Skip to content

Commit b600df7

Browse files
rabbitstackrabbitstack
committed
feat(filter): Introduce TEB filter field
The filter field that returns the thread environment block base address. TEB is the userspace representation of a thread.
1 parent cb89ca5 commit b600df7

File tree

5 files changed

+12
-0
lines changed

5 files changed

+12
-0
lines changed

‎pkg/filter/accessor_windows.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -614,6 +614,8 @@ func (t *threadAccessor) Get(f fields.Field, kevt *kevent.Kevent) (kparams.Value
614614
return kevt.GetParamAsString(kparams.StartAddress), nil
615615
case fields.ThreadPID:
616616
return kevt.Kparams.GetUint32(kparams.ProcessID)
617+
case fields.ThreadTEB:
618+
return kevt.GetParamAsString(kparams.TEB), nil
617619
case fields.ThreadAccessMask:
618620
if kevt.Type != ktypes.OpenThread {
619621
return nil, nil

‎pkg/filter/fields/fields_windows.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,8 @@ const (
193193
ThreadStartAddress Field = "thread.start_address"
194194
// ThreadPID is the process identifier where the thread is created
195195
ThreadPID Field = "thread.pid"
196+
// ThreadTEB is the thread environment block base address
197+
ThreadTEB Field = "thread.teb_address"
196198
// ThreadAccessMask represents the thread access rights field
197199
ThreadAccessMask Field = "thread.access.mask"
198200
// ThreadAccessMaskNames represents the thread access rights list field
@@ -701,6 +703,7 @@ var fields = map[Field]FieldInfo{
701703
ThreadEntrypoint: {ThreadEntrypoint, "starting address of the function to be executed by the thread", kparams.Address, []string{"thread.entrypoint = '7efe0000'"}, &Deprecation{Since: "2.3.0", Fields: []Field{ThreadStartAddress}}},
702704
ThreadStartAddress: {ThreadStartAddress, "thread start address", kparams.Address, []string{"thread.start_address = '7efe0000'"}, nil},
703705
ThreadPID: {ThreadPID, "the process identifier where the thread is created", kparams.Uint32, []string{"kevt.pid != thread.pid"}, nil},
706+
ThreadTEB: {ThreadTEB, "the base address of the thread environment block", kparams.Address, []string{"thread.teb_address = '8f30893000'"}, nil},
704707
ThreadAccessMask: {ThreadAccessMask, "thread desired access rights", kparams.AnsiString, []string{"thread.access.mask = '0x1fffff'"}, nil},
705708
ThreadAccessMaskNames: {ThreadAccessMaskNames, "thread desired access rights as a string list", kparams.Slice, []string{"thread.access.mask.names in ('IMPERSONATE')"}, nil},
706709
ThreadAccessStatus: {ThreadAccessStatus, "thread access status", kparams.UnicodeString, []string{"thread.access.status = 'success'"}, nil},

‎pkg/filter/filter_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,7 @@ func TestThreadFilter(t *testing.T) {
289289
kparams.ThreadID: {Name: kparams.ThreadID, Type: kparams.TID, Value: uint32(3453)},
290290
kparams.BasePrio: {Name: kparams.BasePrio, Type: kparams.Uint8, Value: uint8(13)},
291291
kparams.StartAddress: {Name: kparams.StartAddress, Type: kparams.Address, Value: uint64(140729524944768)},
292+
kparams.TEB: {Name: kparams.TEB, Type: kparams.Address, Value: uint64(614994620416)},
292293
kparams.IOPrio: {Name: kparams.IOPrio, Type: kparams.Uint8, Value: uint8(2)},
293294
kparams.KstackBase: {Name: kparams.KstackBase, Type: kparams.Address, Value: uint64(18446677035730165760)},
294295
kparams.KstackLimit: {Name: kparams.KstackLimit, Type: kparams.Address, Value: uint64(18446677035730137088)},
@@ -343,6 +344,7 @@ func TestThreadFilter(t *testing.T) {
343344
{`thread.kstack.base = 'ffffc307810d6000'`, true},
344345
{`thread.kstack.limit = 'ffffc307810cf000'`, true},
345346
{`thread.start_address = '7ffe2557ff80'`, true},
347+
{`thread.teb_address = '8f30893000'`, true},
346348
{`thread.callstack.summary = 'KERNELBASE.dll|KERNEL32.DLL|java.dll|unbacked'`, true},
347349
{`thread.callstack.detail icontains 'C:\\WINDOWS\\System32\\KERNELBASE.dll!CreateProcessW+0x66'`, true},
348350
{`thread.callstack.modules in ('C:\\WINDOWS\\System32\\KERNELBASE.dll', 'C:\\Program Files\\JetBrains\\GoLand 2021.2.3\\jbr\\bin\\java.dll')`, true},

‎pkg/kevent/kparam_windows.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,7 @@ func (e *Kevent) produceParams(evt *etw.EventRecord) {
278278
kstack, klimit uint64
279279
ustack, ulimit uint64
280280
startAddress uint64
281+
teb uint64
281282
basePrio uint8
282283
pagePrio uint8
283284
ioPrio uint8
@@ -295,6 +296,7 @@ func (e *Kevent) produceParams(evt *etw.EventRecord) {
295296
ustack = evt.ReadUint64(24)
296297
ulimit = evt.ReadUint64(32)
297298
startAddress = evt.ReadUint64(48)
299+
teb = evt.ReadUint64(56)
298300
}
299301
if evt.Version() >= 3 {
300302
basePrio = evt.ReadByte(69)
@@ -308,6 +310,7 @@ func (e *Kevent) produceParams(evt *etw.EventRecord) {
308310
e.AppendParam(kparams.UstackBase, kparams.Address, ustack)
309311
e.AppendParam(kparams.UstackLimit, kparams.Address, ulimit)
310312
e.AppendParam(kparams.StartAddress, kparams.Address, startAddress)
313+
e.AppendParam(kparams.TEB, kparams.Address, teb)
311314
e.AppendParam(kparams.BasePrio, kparams.Uint8, basePrio)
312315
e.AppendParam(kparams.PagePrio, kparams.Uint8, pagePrio)
313316
e.AppendParam(kparams.IOPrio, kparams.Uint8, ioPrio)

‎pkg/kevent/kparams/fields_windows.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,8 @@ const (
7878
UstackLimit = "ustack_limit"
7979
// StartAddress field is the thread start address.
8080
StartAddress = "start_address"
81+
// TEB field is the address of the Thread Environment Block (TEB)
82+
TEB = "teb"
8183

8284
// FileObject determines the field name for the file object pointer.
8385
FileObject = "file_object"

0 commit comments

Comments
 (0)