/builds/wireshark/wireshark/epan/dissectors/packet-procmon.c

1

/* packet-procmon.c

2

* Routines for MS Procmon dissection

3

*

4

* Used a lot of information from https://github.com/eronnen/procmon-parser

5

*

6

* Wireshark - Network traffic analyzer

7

* By Gerald Combs <gerald@wireshark.org>

8

9

*

10

* SPDX-License-Identifier: GPL-2.0-or-later

11

*/

12

13

#include <config.h>

14

15

#include <epan/packet.h>

16

#include <epan/expert.h>

17

#include <epan/tfs.h>

18

#include <wiretap/procmon.h>

19

#include <wiretap/wtap.h>

20

#include "packet-ipv6.h"

21

22

// To do:

23

// - Add a preference for the maximum number of modules to display?

24

// - Add a field that indicates whether or not the event writes data?

25

26

void event_register_procmon(void);

27

void event_reg_handoff_procmon(void);

28

29

/* Initialize the protocol and registered fields */

30

static int proto_procmon;

31

32

static int hf_procmon_process_index;

33

static int hf_procmon_process_id;

34

static int hf_procmon_process_name;

35

static int hf_procmon_process_parent_name;

36

static int hf_procmon_process_image_path;

37

static int hf_procmon_process_command_line;

38

static int hf_procmon_process_user_name;

39

static int hf_procmon_process_start_time;

40

static int hf_procmon_process_end_time;

41

static int hf_procmon_process_session_number;

42

static int hf_procmon_process_authentication_id;

43

static int hf_procmon_process_integrity;

44

static int hf_procmon_process_company;

45

static int hf_procmon_process_version;

46

static int hf_procmon_process_description;

47

static int hf_procmon_process_is_virtualized;

48

static int hf_procmon_process_is_64_bit;

49

50

static int hf_procmon_module_base_address;

51

static int hf_procmon_module_size;

52

static int hf_procmon_module_image_path;

53

static int hf_procmon_module_version;

54

static int hf_procmon_module_company;

55

static int hf_procmon_module_description;

56

static int hf_procmon_module_timestamp;

57

58

static int hf_procmon_thread_id;

59

static int hf_procmon_event_class;

60

static int hf_procmon_operation_type;

61

static int hf_procmon_duration;

62

static int hf_procmon_timestamp;

63

static int hf_procmon_event_result;

64

static int hf_procmon_stack_trace_depth;

65

static int hf_procmon_details_size;

66

static int hf_procmon_extra_details_offset;

67

static int hf_procmon_stack_trace_address;

68

static int hf_procmon_detail_data;

69

static int hf_procmon_extra_detail_data;

70

static int hf_procmon_process_operation;

71

static int hf_procmon_process_pid;

72

static int hf_procmon_process_path;

73

static int hf_procmon_process_path_size;

74

static int hf_procmon_process_path_is_ascii;

75

static int hf_procmon_process_path_char_count;

76

static int hf_procmon_process_commandline;

77

static int hf_procmon_process_commandline_size;

78

static int hf_procmon_process_commandline_is_ascii;

79

static int hf_procmon_process_commandline_char_count;

80

static int hf_procmon_process_thread_id;

81

static int hf_procmon_process_exit_status;

82

static int hf_procmon_process_kernel_time;

83

static int hf_procmon_process_user_time;

84

static int hf_procmon_process_working_set;

85

static int hf_procmon_process_peak_working_set;

86

static int hf_procmon_process_private_bytes;

87

static int hf_procmon_process_peak_private_bytes;

88

static int hf_procmon_process_image_base;

89

static int hf_procmon_process_image_size;

90

static int hf_procmon_process_parent_pid;

91

static int hf_procmon_process_curdir;

92

static int hf_procmon_process_curdir_size;

93

static int hf_procmon_process_curdir_is_ascii;

94

static int hf_procmon_process_curdir_char_count;

95

static int hf_procmon_process_environment;

96

static int hf_procmon_process_environment_char_count;

97

static int hf_procmon_registry_operation;

98

static int hf_procmon_registry_desired_access;

99

static int hf_procmon_registry_granted_access;

100

static int hf_procmon_registry_disposition;

101

static int hf_procmon_registry_key;

102

static int hf_procmon_registry_key_size;

103

static int hf_procmon_registry_key_is_ascii;

104

static int hf_procmon_registry_key_char_count;

105

static int hf_procmon_registry_new_key;

106

static int hf_procmon_registry_new_key_size;

107

static int hf_procmon_registry_new_key_is_ascii;

108

static int hf_procmon_registry_new_key_char_count;

109

static int hf_procmon_registry_value;

110

static int hf_procmon_registry_value_size;

111

static int hf_procmon_registry_value_is_ascii;

112

static int hf_procmon_registry_value_char_count;

113

static int hf_procmon_registry_length;

114

static int hf_procmon_registry_key_information_class;

115

static int hf_procmon_registry_value_information_class;

116

static int hf_procmon_registry_key_set_information_class;

117

static int hf_procmon_registry_index;

118

static int hf_procmon_registry_type;

119

static int hf_procmon_registry_data_length;

120

static int hf_procmon_registry_key_name_size;

121

static int hf_procmon_registry_key_name;

122

static int hf_procmon_registry_key_handle_tags;

123

static int hf_procmon_registry_key_flags;

124

static int hf_procmon_registry_key_last_write_time;

125

static int hf_procmon_registry_key_title_index;

126

static int hf_procmon_registry_key_subkeys;

127

static int hf_procmon_registry_key_max_name_len;

128

static int hf_procmon_registry_key_values;

129

static int hf_procmon_registry_key_max_value_name_len;

130

static int hf_procmon_registry_key_max_value_data_len;

131

static int hf_procmon_registry_key_class_offset;

132

static int hf_procmon_registry_key_class_length;

133

static int hf_procmon_registry_key_max_class_len;

134

static int hf_procmon_registry_value_reg_type;

135

static int hf_procmon_registry_value_offset_to_data;

136

static int hf_procmon_registry_value_length;

137

static int hf_procmon_registry_value_name_size;

138

static int hf_procmon_registry_value_name;

139

static int hf_procmon_registry_value_dword;

140

static int hf_procmon_registry_value_qword;

141

static int hf_procmon_registry_value_sz;

142

static int hf_procmon_registry_value_binary;

143

static int hf_procmon_registry_value_multi_sz;

144

static int hf_procmon_registry_key_set_information_write_time;

145

static int hf_procmon_registry_key_set_information_wow64_flags;

146

static int hf_procmon_registry_key_set_information_handle_tags;

147

static int hf_procmon_filesystem_operation;

148

static int hf_procmon_filesystem_suboperation;

149

static int hf_procmon_filesystem_padding;

150

static int hf_procmon_filesystem_details;

151

static int hf_procmon_filesystem_path;

152

static int hf_procmon_filesystem_path_size;

153

static int hf_procmon_filesystem_path_is_ascii;

154

static int hf_procmon_filesystem_path_char_count;

155

static int hf_procmon_filesystem_create_file_access_mask;

156

static int hf_procmon_filesystem_create_file_impersonating_sid_length;

157

static int hf_procmon_filesystem_create_file_impersonating;

158

static int hf_procmon_filesystem_create_file_disposition;

159

static int hf_procmon_filesystem_create_file_options;

160

static int hf_procmon_filesystem_create_file_attributes;

161

static int hf_procmon_filesystem_create_file_share_mode;

162

static int hf_procmon_filesystem_create_file_allocation;

163

static int hf_procmon_filesystem_create_file_sid_revision;

164

static int hf_procmon_filesystem_create_file_sid_count;

165

static int hf_procmon_filesystem_create_file_sid_authority;

166

static int hf_procmon_filesystem_create_file_sid_value;

167

static int hf_procmon_filesystem_create_file_open_result;

168

static int hf_procmon_filesystem_readwrite_file_io_flags;

169

static int hf_procmon_filesystem_readwrite_file_priority;

170

static int hf_procmon_filesystem_readwrite_file_length;

171

static int hf_procmon_filesystem_readwrite_file_offset;

172

static int hf_procmon_filesystem_readwrite_file_result_length;

173

static int hf_procmon_filesystem_ioctl_write_length;

174

static int hf_procmon_filesystem_ioctl_read_length;

175

static int hf_procmon_filesystem_ioctl_ioctl;

176

static int hf_procmon_filesystem_ioctl_offset;

177

static int hf_procmon_filesystem_ioctl_length;

178

static int hf_procmon_filesystem_create_file_mapping_sync_type;

179

static int hf_procmon_filesystem_create_file_mapping_page_protection;

180

static int hf_procmon_filesystem_directory;

181

static int hf_procmon_filesystem_directory_size;

182

static int hf_procmon_filesystem_directory_is_ascii;

183

static int hf_procmon_filesystem_directory_char_count;

184

static int hf_procmon_filesystem_directory_control_file_information_class;

185

static int hf_procmon_filesystem_directory_control_notify_change_flags;

186

static int hf_procmon_filesystem_set_info_file_disposition_delete;

187

static int hf_procmon_filesystem_directory_control_query_next_entry_offset;

188

static int hf_procmon_filesystem_directory_control_query_file_index;

189

static int hf_procmon_filesystem_directory_control_query_name_length;

190

static int hf_procmon_filesystem_directory_control_query_name;

191

static int hf_procmon_filesystem_directory_control_query_creation_time;

192

static int hf_procmon_filesystem_directory_control_query_last_access_time;

193

static int hf_procmon_filesystem_directory_control_query_last_write_time;

194

static int hf_procmon_filesystem_directory_control_query_change_time;

195

static int hf_procmon_filesystem_directory_control_query_end_of_file;

196

static int hf_procmon_filesystem_directory_control_query_allocation_size;

197

static int hf_procmon_filesystem_directory_control_query_file_attributes;

198

static int hf_procmon_filesystem_directory_control_query_file_ea_size;

199

static int hf_procmon_filesystem_directory_control_query_file_id;

200

static int hf_procmon_filesystem_directory_control_query_short_name_length;

201

static int hf_procmon_filesystem_directory_control_query_short_name;

202

static int hf_procmon_profiling_operation;

203

static int hf_procmon_network_operation;

204

static int hf_procmon_network_flags;

205

static int hf_procmon_network_flags_is_src_ipv4;

206

static int hf_procmon_network_flags_is_dst_ipv4;

207

static int hf_procmon_network_flags_tcp_udp;

208

static int hf_procmon_network_length;

209

static int hf_procmon_network_src_ipv4;

210

static int hf_procmon_network_src_ipv6;

211

static int hf_procmon_network_dest_ipv4;

212

static int hf_procmon_network_dest_ipv6;

213

static int hf_procmon_network_src_port;

214

static int hf_procmon_network_dest_port;

215

static int hf_procmon_network_padding;

216

static int hf_procmon_network_details;

217

218

219

/* Initialize the subtree pointers */

220

static int ett_procmon;

