | 0 | }, |
3332 | 0 | { &hf_procmon_filesystem_readwrite_file_length, |
3333 | 0 | { "Length", "procmon.filesystem.readwrite_file.length", |
3334 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3335 | 0 | }, |
3336 | 0 | { &hf_procmon_filesystem_readwrite_file_offset, |
3337 | 0 | { "Offset", "procmon.filesystem.readwrite_file.file_offset", |
3338 | 0 | FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL } |
3339 | 0 | }, |
3340 | 0 | { &hf_procmon_filesystem_readwrite_file_result_length, |
3341 | 0 | { "Result Length", "procmon.filesystem.readwrite_file.result_length", |
3342 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3343 | 0 | }, |
3344 | 0 | { &hf_procmon_filesystem_ioctl_write_length, |
3345 | 0 | { "Write Length", "procmon.filesystem.ioctl.write_length", |
3346 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3347 | 0 | }, |
3348 | 0 | { &hf_procmon_filesystem_ioctl_read_length, |
3349 | 0 | { "Read Length", "procmon.filesystem.ioctl.read_length", |
3350 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3351 | 0 | }, |
3352 | 0 | { &hf_procmon_filesystem_ioctl_ioctl, |
3353 | 0 | { "ioctl", "procmon.filesystem.ioctl.ioctl", |
3354 | 0 | FT_UINT32, BASE_DEC|BASE_EXT_STRING, &ioctl_code_vals_ext, 0, NULL, HFILL } |
3355 | 0 | }, |
3356 | 0 | { &hf_procmon_filesystem_ioctl_offset, |
3357 | 0 | { "Offset", "procmon.filesystem.ioctl.offset", |
3358 | 0 | FT_INT64, BASE_DEC, NULL, 0, NULL, HFILL } |
3359 | 0 | }, |
3360 | 0 | { &hf_procmon_filesystem_ioctl_length, |
3361 | 0 | { "Length", "procmon.filesystem.ioctl.length", |
3362 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
3363 | 0 | }, |
3364 | 0 | { &hf_procmon_filesystem_create_file_mapping_sync_type, |
3365 | 0 | { "Sync Type", "procmon.filesystem.create_file_mapping.sync_type", |
3366 | 0 | FT_UINT32, BASE_HEX, VALS(sync_type_vals), 0, NULL, HFILL } |
3367 | 0 | }, |
3368 | 0 | { &hf_procmon_filesystem_create_file_mapping_page_protection, |
3369 | 0 | { "Page Protection", "procmon.filesystem.create_file_mapping.page_protection", |
3370 | 0 | FT_UINT32, BASE_HEX, VALS(page_protection_vals), 0, NULL, HFILL } |
3371 | 0 | }, |
3372 | 0 | { &hf_procmon_filesystem_directory, |
3373 | 0 | { "Directory", "procmon.filesystem.directory", |
3374 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3375 | 0 | }, |
3376 | 0 | { &hf_procmon_filesystem_directory_size, |
3377 | 0 | { "Directory Size", "procmon.filesystem.directory.size", |
3378 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
3379 | 0 | }, |
3380 | 0 | { &hf_procmon_filesystem_directory_is_ascii, |
3381 | 0 | { "Is ASCII", "procmon.filesystem.directory.is_ascii", |
3382 | 0 | FT_BOOLEAN, 16, NULL, STRING_IS_ASCII_MASK, NULL, HFILL } |
3383 | 0 | }, |
3384 | 0 | { &hf_procmon_filesystem_directory_char_count, |
3385 | 0 | { "Char Count", "procmon.filesystem.directory.char_count", |
3386 | 0 | FT_UINT16, BASE_DEC, NULL, STRING_CHAR_COUNT_MASK, NULL, HFILL } |
3387 | 0 | }, |
3388 | 0 | { &hf_procmon_filesystem_directory_control_file_information_class, |
3389 | 0 | { "File Information Class", "procmon.filesystem.directory_control.file_information_class", |
3390 | 0 | FT_UINT32, BASE_DEC|BASE_EXT_STRING, &file_information_class_vals_ext, 0, NULL, HFILL } |
3391 | 0 | }, |
