API-To-ETW

July 26, 2024 ยท View on GitHub

stability-experimental

A ghidra script to find all ETW write metadata for each API in a PE file, including any associated public symbols.

See [BSides Brisbane] Kernel ETW is the best ETW for more details.

Why?

Many ETW events are extremely useful for cyber security, but are not (well) documented. :disappointed:

For example, the Kernel-Audit-API-Calls provider sounds interesting, but all of the events are called task_nn.

Microsoft-Windows-Kernel-Audit-API-Calls events

Previously, this was a manual reversing process. Now you can run this Ghidra script on ntoskrnl.exe and grep the results. :smiley:

FunctionEVENT_DESCRIPTOR SymbolIdCallPath
PsSetLoadImageNotifyRoutineKERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE1PsSetLoadImageNotifyRoutine->PsSetLoadImageNotifyRoutineEx
PsSetLoadImageNotifyRoutineExKERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE1PsSetLoadImageNotifyRoutineEx
NtTerminateProcessKERNEL_AUDIT_API_TERMINATEPROCESS2NtTerminateProcess->PspLogAuditTerminateRemoteProcessEvent
NtCreateSymbolicLinkObjectKERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT3NtCreateSymbolicLinkObjec
IoCreateSymbolicLinkKERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT3IoCreateSymbolicLink->IoCreateSymbolicLink2->ObCreateSymbolicLink
NtSetContextThreadKERNEL_AUDIT_API_SETCONTEXTTHREAD4NtSetContextThread
NtOpenProcessKERNEL_AUDIT_API_OPENPROCESS5NtOpenProcess->PsOpenProcess
NtAlpcOpenSenderProcessKERNEL_AUDIT_API_OPENPROCESS5NtAlpcOpenSenderProcess->PsOpenProcess
NtOpenThreadKERNEL_AUDIT_API_OPENTHREAD6NtOpenThread->PsOpenThread
NtAlpcOpenSenderThreadKERNEL_AUDIT_API_OPENTHREAD6NtAlpcOpenSenderThread->PsOpenThread
IoRegisterLastChanceShutdownNotificationKERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION7IoRegisterLastChanceShutdownNotification->IopLogAuditIoRegisterNotificationEvent
IoRegisterShutdownNotificationKERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION8IoRegisterShutdownNotification->IopLogAuditIoRegisterNotificationEvent

There are also trace providers (TraceLogging and WPP) which are not documented by design. This level of debug tracing is intended for the developer only, but might also prove useful for security. For example, the Microsoft.Windows.Kernel.SysEnv TraceLogging provider includes a SetVariable event which might be useful.

Sample Output

syscalls in ntoskrnl.exe

  • A full dump of all kernel ETW events is much, much longer.
  • By default I also only emit the shallowest events in the call graph. The deeper ones are usually error handling.

How good is it?

The quality of the output depends on the quality of the decompilation. With the help of public symbols, Ghidra is pretty good out of the box for Windows binaries. But if you're not getting the results you want, some manual reversing might help.

Sometimes you'll encounter a novel design pattern not supported by the script. For example, lsasrv.dll stores provider handles in a generic table using Adelson-Velsky/Landis (AVL) trees. So, in order to automatically extract the provider guids, the script would need to be updated to understand the GenericTableAvl APIs.

I'm still missing support for some event write edge cases, but I've tried to flag these in the script output.

How do I use it?

  1. Import the file to analyse - such as ntoskrnl.exe
  2. Open the Code Browser - but don't autoanalyze just yet. We want types and symbols available.
  3. Add relevant type archives first. I've provided a minimal ETW header, but I use ntddk64.gdt (or winapi64.gdt for usermode binaries).
  4. Load the PDB. This will trigger autoanalyze - so go make a :coffee:...
  5. Add the local path to this repo to Script Manager's dicectories and refresh the list.
  6. Run DumpEtwWrites.java

References

Inspiration