221

static int ett_procmon_header;

222

static int ett_procmon_stack_trace;

223

static int ett_procmon_process_event;

224

static int ett_procmon_process_modules;

225

static int ett_procmon_process_path;

226

static int ett_procmon_process_commandline;

227

static int ett_procmon_process_curdir;

228

static int ett_procmon_registry_event;

229

static int ett_procmon_registry_key;

230

static int ett_procmon_registry_value;

231

static int ett_procmon_registry_new_key;

232

static int ett_procmon_filesystem_event;

233

static int ett_procmon_filesystem_path;

234

static int ett_procmon_filesystem_create_file_impersonating;

235

static int ett_procmon_filesystem_directory;

236

static int ett_procmon_filesystem_information;

237

static int ett_procmon_profiling_event;

238

static int ett_procmon_network_event;

239

static int ett_procmon_network_flags;

240

241

242

static expert_field ei_procmon_unknown_event_class;

243

static expert_field ei_procmon_unknown_operation;

244

static expert_field ei_procmon_unknown_index;

245

246

static dissector_handle_t procmon_handle;

247

248

#define PROCMON_EVENT_CLASS_TYPE_PROCESS1 1

249

#define PROCMON_EVENT_CLASS_TYPE_REGISTRY2 2

250

#define PROCMON_EVENT_CLASS_TYPE_FILE_SYSTEM3 3

251

#define PROCMON_EVENT_CLASS_TYPE_PROFILING4 4

252

#define PROCMON_EVENT_CLASS_TYPE_NETWORK5 5

253

254

#define STRING_IS_ASCII_MASK0x8000 0x8000

255

#define STRING_CHAR_COUNT_MASK0x7FFF 0x7FFF

256

257

static void dissect_procmon_detail_string_info(tvbuff_t* tvb, proto_tree* tree, int offset,

258

int hf_detail, int hf_detail_ascii, int hf_detail_char_count, int ett_detail, bool_Bool* is_ascii, uint16_t* char_count)

259

{

260

proto_tree* detail_tree;

261

proto_item* detail_item;

262

uint32_t char_value;

263

264

detail_item = proto_tree_add_item(tree, hf_detail, tvb, offset, 2, ENC_LITTLE_ENDIAN0x80000000);

265

detail_tree = proto_item_add_subtree(detail_item, ett_detail);

266

267

proto_tree_add_item_ret_boolean(detail_tree, hf_detail_ascii, tvb, offset, 2, ENC_LITTLE_ENDIAN0x80000000, is_ascii);

268

proto_tree_add_item_ret_uint(detail_tree, hf_detail_char_count, tvb, offset, 2, ENC_LITTLE_ENDIAN0x80000000, &char_value);

269

*char_count = (uint16_t)(char_value & STRING_CHAR_COUNT_MASK0x7FFF);

270

}

271

272

static int dissect_procmon_detail_string(tvbuff_t* tvb, proto_tree* tree, int offset, bool_Bool is_ascii, uint16_t char_count, int hf_detail_string)

273

{

274

int char_size = is_ascii ? 1 : 2;

275

int path_size = char_size * char_count;

276

proto_tree_add_item(tree, hf_detail_string, tvb, offset, path_size, is_ascii ? ENC_ASCII0x00000000 : ENC_UTF_160x00000004|ENC_LITTLE_ENDIAN0x80000000);

277

return offset + path_size;

278

}

279

280

static void dissect_procmon_access_mask(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, int offset, int hf_access_mask, int length, uint32_t* mapping, const value_string* vs_mask_values)

281

{

282

int i = 0;

283

bool_Bool first = true1;

284

proto_item* ti;

285

uint32_t access_mask;

286

wmem_strbuf_t* access_details = wmem_strbuf_new(pinfo->pool, "(");

287

288

ti = proto_tree_add_item_ret_uint(tree, hf_access_mask, tvb, offset, length, ENC_LITTLE_ENDIAN0x80000000, &access_mask);

289

if (mapping != NULL((void*)0))

290

{

291

if (access_mask & 0x80000000)

292

access_mask |= mapping[0];

293

if (access_mask & 0x40000000)

294

access_mask |= mapping[1];

295

if (access_mask & 0x20000000)

296

access_mask |= mapping[2];

297

if (access_mask & 0x10000000)

298

access_mask |= mapping[3];

299

}

300

301

while (vs_mask_values[i].strptr) {

302

if ((vs_mask_values[i].value & access_mask) == vs_mask_values[i].value)

303

{

304

if (first)

305

first = false0;

306

else

307

wmem_strbuf_append(access_details, ", ");

308

wmem_strbuf_append(access_details, vs_mask_values[i].strptr);

309

}

310

311

i++;

312

}

313

314

wmem_strbuf_append_c(access_details, ')');

315

proto_item_append_text(ti, " %s", wmem_strbuf_get_str(access_details));

316

}

317

318

static const value_string event_class_vals[] = {

319

{ PROCMON_EVENT_CLASS_TYPE_PROCESS1, "Process" },

320

{ PROCMON_EVENT_CLASS_TYPE_REGISTRY2, "Registry" },

321

{ PROCMON_EVENT_CLASS_TYPE_FILE_SYSTEM3, "File System" },

322

{ PROCMON_EVENT_CLASS_TYPE_PROFILING4, "Profiling" },

323

{ PROCMON_EVENT_CLASS_TYPE_NETWORK5, "Network" },

324

{ 0, NULL((void*)0) }

325

};

326

327

#define PROCMON_PROCESS_OPERATION_DEFINED0x0000 0x0000

328

#define PROCMON_PROCESS_OPERATION_CREATE0x0001 0x0001

329

#define PROCMON_PROCESS_OPERATION_EXIT0x0002 0x0002

330

#define PROCMON_PROCESS_OPERATION_THREAD_CREATE0x0003 0x0003

331

#define PROCMON_PROCESS_OPERATION_THREAD_EXIT0x0004 0x0004

332

#define PROCMON_PROCESS_OPERATION_LOAD_IMAGE0x0005 0x0005

333

#define PROCMON_PROCESS_OPERATION_THREAD_PROFILE0x0006 0x0006

334

#define PROCMON_PROCESS_OPERATION_PROCESS_START0x0007 0x0007

335

#define PROCMON_PROCESS_OPERATION_PROCESS_STATISTICS0x0008 0x0008

336

#define PROCMON_PROCESS_OPERATION_SYSTEM_STATISTICS0x0009 0x0009

337

338

static const value_string process_operation_vals[] = {

339

{ PROCMON_PROCESS_OPERATION_DEFINED0x0000, "Process Defined" },

340

{ PROCMON_PROCESS_OPERATION_CREATE0x0001, "Process Create" },

341

{ PROCMON_PROCESS_OPERATION_EXIT0x0002, "Process Exit" },

342

{ PROCMON_PROCESS_OPERATION_THREAD_CREATE0x0003, "Thread Create" },

343

{ PROCMON_PROCESS_OPERATION_THREAD_EXIT0x0004, "Thread Exit" },

344

{ PROCMON_PROCESS_OPERATION_LOAD_IMAGE0x0005, "Load Image" },

345

{ PROCMON_PROCESS_OPERATION_THREAD_PROFILE0x0006, "Thread Profile" },

346

{ PROCMON_PROCESS_OPERATION_PROCESS_START0x0007, "Process Start" },

347

{ PROCMON_PROCESS_OPERATION_PROCESS_STATISTICS0x0008, "Process Statistics" },

348

{ PROCMON_PROCESS_OPERATION_SYSTEM_STATISTICS0x0009, "System Statistics" },

349

{ 0, NULL((void*)0) }

350

};

351

352

static const true_false_string process_architecture_tfs = { "64-bit", "32-bit" };

353

354

// https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--0-499-

355

static const value_string system_error_code_vals[] = {

356

{ 0x0, "SUCCESS" },

357

{ 0x2, "FILE_NOT_FOUND" },

358

{ 0x3, "PATH_NOT_FOUND" },

359

{ 0x4, "TOO_MANY_OPEN_FILES" },

360

{ 0x5, "ACCESS_DENIED" },

361

{ 0x6, "INVALID_HANDLE" },

362

{ 0, NULL((void*)0) }

363

};

364

365

366

static bool_Bool dissect_procmon_process_event(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, uint32_t operation, tvbuff_t* extra_details_tvb _U___attribute__((unused)))

367

{

368

proto_tree* process_tree;

369

unsigned offset = 0;

370

bool_Bool handle_extra_details = false0;

371

372

process_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_process_event, NULL((void*)0), "Process Data");

373

374

switch(operation) {

375

case PROCMON_PROCESS_OPERATION_DEFINED0x0000:

376

case PROCMON_PROCESS_OPERATION_CREATE0x0001:

377

{

378

bool_Bool is_path_ascii, is_commandline_ascii;

379

uint16_t path_char_count, commandline_char_count;

380

381

//Unknown fields

382

offset += 4;

383

proto_tree_add_item(process_tree, hf_procmon_process_pid, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

384

offset += 4;

385

//Unknown fields

386

offset += 36;

387

uint8_t unknown_size1 = tvb_get_uint8(tvb, offset);

388

offset += 1;

389

uint8_t unknown_size2 = tvb_get_uint8(tvb, offset);

390

offset += 1;

391

dissect_procmon_detail_string_info(tvb, process_tree, offset,

392

hf_procmon_process_path_size, hf_procmon_process_path_is_ascii, hf_procmon_process_path_char_count, ett_procmon_process_path,

393

&is_path_ascii, &path_char_count);

394

offset += 2;

395

dissect_procmon_detail_string_info(tvb, process_tree, offset,

396

hf_procmon_process_commandline_size, hf_procmon_process_commandline_is_ascii, hf_procmon_process_commandline_char_count, ett_procmon_process_commandline,

397

&is_commandline_ascii, &commandline_char_count);

398

offset += 2;

399

//Unknown fields

400

offset += 2;

401

offset += unknown_size1;

402

offset += unknown_size2;

403

offset = dissect_procmon_detail_string(tvb, process_tree, offset, is_path_ascii, path_char_count, hf_procmon_process_path);

404

/* offset = */ dissect_procmon_detail_string(tvb, process_tree, offset, is_commandline_ascii, commandline_char_count, hf_procmon_process_commandline);

405

406

break;

407

}

408

case PROCMON_PROCESS_OPERATION_EXIT0x0002:

409

{

410

proto_tree_add_item(process_tree, hf_procmon_process_exit_status, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

411

offset += 4;

412

proto_tree_add_item(process_tree, hf_procmon_process_kernel_time, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

413

offset += 8;

414

proto_tree_add_item(process_tree, hf_procmon_process_user_time, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

415

offset += 8;

416

proto_tree_add_item(process_tree, hf_procmon_process_working_set, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

417

offset += 8;

418

proto_tree_add_item(process_tree, hf_procmon_process_peak_working_set, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