3392 | 0 | { &hf_procmon_filesystem_directory_control_notify_change_flags, |
3393 | 0 | { "Notify Change Flags", "procmon.filesystem.directory_control.notify_change_flags", |
3394 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3395 | 0 | }, |
3396 | 0 | { &hf_procmon_filesystem_set_info_file_disposition_delete, |
3397 | 0 | { "Disposition Delete", "procmon.filesystem.set_info_file.disposition.delete", |
3398 | 0 | FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL } |
3399 | 0 | }, |
3400 | 0 | { &hf_procmon_filesystem_directory_control_query_next_entry_offset, |
3401 | 0 | { "Next Entry Offset", "procmon.filesystem.directory_control.query.next_entry_offset", |
3402 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3403 | 0 | }, |
3404 | 0 | { &hf_procmon_filesystem_directory_control_query_file_index, |
3405 | 0 | { "File Index", "procmon.filesystem.directory_control.query.file_index", |
3406 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3407 | 0 | }, |
3408 | 0 | { &hf_procmon_filesystem_directory_control_query_name_length, |
3409 | 0 | { "Query Name Length", "procmon.filesystem.directory_control.query.name_length", |
3410 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3411 | 0 | }, |
3412 | 0 | { &hf_procmon_filesystem_directory_control_query_name, |
3413 | 0 | { "Query Name", "procmon.filesystem.directory_control.query.name", |
3414 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3415 | 0 | }, |
3416 | 0 | { &hf_procmon_filesystem_directory_control_query_creation_time, |
3417 | 0 | { "Creation Time", "procmon.filesystem.directory_control.query.creation_time", |
3418 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
3419 | 0 | }, |
3420 | 0 | { &hf_procmon_filesystem_directory_control_query_last_access_time, |
3421 | 0 | { "Last Access Time", "procmon.filesystem.directory_control.query.last_access_time", |
3422 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
3423 | 0 | }, |
3424 | 0 | { &hf_procmon_filesystem_directory_control_query_last_write_time, |
3425 | 0 | { "Last Write Time", "procmon.filesystem.directory_control.query.last_write_time", |
3426 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
3427 | 0 | }, |
3428 | 0 | { &hf_procmon_filesystem_directory_control_query_change_time, |
3429 | 0 | { "Change Time", "procmon.filesystem.directory_control.query.change_time", |
3430 | 0 | FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL } |
3431 | 0 | }, |
3432 | 0 | { &hf_procmon_filesystem_directory_control_query_end_of_file, |
3433 | 0 | { "End of File", "procmon.filesystem.directory_control.query.end_of_file", |
3434 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
3435 | 0 | }, |
3436 | 0 | { &hf_procmon_filesystem_directory_control_query_allocation_size, |
3437 | 0 | { "Allocation Size", "procmon.filesystem.directory_control.query.allocation_size", |
3438 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
3439 | 0 | }, |
3440 | 0 | { &hf_procmon_filesystem_directory_control_query_file_attributes, |
3441 | 0 | { "File Attributes", "procmon.filesystem.directory_control.query.file_attributes", |
3442 | 0 | FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL } |
3443 | 0 | }, |
3444 | 0 | { &hf_procmon_filesystem_directory_control_query_file_ea_size, |
3445 | 0 | { "EA Size", "procmon.filesystem.directory_control.query.ea_size", |