419

offset += 8;

420

proto_tree_add_item(process_tree, hf_procmon_process_private_bytes, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

421

offset += 8;

422

proto_tree_add_item(process_tree, hf_procmon_process_peak_private_bytes, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

423

/* offset += 8; */

424

break;

425

}

426

case PROCMON_PROCESS_OPERATION_THREAD_CREATE0x0003:

427

{

428

proto_tree_add_item(process_tree, hf_procmon_process_thread_id, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

429

/* offset += 4; */

430

break;

431

}

432

case PROCMON_PROCESS_OPERATION_THREAD_EXIT0x0004:

433

case PROCMON_PROCESS_OPERATION_PROCESS_STATISTICS0x0008:

434

{

435

//Unknown fields

436

offset += 4;

437

proto_tree_add_item(process_tree, hf_procmon_process_kernel_time, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

438

offset += 8;

439

proto_tree_add_item(process_tree, hf_procmon_process_user_time, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

440

/* offset += 8; */

441

break;

442

}

443

case PROCMON_PROCESS_OPERATION_LOAD_IMAGE0x0005:

444

{

445

bool_Bool is_path_ascii;

446

uint16_t path_char_count;

447

448

if (pinfo->pseudo_header->procmon.system_bitness)

449

{

450

proto_tree_add_item(process_tree, hf_procmon_process_image_base, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

451

offset += 8;

452

}

453

else

454

{

455

proto_tree_add_item(process_tree, hf_procmon_process_image_base, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

456

offset += 4;

457

}

458

459

proto_tree_add_item(process_tree, hf_procmon_process_image_size, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

460

offset += 4;

461

dissect_procmon_detail_string_info(tvb, process_tree, offset,

462

hf_procmon_process_path_size, hf_procmon_process_path_is_ascii, hf_procmon_process_path_char_count, ett_procmon_process_path,

463

&is_path_ascii, &path_char_count);

464

offset += 2;

465

//Unknown fields

466

offset += 2;

467

/* offset = */ dissect_procmon_detail_string(tvb, process_tree, offset, is_path_ascii, path_char_count, hf_procmon_process_path);

468

break;

469

}

470

case PROCMON_PROCESS_OPERATION_THREAD_PROFILE0x0006:

471

//Unknown

472

break;

473

case PROCMON_PROCESS_OPERATION_PROCESS_START0x0007:

474

{

475

bool_Bool is_commandline_ascii, is_curdir_ascii;

476

uint16_t commandline_char_count, curdir_char_count;

477

uint32_t environment_char_count;

478

479

proto_tree_add_item(process_tree, hf_procmon_process_parent_pid, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

480

offset += 4;

481

dissect_procmon_detail_string_info(tvb, process_tree, offset,

482

hf_procmon_process_commandline_size, hf_procmon_process_commandline_is_ascii, hf_procmon_process_commandline_char_count, ett_procmon_process_commandline,

483

&is_commandline_ascii, &commandline_char_count);

484

offset += 2;

485

dissect_procmon_detail_string_info(tvb, process_tree, offset,

486

hf_procmon_process_curdir_size, hf_procmon_process_curdir_is_ascii, hf_procmon_process_curdir_char_count, ett_procmon_process_curdir,

487

&is_curdir_ascii, &curdir_char_count);

488

offset += 2;

489

proto_tree_add_item_ret_uint(process_tree, hf_procmon_process_environment_char_count, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &environment_char_count);

490

offset += 4;

491

offset = dissect_procmon_detail_string(tvb, process_tree, offset, is_commandline_ascii, commandline_char_count, hf_procmon_process_commandline);

492

offset = dissect_procmon_detail_string(tvb, process_tree, offset, is_curdir_ascii, curdir_char_count, hf_procmon_process_curdir);

493

proto_tree_add_item(process_tree, hf_procmon_process_environment, tvb, offset, environment_char_count*2, ENC_UTF_160x00000004|ENC_LITTLE_ENDIAN0x80000000);

494

break;

495

}

496

case PROCMON_PROCESS_OPERATION_SYSTEM_STATISTICS0x0009:

497

//Unknown

498

break;

499

}

500

return handle_extra_details;

501

}

502

503

#define PROCMON_REGISTRY_OPERATION_OPEN_KEY0x0000 0x0000

504

#define PROCMON_REGISTRY_OPERATION_CREATE_KEY0x0001 0x0001

505

#define PROCMON_REGISTRY_OPERATION_CLOSE_KEY0x0002 0x0002

506

#define PROCMON_REGISTRY_OPERATION_QUERY_KEY0x0003 0x0003

507

#define PROCMON_REGISTRY_OPERATION_SET_VALUE0x0004 0x0004

508

#define PROCMON_REGISTRY_OPERATION_QUERY_VALUE0x0005 0x0005

509

#define PROCMON_REGISTRY_OPERATION_ENUM_VALUE0x0006 0x0006

510

#define PROCMON_REGISTRY_OPERATION_ENUM_KEY0x0007 0x0007

511

#define PROCMON_REGISTRY_OPERATION_SET_INFO_KEY0x0008 0x0008

512

#define PROCMON_REGISTRY_OPERATION_DELETE_KEY0x0009 0x0009

513

#define PROCMON_REGISTRY_OPERATION_DELETE_VALUE0x000A 0x000A

514

#define PROCMON_REGISTRY_OPERATION_FLUSH_KEY0x000B 0x000B

515

#define PROCMON_REGISTRY_OPERATION_LOAD_KEY0x000C 0x000C

516

#define PROCMON_REGISTRY_OPERATION_UNLOAD_KEY0x000D 0x000D

517

#define PROCMON_REGISTRY_OPERATION_RENAME_KEY0x000E 0x000E

518

#define PROCMON_REGISTRY_OPERATION_QUERY_MULTIPLE_VALUE0x000F 0x000F

519

#define PROCMON_REGISTRY_OPERATION_SET_KEY_SECURITY0x0010 0x0010

520

#define PROCMON_REGISTRY_OPERATION_QUERY_KEY_SECURITY0x0011 0x0011

521

522

static const value_string registry_operation_vals[] = {

523

{ PROCMON_REGISTRY_OPERATION_OPEN_KEY0x0000, "Open Key" },

524

{ PROCMON_REGISTRY_OPERATION_CREATE_KEY0x0001, "Create Key" },

525

{ PROCMON_REGISTRY_OPERATION_CLOSE_KEY0x0002, "Close Key" },

526

{ PROCMON_REGISTRY_OPERATION_QUERY_KEY0x0003, "Query Key" },

527

{ PROCMON_REGISTRY_OPERATION_SET_VALUE0x0004, "Set Value" },

528

{ PROCMON_REGISTRY_OPERATION_QUERY_VALUE0x0005, "Query Value" },

529

{ PROCMON_REGISTRY_OPERATION_ENUM_VALUE0x0006, "Enum Value" },

530

{ PROCMON_REGISTRY_OPERATION_ENUM_KEY0x0007, "Enum Key" },

531

{ PROCMON_REGISTRY_OPERATION_SET_INFO_KEY0x0008, "Set Info Key" },

532

{ PROCMON_REGISTRY_OPERATION_DELETE_KEY0x0009, "Delete Key" },

533

{ PROCMON_REGISTRY_OPERATION_DELETE_VALUE0x000A, "Delete Value" },

534

{ PROCMON_REGISTRY_OPERATION_FLUSH_KEY0x000B, "Flush Key" },

535

{ PROCMON_REGISTRY_OPERATION_LOAD_KEY0x000C, "Load Key" },

536

{ PROCMON_REGISTRY_OPERATION_UNLOAD_KEY0x000D, "Unload Key" },

537

{ PROCMON_REGISTRY_OPERATION_RENAME_KEY0x000E, "Rename Key" },

538

{ PROCMON_REGISTRY_OPERATION_QUERY_MULTIPLE_VALUE0x000F, "Query Multiple Value" },

539

{ PROCMON_REGISTRY_OPERATION_SET_KEY_SECURITY0x0010, "Set Key Security" },

540

{ PROCMON_REGISTRY_OPERATION_QUERY_KEY_SECURITY0x0011, "Query Key Security" },

541

{ 0, NULL((void*)0) }

542

};

543

544

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_BASIC0 0

545

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NODE1 1

546

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FULL2 2

547

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NAME3 3

548

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_CACHED4 4

549

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FLAGS5 5

550

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_VIRTUALIZATION6 6

551

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_HANDLE_TAGS7 7

552

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_TRUST8 8

553

#define PROCMON_REGISTRY_KEY_INFORMATION_CLASS_LAYER9 9

554

555

static const value_string registry_key_information_class_vals[] = {

556

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_BASIC0, "Basic" },

557

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NODE1, "Node" },

558

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FULL2, "Full" },

559

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NAME3, "Name" },

560

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_CACHED4, "Cached" },

561

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FLAGS5, "Flags" },

562

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_VIRTUALIZATION6, "Virtualization" },

563

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_HANDLE_TAGS7, "Handle Tags" },

564

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_TRUST8, "Trust" },

565

{ PROCMON_REGISTRY_KEY_INFORMATION_CLASS_LAYER9, "Layer" },

566

{ 0, NULL((void*)0) }

567

};

568

569

#define PROCMON_REGISTRY_KEY_SET_INFORMATION_WRITE_TIME_INFO0 0

570

#define PROCMON_REGISTRY_KEY_SET_INFORMATION_WOW64_FLAGS_INFO1 1

571

#define PROCMON_REGISTRY_KEY_SET_INFORMATION_HANDLE_TAGS_INFO2 2

572

573

static const value_string registry_value_set_information_class_vals[] = {

574

{ PROCMON_REGISTRY_KEY_SET_INFORMATION_WRITE_TIME_INFO0, "Write Time" },

575

{ PROCMON_REGISTRY_KEY_SET_INFORMATION_WOW64_FLAGS_INFO1, "WOW64 Flags" },

576

{ PROCMON_REGISTRY_KEY_SET_INFORMATION_HANDLE_TAGS_INFO2, "Set Handle Tags" },

577

{ 0, NULL((void*)0) }

578

};

579

580

581

582

#define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_BASIC0 0

583

#define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL1 1

584

#define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL2 2

585

#define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL_ALIGN643 3

586

#define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL_ALIGN644 4

587

#define PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_LAYER5 5

588

589

static const value_string registry_value_information_class_vals[] = {

590

{ PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_BASIC0, "Basic" },

591

{ PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL1, "Full" },

592

{ PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL2, "Partial" },

593

{ PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL_ALIGN643, "Full Align64" },

594

{ PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL_ALIGN644, "Partial Align64" },

595

{ PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_LAYER5, "Layer" },

596

{ 0, NULL((void*)0) }

597

};

598

599

#define PROCMON_REGISTRY_DISPOSITION_CREATED_NEW_KEY1 1

600

#define PROCMON_REGISTRY_DISPOSITION_OPENED_EXISTING_KEY2 2

601

602

static const value_string registry_disposition_vals[] = {

603

{ PROCMON_REGISTRY_DISPOSITION_CREATED_NEW_KEY1, "Created Key" },

604

{ PROCMON_REGISTRY_DISPOSITION_OPENED_EXISTING_KEY2, "Open Existing" },

605

{ 0, NULL((void*)0) }

606

};

607

608

static int procmon_registry_query_or_enum_key_extra_details(proto_tree* tree, tvbuff_t* tvb, uint32_t information_class)

609

{

610

uint32_t name_size;

611

unsigned offset = 0;

612

613

switch (information_class)

614

{

615

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NAME3:

616

proto_tree_add_item_ret_uint(tree, hf_procmon_registry_key_name_size, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &name_size);

617

offset += 4;

618

proto_tree_add_item(tree, hf_procmon_registry_key_name, tvb, offset, name_size, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

619

offset += name_size;

620

break;

621

622

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_HANDLE_TAGS7:

623

proto_tree_add_item(tree, hf_procmon_registry_key_handle_tags, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

624

offset += 4;

625

break;

626

627

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FLAGS5:

628

proto_tree_add_item(tree, hf_procmon_registry_key_flags, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

629

offset += 4;

630

break;

631

632

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_CACHED4:

633

proto_tree_add_item(tree, hf_procmon_registry_key_last_write_time, tvb, offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

634

offset += 8;

635

proto_tree_add_item(tree, hf_procmon_registry_key_title_index, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

636

offset += 4;

637

proto_tree_add_item(tree, hf_procmon_registry_key_subkeys, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

638

offset += 4;

639

proto_tree_add_item(tree, hf_procmon_registry_key_max_name_len, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

640

offset += 4;

641

proto_tree_add_item(tree, hf_procmon_registry_key_values, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

642

offset += 4;

643

proto_tree_add_item(tree, hf_procmon_registry_key_max_value_name_len, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

644

offset += 4;

645

proto_tree_add_item(tree, hf_procmon_registry_key_max_value_data_len, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

646

offset += 4;

647

break;

648

649

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_BASIC0:

650

proto_tree_add_item(tree, hf_procmon_registry_key_last_write_time, tvb, offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

651

offset += 8;

652

proto_tree_add_item(tree, hf_procmon_registry_key_title_index, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

653

offset += 4;

654

proto_tree_add_item_ret_uint(tree, hf_procmon_registry_key_name_size, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &name_size);

655

offset += 4;

656

proto_tree_add_item(tree, hf_procmon_registry_key_name, tvb, offset, name_size, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

657

offset += name_size;

658

break;

659

660

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_FULL2:

661

proto_tree_add_item(tree, hf_procmon_registry_key_last_write_time, tvb, offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

662

offset += 8;

663

proto_tree_add_item(tree, hf_procmon_registry_key_title_index, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

664

offset += 4;

665

proto_tree_add_item(tree, hf_procmon_registry_key_class_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

666

offset += 4;

667

proto_tree_add_item(tree, hf_procmon_registry_key_class_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

668

offset += 4;

669

proto_tree_add_item(tree, hf_procmon_registry_key_subkeys, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

670

offset += 4;

671

proto_tree_add_item(tree, hf_procmon_registry_key_max_name_len, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

672

offset += 4;

673

proto_tree_add_item(tree, hf_procmon_registry_key_max_class_len, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

674

offset += 4;

675

proto_tree_add_item(tree, hf_procmon_registry_key_values, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

676

offset += 4;

677

proto_tree_add_item(tree, hf_procmon_registry_key_max_value_name_len, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

678

offset += 4;

679

proto_tree_add_item(tree, hf_procmon_registry_key_max_value_data_len, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

680

offset += 4;

681

break;

682

683

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_NODE1:

684

proto_tree_add_item(tree, hf_procmon_registry_key_last_write_time, tvb, offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

685

offset += 8;

686

proto_tree_add_item(tree, hf_procmon_registry_key_title_index, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

687

offset += 4;

688

proto_tree_add_item(tree, hf_procmon_registry_key_class_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

689

offset += 4;

690

proto_tree_add_item(tree, hf_procmon_registry_key_class_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

691

offset += 4;

692

proto_tree_add_item_ret_uint(tree, hf_procmon_registry_key_name_size, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &name_size);

693

offset += 4;

694

proto_tree_add_item(tree, hf_procmon_registry_key_name, tvb, offset, name_size, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

695

offset += name_size;

696

break;

697

698

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_VIRTUALIZATION6:

699

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_TRUST8:

700

case PROCMON_REGISTRY_KEY_INFORMATION_CLASS_LAYER9:

701

//No extra data (or unknown)

702

break;

703

}

704

705

return offset;

706

}

707

708

#define PROCMON_REGISTRY_VALUE_REG_TYPE_NONE0 0

709

#define PROCMON_REGISTRY_VALUE_REG_TYPE_SZ1 1

710

#define PROCMON_REGISTRY_VALUE_REG_TYPE_EXPAND_SZ2 2

711

#define PROCMON_REGISTRY_VALUE_REG_TYPE_BINARY3 3

712

#define PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD4 4

713

#define PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD_BIG_ENDIAN5 5

714

#define PROCMON_REGISTRY_VALUE_REG_TYPE_LINK6 6

715

#define PROCMON_REGISTRY_VALUE_REG_TYPE_MULTI_SZ7 7

716

#define PROCMON_REGISTRY_VALUE_REG_TYPE_RESOURCE_LIST8 8

717

#define PROCMON_REGISTRY_VALUE_REG_TYPE_FULL_RESOURCE_DESCRIPTOR9 9

718

#define PROCMON_REGISTRY_VALUE_REG_TYPE_RESOURCE_REQUIREMENTS_LIST10 10

719

#define PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD11 11

720

#define PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD_BIG_ENDIAN12 12

721

722

static const value_string registry_value_reg_type_vals[] = {

723

{ PROCMON_REGISTRY_VALUE_REG_TYPE_NONE0, "REG_NONE" },

724

{ PROCMON_REGISTRY_VALUE_REG_TYPE_SZ1, "REG_SZ" },

725

{ PROCMON_REGISTRY_VALUE_REG_TYPE_EXPAND_SZ2, "REG_EXPAND_SZ" },

726

{ PROCMON_REGISTRY_VALUE_REG_TYPE_BINARY3, "REG_BINARY" },

727

{ PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD4, "REG_DWORD" },

728

{ PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD_BIG_ENDIAN5, "REG_DWORD_BIG_ENDIAN" },

729

{ PROCMON_REGISTRY_VALUE_REG_TYPE_LINK6, "REG_LINK" },

730

{ PROCMON_REGISTRY_VALUE_REG_TYPE_MULTI_SZ7, "REG_MULTI_SZ" },

731

{ PROCMON_REGISTRY_VALUE_REG_TYPE_RESOURCE_LIST8, "REG_RESOURCE_LIST" },

732

{ PROCMON_REGISTRY_VALUE_REG_TYPE_FULL_RESOURCE_DESCRIPTOR9, "REG_FULL_RESOURCE_DESCRIPTOR" },

733

{ PROCMON_REGISTRY_VALUE_REG_TYPE_RESOURCE_REQUIREMENTS_LIST10, "REG_RESOURCE_REQUIREMENTS_LIST" },

734

{ PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD11, "REG_QWORD" },

735

{ PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD_BIG_ENDIAN12, "REG_QWORD_BIG_ENDIAN" },

736

{ 0, NULL((void*)0) }

737

};

738

739

static int procmon_read_registry_data(proto_tree* tree, packet_info* pinfo, tvbuff_t* tvb, int offset, uint32_t type, uint32_t length)

740

{

741

switch (type)

742

{

743

case PROCMON_REGISTRY_VALUE_REG_TYPE_DWORD4:

744

proto_tree_add_item(tree, hf_procmon_registry_value_dword, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

745

offset += 4;

746

break;

747

case PROCMON_REGISTRY_VALUE_REG_TYPE_QWORD11:

748

proto_tree_add_item(tree, hf_procmon_registry_value_qword, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

749

offset += 8;

750

break;

751

case PROCMON_REGISTRY_VALUE_REG_TYPE_SZ1:

752

case PROCMON_REGISTRY_VALUE_REG_TYPE_EXPAND_SZ2:

753

proto_tree_add_item(tree, hf_procmon_registry_value_sz, tvb, offset, -1, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

754

offset += tvb_reported_length(tvb);

755

break;

756

case PROCMON_REGISTRY_VALUE_REG_TYPE_BINARY3:

757

proto_tree_add_item(tree, hf_procmon_registry_value_binary, tvb, offset, -1, ENC_NA0x00000000);

758

offset += tvb_reported_length(tvb);

759

break;

760

case PROCMON_REGISTRY_VALUE_REG_TYPE_MULTI_SZ7:

761

{

762

unsigned str_length, total_length = 0;

763

int start_offset = offset;

764

const char* substring;

765

wmem_strbuf_t* full_string = wmem_strbuf_new(pinfo->pool, "");

766

767

while ((total_length < length) && ((substring = (char*)tvb_get_stringz_enc(pinfo->pool, tvb, offset, &str_length, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000)) != NULL((void*)0)))

768

{

769

offset += str_length;

770

total_length += str_length;

771

if (strlen(substring) > 0)

772

wmem_strbuf_append_printf(full_string, " %s", substring);

773

else

774

break;

775

}

776

777

proto_tree_add_string(tree, hf_procmon_registry_value_multi_sz, tvb, start_offset, offset - start_offset, wmem_strbuf_get_str(full_string));

778

break;

779

}

780

}

781

782

return offset;

783

}

784

785

static int procmon_registry_query_or_enum_value_extra_details(proto_tree* tree, packet_info* pinfo, tvbuff_t* tvb, uint32_t information_class)

786

{

787

unsigned offset = 0;

788

uint32_t length = 0, type, name_size;

789

790

//Unknown fields

791

offset += 4;

792

793

proto_tree_add_item_ret_uint(tree, hf_procmon_registry_value_reg_type, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &type);

794

offset += 4;

795

796

switch (information_class)

797

{

798

case PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_FULL1:

799

proto_tree_add_item(tree, hf_procmon_registry_value_offset_to_data, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

800

offset += 4;

801

proto_tree_add_item_ret_uint(tree, hf_procmon_registry_value_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &length);

802

offset += 4;

803

proto_tree_add_item_ret_uint(tree, hf_procmon_registry_value_name_size, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &name_size);

804

offset += 4;

805

proto_tree_add_item(tree, hf_procmon_registry_value_name, tvb, offset, name_size, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

806

offset += name_size;

807

break;

808

case PROCMON_REGISTRY_VALUE_INFORMATION_CLASS_PARTIAL2:

809

proto_tree_add_item_ret_uint(tree, hf_procmon_registry_value_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &length);