3446 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3447 | 0 | }, |
3448 | 0 | { &hf_procmon_filesystem_directory_control_query_file_id, |
3449 | 0 | { "File ID", "procmon.filesystem.directory_control.query.file_id", |
3450 | 0 | FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL } |
3451 | 0 | }, |
3452 | 0 | { &hf_procmon_filesystem_directory_control_query_short_name_length, |
3453 | 0 | { "Short Name Length", "procmon.filesystem.directory_control.query.short_name_length", |
3454 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
3455 | 0 | }, |
3456 | 0 | { &hf_procmon_filesystem_directory_control_query_short_name, |
3457 | 0 | { "Short Name", "procmon.filesystem.directory_control.short_name", |
3458 | 0 | FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL } |
3459 | 0 | }, |
3460 | 0 | { &hf_procmon_profiling_operation, |
3461 | 0 | { "Operation Type", "procmon.profiling.operation_type", |
3462 | 0 | FT_UINT16, BASE_DEC, VALS(profiling_operation_vals), 0, NULL, HFILL } |
3463 | 0 | }, |
3464 | 0 | { &hf_procmon_network_operation, |
3465 | 0 | { "Operation Type", "procmon.network.operation_type", |
3466 | 0 | FT_UINT16, BASE_DEC, VALS(network_operation_vals), 0, NULL, HFILL } |
3467 | 0 | }, |
3468 | 0 | { &hf_procmon_network_flags, |
3469 | 0 | { "Flags", "procmon.network.flags", |
3470 | 0 | FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL } |
3471 | 0 | }, |
3472 | 0 | { &hf_procmon_network_flags_is_src_ipv4, |
3473 | 0 | { "Is Src IPv4", "procmon.network.flags.is_src_ipv4", |
3474 | 0 | FT_BOOLEAN, 16, NULL, 0x0001, NULL, HFILL } |
3475 | 0 | }, |
3476 | 0 | { &hf_procmon_network_flags_is_dst_ipv4, |
3477 | 0 | { "Is Dest IPv4", "procmon.network.flags.is_dst_ipv4", |
3478 | 0 | FT_BOOLEAN, 16, NULL, 0x0002, NULL, HFILL } |
3479 | 0 | }, |
3480 | 0 | { &hf_procmon_network_flags_tcp_udp, |
3481 | 0 | { "TCP/UDP", "procmon.network.flags.tcp_udp", |
3482 | 0 | FT_BOOLEAN, 16, TFS(&tfs_tcp_udp), 0x0004, NULL, HFILL} |
3483 | 0 | }, |
3484 | 0 | { &hf_procmon_network_length, |
3485 | 0 | { "Length", "procmon.network.length", |
3486 | 0 | FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL } |
3487 | 0 | }, |
3488 | 0 | { &hf_procmon_network_src_ipv4, |
3489 | 0 | { "Src IP", "procmon.network.src_ipv4", |
3490 | 0 | FT_IPv4, BASE_NONE, NULL, 0, NULL, HFILL } |
3491 | 0 | }, |
3492 | 0 | { &hf_procmon_network_src_ipv6, |
3493 | 0 | { "Src IP", "procmon.network.src_ipv6", |
3494 | 0 | FT_IPv6, BASE_NONE, NULL, 0, NULL, HFILL } |
3495 | 0 | }, |
3496 | 0 | { &hf_procmon_network_dest_ipv4, |
3497 | 0 | { "Dest IP", "procmon.network.dest_ipv4", |
3498 | 0 | FT_IPv4, BASE_NONE, NULL, 0, NULL, HFILL } |
3499 | 0 | }, |
3500 | 0 | { &hf_procmon_network_dest_ipv6, |
3501 | 0 | { "Dest IP", "procmon.network.dest_ipv6", |
3502 | 0 | FT_IPv6, BASE_NONE, NULL, 0, NULL, HFILL } |
3503 | 0 | }, |
3504 | 0 | { &hf_procmon_network_src_port, |
3505 | 0 | { "Src Port", "procmon.network.src_port", |
3506 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
3507 | 0 | }, |
3508 | 0 | { &hf_procmon_network_dest_port, |
3509 | 0 | { "Dest Port", "procmon.network.dest_port", |
3510 | 0 | FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL } |
3511 | 0 | }, |
3512 | 0 | { &hf_procmon_network_padding, |