810

offset += 4;

811

break;

812

}

813

814

if (length > 0)

815

offset += procmon_read_registry_data(tree, pinfo, tvb, offset, type, length);

816

817

return offset;

818

}

819

820

static bool_Bool dissect_procmon_registry_event(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, uint32_t operation, tvbuff_t* extra_details_tvb)

821

{

822

proto_tree* registry_tree;

823

int offset = 0, extra_offset = 0;

824

bool_Bool is_value_ascii, is_new_value_ascii;

825

uint32_t information_class, type;

826

uint16_t value_char_count, new_value_char_count;

827

uint32_t registry_access_mask_mapping[4] = { 0x20019, 0x20006, 0x20019, 0xf003f };

828

829

registry_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_registry_event, NULL((void*)0), "Registry Data");

830

831

switch(operation) {

832

case PROCMON_REGISTRY_OPERATION_OPEN_KEY0x0000:

833

case PROCMON_REGISTRY_OPERATION_CREATE_KEY0x0001:

834

{

835

static const value_string desired_access_vals[] = {

836

{0xf003f, "All Access"},

837

{0x2001f, "Read/Write"},

838

{0x20019, "Read"},

839

{0x20006, "Write"},

840

{0x1, "Query Value"},

841

{0x2, "Set Value"},

842

{0x4, "Create Sub Key"},

843

{0x8, "Enumerate Sub Keys"},

844

{0x10, "Notify"},

845

{0x20, "Create Link"},

846

{0x300, "WOW64_Res"},

847

{0x200, "WOW64_32Key"},

848

{0x100, "WOW64_64Key"},

849

{0x10000, "Delete"},

850

{0x20000, "Read Control"},

851

{0x40000, "Write DAC"},

852

{0x80000, "Write Owner"},

853

{0x100000, "Synchronize"},

854

{0x1000000, "Access System Security"},

855

{0x2000000, "Maximum Allowed"},

856

{ 0, NULL((void*)0) }

857

};

858

uint32_t desired_access;

859

860

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

861

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

862

&is_value_ascii, &value_char_count);

863

offset += 2;

864

865

//Unknown fields

866

offset += 2;

867

868

desired_access = tvb_get_letohl(tvb, offset);

869

dissect_procmon_access_mask(tvb, pinfo, registry_tree, offset, hf_procmon_registry_desired_access, 4, registry_access_mask_mapping, desired_access_vals);

870

offset += 4;

871

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

872

873

if (tvb_reported_length(extra_details_tvb) > 0)

874

{

875

if (desired_access & 0x2000000)

876

dissect_procmon_access_mask(extra_details_tvb, pinfo, registry_tree, extra_offset, hf_procmon_registry_granted_access, 4, registry_access_mask_mapping, desired_access_vals);

877

878

extra_offset += 4;

879

proto_tree_add_item(registry_tree, hf_procmon_registry_disposition, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

880

extra_offset += 4;

881

}

882

break;

883

}

884

case PROCMON_REGISTRY_OPERATION_CLOSE_KEY0x0002:

885

case PROCMON_REGISTRY_OPERATION_FLUSH_KEY0x000B:

886

case PROCMON_REGISTRY_OPERATION_UNLOAD_KEY0x000D:

887

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

888

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

889

&is_value_ascii, &value_char_count);

890

offset += 2;

891

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

892

break;

893

894

case PROCMON_REGISTRY_OPERATION_QUERY_KEY0x0003:

895

{

896

proto_item* info_item;

897

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

898

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

899

&is_value_ascii, &value_char_count);

900

offset += 2;

901

902

//Unknown fields

903

offset += 2;

904

905

proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

906

offset += 4;

907

info_item = proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_key_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &information_class);

908

if (try_val_to_str(information_class, registry_key_information_class_vals) == NULL((void*)0))

909

expert_add_info_format(pinfo, info_item, &ei_procmon_unknown_operation, "Unknown Registry Key Information Class: %u", information_class);

910

offset += 4;

911

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

912

if (tvb_reported_length(extra_details_tvb) > 0)

913

extra_offset += procmon_registry_query_or_enum_key_extra_details(registry_tree, extra_details_tvb, information_class);

914

break;

915

}

916

case PROCMON_REGISTRY_OPERATION_QUERY_VALUE0x0005:

917

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

918

hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value,

919

&is_value_ascii, &value_char_count);

920

offset += 2;

921

922

//Unknown fields

923

offset += 2;

924

925

proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

926

offset += 4;

927

proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_value_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &information_class);

928

offset += 4;

929

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value);

930

if (tvb_reported_length(extra_details_tvb) > 0)

931

extra_offset += procmon_registry_query_or_enum_value_extra_details(registry_tree, pinfo, extra_details_tvb, information_class);

932

break;

933

934

case PROCMON_REGISTRY_OPERATION_ENUM_KEY0x0007:

935

{

936

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

937

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

938

&is_value_ascii, &value_char_count);

939

offset += 2;

940

941

//Unknown fields

942

offset += 2;

943

944

proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

945

offset += 4;

946

proto_tree_add_item(registry_tree, hf_procmon_registry_index, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

947

offset += 4;

948

proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_key_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &information_class);

949

offset += 4;

950

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

951

if (tvb_reported_length(extra_details_tvb) > 0)

952

extra_offset += procmon_registry_query_or_enum_key_extra_details(registry_tree, extra_details_tvb, information_class);

953

break;

954

}

955

case PROCMON_REGISTRY_OPERATION_ENUM_VALUE0x0006:

956

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

957

hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value,

958

&is_value_ascii, &value_char_count);

959

offset += 2;

960

961

//Unknown fields

962

offset += 2;

963

964

proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

965

offset += 4;

966

proto_tree_add_item(registry_tree, hf_procmon_registry_index, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

967

offset += 4;

968

proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_value_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &information_class);

969

offset += 4;

970

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value);

971

if (tvb_reported_length(extra_details_tvb) > 0)

972

extra_offset += procmon_registry_query_or_enum_value_extra_details(registry_tree, pinfo, extra_details_tvb, information_class);

973

break;

974

975

case PROCMON_REGISTRY_OPERATION_SET_VALUE0x0004:

976

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

977

hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value,

978

&is_value_ascii, &value_char_count);

979

offset += 2;

980

981

//Unknown fields

982

offset += 2;

983

984

proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_type, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &type);

985

offset += 4;

986

proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

987

offset += 4;

988

proto_tree_add_item(registry_tree, hf_procmon_registry_data_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

989

offset += 4;

990

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value);

991

if (tvb_reported_length(extra_details_tvb) > 0)

992

extra_offset += procmon_read_registry_data(registry_tree, pinfo, extra_details_tvb, extra_offset, type, tvb_reported_length(extra_details_tvb));

993

break;

994

case PROCMON_REGISTRY_OPERATION_SET_INFO_KEY0x0008:

995

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

996

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

997

&is_value_ascii, &value_char_count);

998

offset += 2;

999

1000

//Unknown fields

1001

offset += 2;

1002

1003

proto_tree_add_item_ret_uint(registry_tree, hf_procmon_registry_key_set_information_class, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &information_class);

1004

offset += 4;

1005

1006

//Unknown fields

1007

offset += 4;

1008

1009

proto_tree_add_item(registry_tree, hf_procmon_registry_length, tvb, offset, 2, ENC_LITTLE_ENDIAN0x80000000);

1010

offset += 2;

1011

1012

//Unknown fields

1013

offset += 2;

1014

1015

offset = dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

1016

1017

if (tvb_reported_length(extra_details_tvb) > 0)

1018

{

1019

switch (information_class)

1020

{

1021

case PROCMON_REGISTRY_KEY_SET_INFORMATION_WRITE_TIME_INFO0:

1022

proto_tree_add_item(registry_tree, hf_procmon_registry_key_set_information_write_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

1023

extra_offset += 8;

1024

break;

1025

case PROCMON_REGISTRY_KEY_SET_INFORMATION_WOW64_FLAGS_INFO1:

1026

proto_tree_add_item(registry_tree, hf_procmon_registry_key_set_information_wow64_flags, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

1027

extra_offset += 4;

1028

break;

1029

case PROCMON_REGISTRY_KEY_SET_INFORMATION_HANDLE_TAGS_INFO2:

1030

proto_tree_add_item(registry_tree, hf_procmon_registry_key_set_information_handle_tags, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

1031

extra_offset += 4;

1032

break;

1033

}

1034

}

1035

break;

1036

1037

case PROCMON_REGISTRY_OPERATION_DELETE_KEY0x0009:

1038

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

1039

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

1040

&is_value_ascii, &value_char_count);

1041

offset += 2;

1042

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

1043

break;

1044

1045

case PROCMON_REGISTRY_OPERATION_DELETE_VALUE0x000A:

1046

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

1047

hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value,

1048

&is_value_ascii, &value_char_count);

1049

offset += 2;

1050

1051

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value);

1052

break;

1053

1054

case PROCMON_REGISTRY_OPERATION_LOAD_KEY0x000C:

1055

case PROCMON_REGISTRY_OPERATION_RENAME_KEY0x000E:

1056

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

1057

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

1058

&is_value_ascii, &value_char_count);

1059

offset += 2;

1060

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

1061

hf_procmon_registry_new_key_size, hf_procmon_registry_new_key_is_ascii, hf_procmon_registry_new_key_char_count, ett_procmon_registry_new_key,

1062

&is_new_value_ascii, &new_value_char_count);

1063

offset += 2;

1064

offset = dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

1065

/* offset += */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_new_value_ascii, new_value_char_count, hf_procmon_registry_new_key);

1066

break;

1067

1068

case PROCMON_REGISTRY_OPERATION_QUERY_MULTIPLE_VALUE0x000F:

1069

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

1070

hf_procmon_registry_value_size, hf_procmon_registry_value_is_ascii, hf_procmon_registry_value_char_count, ett_procmon_registry_value,

1071

&is_value_ascii, &value_char_count);

1072

offset += 2;

1073

1074

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_value);

1075

break;

1076

1077

case PROCMON_REGISTRY_OPERATION_SET_KEY_SECURITY0x0010:

1078

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

1079

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

1080

&is_value_ascii, &value_char_count);

1081

offset += 2;

1082

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

1083

break;

1084

1085

case PROCMON_REGISTRY_OPERATION_QUERY_KEY_SECURITY0x0011:

1086

dissect_procmon_detail_string_info(tvb, registry_tree, offset,

1087

hf_procmon_registry_key_size, hf_procmon_registry_key_is_ascii, hf_procmon_registry_key_char_count, ett_procmon_registry_key,

1088

&is_value_ascii, &value_char_count);

1089

offset += 2;

1090

/* offset = */ dissect_procmon_detail_string(tvb, registry_tree, offset, is_value_ascii, value_char_count, hf_procmon_registry_key);

1091

break;

1092

}

1093

1094

return (extra_offset != 0);

1095

}

1096

1097

#define PROCMON_FILESYSTEM_OPERATION_VOLUME_DISMOUNT0 0

1098

#define PROCMON_FILESYSTEM_OPERATION_VOLUME_MOUNT1 1

1099

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_MDL_WRITE_COMPLETE2 2

1100

#define PROCMON_FILESYSTEM_OPERATION_WRITE_FILE23 3

1101

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_MDL_READ_COMPLETE4 4

1102

#define PROCMON_FILESYSTEM_OPERATION_READ_FILE25 5

1103

#define PROCMON_FILESYSTEM_OPERATION_QUERY_OPEN6 6

1104

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_CHECK_IF_POSSIBLE7 7

1105

#define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_128 8

1106

#define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_119 9

1107

#define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_1010 10

1108

#define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_911 11

1109

#define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_812 12

1110

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_NOTIFY_STREAM_FO_CREATION13 13

1111

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_CC_FLUSH14 14

1112

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_ACQUIRE_FOR_CC_FLUSH15 15

1113

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_MOD_WRITE16 16

1114

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_ACQUIRE_FOR_MOD_WRITE17 17

1115

#define PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION18 18

1116

#define PROCMON_FILESYSTEM_OPERATION_CREATE_FILE_MAPPING19 19

1117

#define PROCMON_FILESYSTEM_OPERATION_CREATE_FILE20 20

1118

#define PROCMON_FILESYSTEM_OPERATION_CREATE_PIPE21 21

1119

#define PROCMON_FILESYSTEM_OPERATION_IRP_MJ_CLOSE22 22

1120

#define PROCMON_FILESYSTEM_OPERATION_READ_FILE23 23

1121

#define PROCMON_FILESYSTEM_OPERATION_WRITE_FILE24 24

1122

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE25 25

1123

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE26 26

1124

#define PROCMON_FILESYSTEM_OPERATION_QUERY_EA_FILE27 27

1125

#define PROCMON_FILESYSTEM_OPERATION_SET_EA_FILE28 28

1126

#define PROCMON_FILESYSTEM_OPERATION_FLUSH_BUFFERS_FILE29 29

1127

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION30 30

1128

#define PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION31 31

1129

#define PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL32 32

1130

#define PROCMON_FILESYSTEM_OPERATION_FILE_SYSTEM_CONTROL33 33

1131

#define PROCMON_FILESYSTEM_OPERATION_DEVICE_IO_CONTROL34 34

1132

#define PROCMON_FILESYSTEM_OPERATION_INTERNAL_DEVICE_IO_CONTROL35 35

1133

#define PROCMON_FILESYSTEM_OPERATION_SHUTDOWN36 36

1134

#define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE37 37

1135

#define PROCMON_FILESYSTEM_OPERATION_CLOSE_FILE38 38

1136

#define PROCMON_FILESYSTEM_OPERATION_CREATE_MAIL_SLOT39 39

1137

#define PROCMON_FILESYSTEM_OPERATION_QUERY_SECURITY_FILE40 40

1138

#define PROCMON_FILESYSTEM_OPERATION_SET_SECURITY_FILE41 41

1139

#define PROCMON_FILESYSTEM_OPERATION_POWER42 42

1140

#define PROCMON_FILESYSTEM_OPERATION_SYSTEM_CONTROL43 43

1141

#define PROCMON_FILESYSTEM_OPERATION_DEVICE_CHANGE44 44

1142

#define PROCMON_FILESYSTEM_OPERATION_QUERY_FILE_QUOTA45 45

1143

#define PROCMON_FILESYSTEM_OPERATION_SET_FILE_QUOTA46 46

1144

#define PROCMON_FILESYSTEM_OPERATION_PLUG_AND_PLAY47 47

1145

1146

static const value_string filesystem_operation_vals[] = {

1147

{ PROCMON_FILESYSTEM_OPERATION_VOLUME_DISMOUNT0, "Volume Dismount" },

1148

{ PROCMON_FILESYSTEM_OPERATION_VOLUME_MOUNT1, "Volume Mount" },

1149

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_MDL_WRITE_COMPLETE2, "Fast I/O MDL Write Complete" },

1150

{ PROCMON_FILESYSTEM_OPERATION_WRITE_FILE23, "Write File 2" },

1151

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_MDL_READ_COMPLETE4, "Fast I/O MDL Read Complete" },

1152

{ PROCMON_FILESYSTEM_OPERATION_READ_FILE25, "Read File 2" },

1153

{ PROCMON_FILESYSTEM_OPERATION_QUERY_OPEN6, "Query Open" },

1154

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_CHECK_IF_POSSIBLE7, "Fast I/O Check If Possible" },

1155

{ PROCMON_FILESYSTEM_OPERATION_IRP_MJ_128, "IRP_MJ_CLEANUP" },

1156

{ PROCMON_FILESYSTEM_OPERATION_IRP_MJ_119, "IRP_MJ_SET_INFORMATION" },

1157

{ PROCMON_FILESYSTEM_OPERATION_IRP_MJ_1010, "IRP_MJ_QUERY_INFORMATION" },

1158

{ PROCMON_FILESYSTEM_OPERATION_IRP_MJ_911, "IRP_MJ_FLUSH_BUFFERS" },

1159

{ PROCMON_FILESYSTEM_OPERATION_IRP_MJ_812, "IRP_MJ_DIRECTORY_CONTROL" },

1160

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_NOTIFY_STREAM_FO_CREATION13, "Fast I/O Notify Stream File Object Creation" },

1161

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_CC_FLUSH14, "Fast I/O Release For Cache Manager Flush" },

1162

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_ACQUIRE_FOR_CC_FLUSH15, "Fast I/O Acquire For Cache Manager Flush" },

1163

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_MOD_WRITE16, "Fast I/O Release For Modified Write" },

1164

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_ACQUIRE_FOR_MOD_WRITE17, "Fast I/O Acquire For Modified Write" },

1165

{ PROCMON_FILESYSTEM_OPERATION_FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION18, "Fast I/O Release For Section Synchronization" },

1166

{ PROCMON_FILESYSTEM_OPERATION_CREATE_FILE_MAPPING19, "Create File Mapping" },

1167

{ PROCMON_FILESYSTEM_OPERATION_CREATE_FILE20, "Create File" },

1168

{ PROCMON_FILESYSTEM_OPERATION_CREATE_PIPE21, "Create Pipe" },

1169

{ PROCMON_FILESYSTEM_OPERATION_IRP_MJ_CLOSE22, "IRP_MJ_CLOSE" },

1170

{ PROCMON_FILESYSTEM_OPERATION_READ_FILE23, "Read File" },

1171

{ PROCMON_FILESYSTEM_OPERATION_WRITE_FILE24, "Write File" },

1172

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE25, "Query Information File" },

1173

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE26, "Set Information File" },

1174

{ PROCMON_FILESYSTEM_OPERATION_QUERY_EA_FILE27, "Query EA File" },

1175

{ PROCMON_FILESYSTEM_OPERATION_SET_EA_FILE28, "Set EA File" },

1176

{ PROCMON_FILESYSTEM_OPERATION_FLUSH_BUFFERS_FILE29, "Flush Buffers File" },

1177

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION30, "Query Volume Information" },

1178

{ PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION31, "Set Volume Information" },

1179

{ PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL32, "Directory Control" },

1180

{ PROCMON_FILESYSTEM_OPERATION_FILE_SYSTEM_CONTROL33, "File System Control" },

1181

{ PROCMON_FILESYSTEM_OPERATION_DEVICE_IO_CONTROL34, "Device I/O Control" },

1182

{ PROCMON_FILESYSTEM_OPERATION_INTERNAL_DEVICE_IO_CONTROL35, "Internal Device I/O Control" },

1183

{ PROCMON_FILESYSTEM_OPERATION_SHUTDOWN36, "Shutdown" },

1184

{ PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE37, "Lock/Unlock File" },

1185

{ PROCMON_FILESYSTEM_OPERATION_CLOSE_FILE38, "Close File" },

1186

{ PROCMON_FILESYSTEM_OPERATION_CREATE_MAIL_SLOT39, "Create Mail Slot" },

1187

{ PROCMON_FILESYSTEM_OPERATION_QUERY_SECURITY_FILE40, "Query Security File" },

1188

{ PROCMON_FILESYSTEM_OPERATION_SET_SECURITY_FILE41, "Set Security File" },

1189

{ PROCMON_FILESYSTEM_OPERATION_POWER42, "Power" },

1190

{ PROCMON_FILESYSTEM_OPERATION_SYSTEM_CONTROL43, "System Control" },

1191

{ PROCMON_FILESYSTEM_OPERATION_DEVICE_CHANGE44, "Device Change" },

1192

{ PROCMON_FILESYSTEM_OPERATION_QUERY_FILE_QUOTA45, "Query File Quota" },

1193

{ PROCMON_FILESYSTEM_OPERATION_SET_FILE_QUOTA46, "Set File Quota" },

1194

{ PROCMON_FILESYSTEM_OPERATION_PLUG_AND_PLAY47, "Plug and Play" },

1195

{ 0, NULL((void*)0) }

1196

};

1197

1198

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_BASIC0x04 0x04

1199

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STANDARD0x05 0x05

1200

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_INTERNAL0x06 0x06

1201

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_EA0x07 0x07

1202

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NAME0x09 0x09

1203

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_POSITION0x0E 0x0E

1204

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ALL0x12 0x12

1205

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_END_OF_FILE0x14 0x14

1206

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STREAM0x16 0x16

1207

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_COMPRESSION0x1C 0x1C

1208

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID0x1D 0x1D

1209

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_MOVE_CLUSTER0x1F 0x1F

1210

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NETWORK_OPEN0x22 0x22

1211

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ATTRIBUTE_TAG0x23 0x23

1212

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_BOTH_DIRECTORY0x25 0x25

1213

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_VALID_DATA_LENGTH0x27 0x27

1214

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_SHORT_NAME0x28 0x28

1215

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_IO_PRIORITY_HINT0x2B 0x2B

1216

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINKS0x2E 0x2E

1217

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NAMES0x2F 0x2F

1218

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NORMALIZED_NAME0x30 0x30

1219

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NETWORK_PHYSICAL_NAME0x31 0x31

1220

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_GLOBAL_TX_DIRECTORY0x32 0x32

1221

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_IS_REMOTE_DEVICE0x33 0x33

1222

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ATTRIBUTE_CACHE0x34 0x34

1223

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NUMA_NODE0x35 0x35

1224

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STANDARD_LINK0x36 0x36

1225

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_REMOTE_PROTOCOL0x37 0x37

1226

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_RENAME_BYPASS_ACCESS0x38 0x38