3513 | 0 | { "Padding", "procmon.network.padding", |
3514 | 0 | FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL } |
3515 | 0 | }, |
3516 | 0 | { &hf_procmon_network_details, |
3517 | 0 | { "Details", "procmon.network.details", |
3518 | 0 | FT_STRINGZ, BASE_NONE, NULL, 0, NULL, HFILL } |
3519 | 0 | }, |
3520 | |
|
3521 | 0 | }; |
3522 | | |
3523 | | /* Setup protocol subtree array */ |
3524 | 0 | static int *ett[] = { |
3525 | 0 | &ett_procmon, |
3526 | 0 | &ett_procmon_header, |
3527 | 0 | &ett_procmon_stack_trace, |
3528 | 0 | &ett_procmon_process_event, |
3529 | 0 | &ett_procmon_process_modules, |
3530 | 0 | &ett_procmon_process_path, |
3531 | 0 | &ett_procmon_process_commandline, |
3532 | 0 | &ett_procmon_process_curdir, |
3533 | 0 | &ett_procmon_registry_event, |
3534 | 0 | &ett_procmon_registry_key, |
3535 | 0 | &ett_procmon_registry_new_key, |
3536 | 0 | &ett_procmon_registry_value, |
3537 | 0 | &ett_procmon_filesystem_event, |
3538 | 0 | &ett_procmon_filesystem_path, |
3539 | 0 | &ett_procmon_filesystem_create_file_impersonating, |
3540 | 0 | &ett_procmon_filesystem_directory, |
3541 | 0 | &ett_procmon_filesystem_information, |
3542 | 0 | &ett_procmon_profiling_event, |
3543 | 0 | &ett_procmon_network_event, |
3544 | 0 | &ett_procmon_network_flags, |
3545 | 0 | }; |
3546 | |
|
3547 | 0 | static ei_register_info ei[] = { |
3548 | 0 | { &ei_procmon_unknown_event_class, { "procmon.event_class.unknown", PI_UNDECODED, PI_WARN, "Unknown event class", EXPFILL }}, |
3549 | 0 | { &ei_procmon_unknown_operation, { "procmon.operation_type.unknown", PI_UNDECODED, PI_WARN, "Unknown event operation", EXPFILL }}, |
3550 | 0 | { &ei_procmon_unknown_index, { "procmon.index.unknown", PI_UNDECODED, PI_WARN, "Unknown index", EXPFILL }}, |
3551 | 0 | }; |
3552 | |
|
3553 | 0 | expert_module_t* expert_procmon; |
3554 | | |
3555 | | /* Register the protocol name and description */ |
3556 | 0 | proto_procmon = proto_register_protocol("MS Procmon Event", "MS Procmon", "procmon"); |
3557 | | |
3558 | | /* Required function calls to register the header fields and subtrees */ |
3559 | 0 | proto_register_field_array(proto_procmon, hf, array_length(hf)); |
3560 | 0 | proto_register_subtree_array(ett, array_length(ett)); |
3561 | 0 | expert_procmon = expert_register_protocol(proto_procmon); |
3562 | 0 | expert_register_field_array(expert_procmon, ei, array_length(ei)); |
3563 | |
|
3564 | 0 | procmon_handle = register_dissector("procmon", dissect_procmon_event, proto_procmon); |
3565 | 0 | } |
3566 | | |
3567 | | void |
3568 | | event_reg_handoff_procmon(void) |
3569 | 0 | { |
3570 | 0 | int file_type_subtype_procmon; |
3571 | |
|
3572 | 0 | file_type_subtype_procmon = wtap_name_to_file_type_subtype("procmon"); |
3573 | 0 | if (file_type_subtype_procmon != -1) |
3574 | 0 | dissector_add_uint("wtap_fts_rec", file_type_subtype_procmon, procmon_handle); |
3575 | 0 | } |
3576 | | |
3577 | | /* |
3578 | | * Editor modelines - https://www.wireshark.org/tools/modelines.html |
3579 | | * |
3580 | | * Local variables: |
3581 | | * c-basic-offset: 4 |
3582 | | * tab-width: 8 |
3583 | | * indent-tabs-mode: nil |
3584 | | * End: |
3585 | | * |
3586 | | * vi: set shiftwidth=4 tabstop=8 expandtab: |
3587 | | * :indentSize=4:tabSize=8:noTabs=true: |
3588 | | */ |