1227

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINK_BYPASS_ACCESS0x39 0x39

1228

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_VOLUME_NAME0x3A 0x3A

1229

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_INFO0x3B 0x3B

1230

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_EXTD_DIRECTORY0x3C 0x3C

1231

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_HARD_LINK_FULL_ID0x3E 0x3E

1232

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_EXTD_BOTH_DIRECTORY0x3F 0x3F

1233

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_DESIRED_STORAGE_CLASS0x43 0x43

1234

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STAT0x44 0x44

1235

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_MEMORY_PARTITION0x45 0x45

1236

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_SAT_LX0x46 0x46

1237

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_CASE_SENSITIVE0x47 0x47

1238

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINK_EX0x48 0x48

1239

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STORAGE_RESERVED_ID0x4A 0x4A

1240

#define PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_CASE_SENSITIVE_FORCE_ACCESS0x4B 0x4B

1241

1242

static const value_string filesystem_operation_query_info_vals[] = {

1243

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_BASIC0x04, "Basic"},

1244

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STANDARD0x05, "Standard"},

1245

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_INTERNAL0x06, "Internal"},

1246

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_EA0x07, "EA"},

1247

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NAME0x09, "Name"},

1248

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_POSITION0x0E, "Position"},

1249

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ALL0x12, "All"},

1250

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_END_OF_FILE0x14, "End of File"},

1251

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STREAM0x16, "Stream"},

1252

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_COMPRESSION0x1C, "Compression"},

1253

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID0x1D, "ID"},

1254

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_MOVE_CLUSTER0x1F, "Move Cluster"},

1255

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NETWORK_OPEN0x22, "Network Open"},

1256

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ATTRIBUTE_TAG0x23, "Attribute Tag"},

1257

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_BOTH_DIRECTORY0x25,"ID Both Directory"},

1258

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_VALID_DATA_LENGTH0x27,"Valid Data Length"},

1259

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_SHORT_NAME0x28, "Short Name"},

1260

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_IO_PRIORITY_HINT0x2B, "I/O Priority Hint"},

1261

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINKS0x2E, "Links"},

1262

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NAMES0x2F, "Names"},

1263

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NORMALIZED_NAME0x30, "Normalized Name"},

1264

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NETWORK_PHYSICAL_NAME0x31,"Network Physical Name"},

1265

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_GLOBAL_TX_DIRECTORY0x32,"ID Global TX Directory"},

1266

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_IS_REMOTE_DEVICE0x33, "Is Remote Device"},

1267

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ATTRIBUTE_CACHE0x34, "Attribute Cache"},

1268

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_NUMA_NODE0x35, "NUMA Node"},

1269

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STANDARD_LINK0x36, "Standard Link"},

1270

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_REMOTE_PROTOCOL0x37, "Remote Protocol"},

1271

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_RENAME_BYPASS_ACCESS0x38, "Rename Bypass Access"},

1272

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINK_BYPASS_ACCESS0x39, "Link Bypass Access"},

1273

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_VOLUME_NAME0x3A, "Volume Name"},

1274

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_INFO0x3B, "ID Info"},

1275

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_EXTD_DIRECTORY0x3C, "ID Extended Directory"},

1276

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_HARD_LINK_FULL_ID0x3E, "Hard Link Full ID"},

1277

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_ID_EXTD_BOTH_DIRECTORY0x3F, "ID Extended Both Directory"},

1278

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_DESIRED_STORAGE_CLASS0x43, "Desired Storage Class"},

1279

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STAT0x44, "Stat"},

1280

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_MEMORY_PARTITION0x45, "Memory Partition"},

1281

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_SAT_LX0x46, "SAT LX"},

1282

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_CASE_SENSITIVE0x47, "Case Sensitive"},

1283

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_LINK_EX0x48, "Link Ex"},

1284

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_STORAGE_RESERVED_ID0x4A,"Storage Reserved ID"},

1285

{ PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE_CASE_SENSITIVE_FORCE_ACCESS0x4B,"Case Sensitive Force Access"},

1286

{ 0, NULL((void*)0) }

1287

};

1288

1289

1290

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_BASIC0x04 0x04

1291

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME0x0A 0x0A

1292

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_LINK0x0B 0x0B

1293

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION0x0D 0x0D

1294

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_POSITION0x0E 0x0E

1295

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_ALLOCATION0x13 0x13

1296

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_END_OF_FILE0x14 0x14

1297

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_STREAM0x16 0x16

1298

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_PIPE0x17 0x17

1299

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_VALID_DATA_LENGTH0x27 0x27

1300

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_SHORT_NAME0x28 0x28

1301

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_REPLACE_COMPLETION0x3D 0x3D

1302

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION_EX0x40 0x40

1303

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME_EX0x41 0x41

1304

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME_EX_BYPASS_ACCESS0x42 0x42

1305

#define PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_STORAGE_RESERVE_ID0x4A 0x4A

1306

1307

static const value_string filesystem_operation_set_info_vals[] = {

1308

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_BASIC0x04, "Basic" },

1309

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME0x0A, "Rename" },

1310

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_LINK0x0B, "Link" },

1311

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION0x0D, "Disposition" },

1312

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_POSITION0x0E, "Position" },

1313

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_ALLOCATION0x13, "Allocation" },

1314

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_END_OF_FILE0x14, "End of File" },

1315

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_STREAM0x16, "Stream" },

1316

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_PIPE0x17, "Pipe" },

1317

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_VALID_DATA_LENGTH0x27, "Valid Data Length" },

1318

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_SHORT_NAME0x28, "Short name" },

1319

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_REPLACE_COMPLETION0x3D,"Replace Completion" },

1320

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION_EX0x40, "DispositionEx" },

1321

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME_EX0x41, "RenameEx" },

1322

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_RENAME_EX_BYPASS_ACCESS0x42, "RenameEx Bypass Access" },

1323

{ PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_STORAGE_RESERVE_ID0x4A,"Storage Reserve ID" },

1324

{ 0, NULL((void*)0) }

1325

};

1326

1327

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_INFORMATION0x1 0x1

1328

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_LABEL0x2 0x2

1329

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_SIZE0x3 0x3

1330

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_DEVICE0x4 0x4

1331

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_ATTRIBUTE0x5 0x5

1332

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_CONTROL0x6 0x6

1333

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_FULL_SIZE0x7 0x7

1334

#define PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_OBJECT_ID0x8 0x8

1335

1336

static const value_string filesystem_operation_query_volume_info_vals[] = {

1337

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_INFORMATION0x1, "Query Information" },

1338

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_LABEL0x2, "Query Label" },

1339

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_SIZE0x3, "Query Size" },

1340

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_DEVICE0x4, "Query Device" },

1341

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_ATTRIBUTE0x5, "Query Attribute" },

1342

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_CONTROL0x6, "Query Control" },

1343

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_FULL_SIZE0x7, "Query Full Size" },

1344

{ PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION_QUERY_OBJECT_ID0x8, "Query Object ID" },

1345

{ 0, NULL((void*)0) }

1346

};

1347

1348

#define PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_CONTROL0x01 0x01

1349

#define PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_LABEL0x02 0x02

1350

#define PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_OBJECT_ID0x08 0x08

1351

1352

static const value_string filesystem_operation_set_volume_info_vals[] = {

1353

{ PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_CONTROL0x01, "Control" },

1354

{ PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_LABEL0x02, "Label" },

1355

{ PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION_OBJECT_ID0x08, "Object ID" },

1356

{ 0, NULL((void*)0) }

1357

};

1358

1359

#define PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_QUERY0x01 0x01

1360

#define PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_NOTIFY_CHANGE0x02 0x02

1361

1362

static const value_string filesystem_operation_directory_control_vals[] = {

1363

{ PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_QUERY0x01, "Query" },

1364

{ PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_NOTIFY_CHANGE0x02, "Notify Change" },

1365

{ 0, NULL((void*)0) }

1366

};

1367

1368

#define PROCMON_FILESYSTEM_OPERATION_PNP_START_DEVICE0x00 0x00

1369

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_REMOVE_DEVICE0x01 0x01

1370

#define PROCMON_FILESYSTEM_OPERATION_PNP_REMOVE_DEVICE0x02 0x02

1371

#define PROCMON_FILESYSTEM_OPERATION_PNP_CANCEL_REMOVE_DEVICE0x03 0x03

1372

#define PROCMON_FILESYSTEM_OPERATION_PNP_STOP_DEVICE0x04 0x04

1373

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_STOP_DEVICE0x05 0x05

1374

#define PROCMON_FILESYSTEM_OPERATION_PNP_CANCEL_STOP_DEVICE0x06 0x06

1375

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_DEVICE_RELATIONS0x07 0x07

1376

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_INTERFACE0x08 0x08

1377

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_CAPABILITIES0x09 0x09

1378

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_RESOURCES0x0A 0x0A

1379

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_RESOURCE_REQUIREMENTS0x0B 0x0B

1380

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_DEVICE_TEXT0x0C 0x0C

1381

#define PROCMON_FILESYSTEM_OPERATION_PNP_FILTER_RESOURCE_REQUIREMENTS0x0D 0x0D

1382

#define PROCMON_FILESYSTEM_OPERATION_PNP_READ_CONFIG0x0F 0x0F

1383

#define PROCMON_FILESYSTEM_OPERATION_PNP_WRITE_CONFIG0x10 0x10

1384

#define PROCMON_FILESYSTEM_OPERATION_PNP_EJECT0x11 0x11

1385

#define PROCMON_FILESYSTEM_OPERATION_PNP_SET_LOCK0x12 0x12

1386

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_ID20x13 0x13

1387

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_PNP_DEVICE_STATE0x14 0x14

1388

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_BUS_INFORMATION0x15 0x15

1389

#define PROCMON_FILESYSTEM_OPERATION_PNP_DEVICE_USAGE_NOTIFICATION0x16 0x16

1390

#define PROCMON_FILESYSTEM_OPERATION_PNP_SURPRISE_REMOVAL0x17 0x17

1391

#define PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_LEGACY_BUS_INFORMATION0x18 0x18

1392

1393

static const value_string filesystem_operation_pnp_vals[] = {

1394

{ PROCMON_FILESYSTEM_OPERATION_PNP_START_DEVICE0x00, "Start Device" },

1395

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_REMOVE_DEVICE0x01, "Query Remove Device" },

1396

{ PROCMON_FILESYSTEM_OPERATION_PNP_REMOVE_DEVICE0x02, "Remove Device" },

1397

{ PROCMON_FILESYSTEM_OPERATION_PNP_CANCEL_REMOVE_DEVICE0x03, "Cancel Remove Device" },

1398

{ PROCMON_FILESYSTEM_OPERATION_PNP_STOP_DEVICE0x04, "Stop Device" },

1399

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_STOP_DEVICE0x05, "Query Stop Device" },

1400

{ PROCMON_FILESYSTEM_OPERATION_PNP_CANCEL_STOP_DEVICE0x06, "Cancel Stop Device" },

1401

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_DEVICE_RELATIONS0x07, "Query Device Relations" },

1402

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_INTERFACE0x08, "Query Interface" },

1403

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_CAPABILITIES0x09, "Query Capabilities" },

1404

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_RESOURCES0x0A, "Query Resources" },

1405

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_RESOURCE_REQUIREMENTS0x0B, "Query Resource Requirements" },

1406

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_DEVICE_TEXT0x0C, "Query Device Text" },

1407

{ PROCMON_FILESYSTEM_OPERATION_PNP_FILTER_RESOURCE_REQUIREMENTS0x0D,"Filter Resource Requirements" },

1408

{ PROCMON_FILESYSTEM_OPERATION_PNP_READ_CONFIG0x0F, "Read Config" },

1409

{ PROCMON_FILESYSTEM_OPERATION_PNP_WRITE_CONFIG0x10, "Write Config" },

1410

{ PROCMON_FILESYSTEM_OPERATION_PNP_EJECT0x11, "Eject" },

1411

{ PROCMON_FILESYSTEM_OPERATION_PNP_SET_LOCK0x12, "Set Lock" },

1412

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_ID20x13, "Query ID2" },

1413

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_PNP_DEVICE_STATE0x14, "Query PnP Device State" },

1414

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_BUS_INFORMATION0x15, "Query Bus Information" },

1415

{ PROCMON_FILESYSTEM_OPERATION_PNP_DEVICE_USAGE_NOTIFICATION0x16, "Device Usage Notification" },

1416

{ PROCMON_FILESYSTEM_OPERATION_PNP_SURPRISE_REMOVAL0x17, "Surprise Removal" },

1417

{ PROCMON_FILESYSTEM_OPERATION_PNP_QUERY_LEGACY_BUS_INFORMATION0x18, "Query Legacy Bus Information" },

1418

{ 0, NULL((void*)0) }

1419

};

1420

1421

#define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_LOCK0x01 0x01

1422

#define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_SINGLE0x02 0x02

1423

#define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_ALL0x03 0x03

1424

#define PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_BY_KEY0x04 0x04

1425

1426

static const value_string filesystem_operation_lock_unlock_file_vals[] = {

1427

{ PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_LOCK0x01, "Lock" },

1428

{ PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_SINGLE0x02, "Unlock Single" },

1429

{ PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_ALL0x03, "Unlock All" },

1430

{ PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE_UNLOCK_BY_KEY0x04, "Unlock By Key" },

1431

{ 0, NULL((void*)0) }

1432

};

1433

1434

#define PROCMON_FILESYSTEM_DISPOSITION_SUPERSEDE0x00 0x00

1435

#define PROCMON_FILESYSTEM_DISPOSITION_OPEN0x01 0x01

1436

#define PROCMON_FILESYSTEM_DISPOSITION_CREATE0x02 0x02

1437

#define PROCMON_FILESYSTEM_DISPOSITION_OPEN_IF0x03 0x03

1438

#define PROCMON_FILESYSTEM_DISPOSITION_OVERWRITE0x04 0x04

1439

#define PROCMON_FILESYSTEM_DISPOSITION_OVERWRITE_IF0x05 0x05

1440

1441

static const value_string filesystem_disposition_vals[] = {

1442

{ PROCMON_FILESYSTEM_DISPOSITION_SUPERSEDE0x00, "Supersede" },

1443

{ PROCMON_FILESYSTEM_DISPOSITION_OPEN0x01, "Open" },

1444

{ PROCMON_FILESYSTEM_DISPOSITION_CREATE0x02, "Create" },

1445

{ PROCMON_FILESYSTEM_DISPOSITION_OPEN_IF0x03, "Open If" },

1446

{ PROCMON_FILESYSTEM_DISPOSITION_OVERWRITE0x04, "Overwrite" },

1447

{ PROCMON_FILESYSTEM_DISPOSITION_OVERWRITE_IF0x05, "Overwrite If" },

1448

{ 0, NULL((void*)0) }

1449

};

1450

1451

static const value_string filesystem_open_result_vals[] = {

1452

{ 0, "Superseded" },

1453

{ 1, "Opened" },

1454

{ 2, "Created" },

1455

{ 3, "Overwritten" },

1456

{ 4, "Exists" },

1457

{ 5, "Does Not Exists" },

1458

{ 0, NULL((void*)0) }

1459

};

1460

1461

static const value_string filesystem_readwrite_priority_vals[] = {

1462

{ 0, "" },

1463

{ 1, "Very Low" },

1464

{ 2, "Low" },

1465

{ 3, "Normal" },

1466

{ 4, "High" },

1467

{ 5, "Critical" },

1468

{ 0, NULL((void*)0) }

1469

};

1470

1471

static const value_string ioctl_code_vals[] = {

1472

{0x24058, "IOCTL_CDROM_GET_CONFIGURATION"},

1473

{0x24800, "IOCTL_CDROM_CHECK_VERIFY"},

1474

{0x24804, "IOCTL_CDROM_MEDIA_REMOVAL"},

1475

{0x24808, "IOCTL_CDROM_EJECT_MEDIA"},

1476

{0x2480c, "IOCTL_CDROM_LOAD_MEDIA"},

1477

{0x41018, "IOCTL_SCSI_GET_ADDRESS"},

1478

{0x41020, "IOCTL_SCSI_GET_DUMP_POINTERS"},

1479

{0x41024, "IOCTL_SCSI_FREE_DUMP_POINTERS"},

1480

{0x4d004, "IOCTL_SCSI_PASS_THROUGH"},

1481

{0x4d014, "IOCTL_SCSI_PASS_THROUGH_DIRECT"},

1482

{0x60190, "FSCTL_DFS_TRANSLATE_PATH"},

1483

{0x60194, "FSCTL_DFS_GET_REFERRALS"},

1484

{0x60198, "FSCTL_DFS_REPORT_INCONSISTENCY"},

1485

{0x6019c, "FSCTL_DFS_IS_SHARE_IN_DFS"},

1486

{0x601a0, "FSCTL_DFS_IS_ROOT"},

1487

{0x601a4, "FSCTL_DFS_GET_VERSION"},

1488

{0x70000, "IOCTL_DISK_GET_DRIVE_GEOMETRY"},

1489

{0x70014, "IOCTL_DISK_VERIFY"},

1490

{0x70020, "IOCTL_DISK_PERFORMANCE"},

1491

{0x70024, "IOCTL_DISK_IS_WRITABLE"},

1492

{0x70028, "IOCTL_DISK_LOGGING"},

1493

{0x70030, "IOCTL_DISK_HISTOGRAM_STRUCTURE"},

1494

{0x70034, "IOCTL_DISK_HISTOGRAM_DATA"},

1495

{0x70038, "IOCTL_DISK_HISTOGRAM_RESET"},

1496

{0x7003c, "IOCTL_DISK_REQUEST_STRUCTURE"},

1497

{0x70040, "IOCTL_DISK_REQUEST_DATA"},

1498

{0x70048, "IOCTL_DISK_GET_PARTITION_INFO_EX"},

1499

{0x70050, "IOCTL_DISK_GET_DRIVE_LAYOUT_EX"},

1500

{0x70060, "IOCTL_DISK_PERFORMANCE_OFF"},

1501

{0x700a0, "IOCTL_DISK_GET_DRIVE_GEOMETRY_EX"},

1502

{0x700f0, "IOCTL_DISK_GET_DISK_ATTRIBUTES"},

1503

{0x70140, "IOCTL_DISK_UPDATE_PROPERTIES"},

1504

{0x70214, "IOCTL_DISK_GET_CLUSTER_INFO"},

1505

{0x70c00, "IOCTL_DISK_GET_MEDIA_TYPES"},

1506

{0x74004, "IOCTL_DISK_GET_PARTITION_INFO"},

1507

{0x7400c, "IOCTL_DISK_GET_DRIVE_LAYOUT"},

1508

{0x7405c, "IOCTL_DISK_GET_LENGTH_INFO"},

1509

{0x74080, "SMART_GET_VERSION"},

1510

{0x740d4, "IOCTL_DISK_GET_CACHE_INFORMATION"},

1511

{0x74800, "IOCTL_DISK_CHECK_VERIFY"},

1512

{0x74804, "IOCTL_DISK_MEDIA_REMOVAL"},

1513

{0x74808, "IOCTL_DISK_EJECT_MEDIA"},

1514

{0x7480c, "IOCTL_DISK_LOAD_MEDIA"},

1515

{0x74810, "IOCTL_DISK_RESERVE"},

1516

{0x74814, "IOCTL_DISK_RELEASE"},

1517

{0x74818, "IOCTL_DISK_FIND_NEW_DEVICES"},

1518

{0x7c008, "IOCTL_DISK_SET_PARTITION_INFO"},

1519

{0x7c010, "IOCTL_DISK_SET_DRIVE_LAYOUT"},

1520

{0x7c018, "IOCTL_DISK_FORMAT_TRACKS"},

1521

{0x7c01c, "IOCTL_DISK_REASSIGN_BLOCKS"},

1522

{0x7c02c, "IOCTL_DISK_FORMAT_TRACKS_EX"},

1523

{0x7c04c, "IOCTL_DISK_SET_PARTITION_INFO_EX"},

1524

{0x7c054, "IOCTL_DISK_SET_DRIVE_LAYOUT_EX"},

1525

{0x7c058, "IOCTL_DISK_CREATE_DISK"},

1526

{0x7c084, "SMART_SEND_DRIVE_COMMAND"},

1527

{0x7c088, "SMART_RCV_DRIVE_DATA"},

1528

{0x7c0a4, "IOCTL_DISK_REASSIGN_BLOCKS_EX"},

1529

{0x7c0c8, "IOCTL_DISK_UPDATE_DRIVE_SIZE"},

1530

{0x7c0d0, "IOCTL_DISK_GROW_PARTITION"},

1531

{0x7c0d8, "IOCTL_DISK_SET_CACHE_INFORMATION"},

1532

{0x7c0f4, "IOCTL_DISK_SET_DISK_ATTRIBUTES"},

1533

{0x7c218, "IOCTL_DISK_SET_CLUSTER_INFO"},

1534

{0x90000, "FSCTL_REQUEST_OPLOCK_LEVEL_1"},

1535

{0x90004, "FSCTL_REQUEST_OPLOCK_LEVEL_2"},

1536

{0x90008, "FSCTL_REQUEST_BATCH_OPLOCK"},

1537

{0x9000c, "FSCTL_OPLOCK_BREAK_ACKNOWLEDGE"},

1538

{0x90010, "FSCTL_OPBATCH_ACK_CLOSE_PENDING"},

1539

{0x90014, "FSCTL_OPLOCK_BREAK_NOTIFY"},

1540

{0x90018, "FSCTL_LOCK_VOLUME"},

1541

{0x9001c, "FSCTL_UNLOCK_VOLUME"},

1542

{0x90020, "FSCTL_DISMOUNT_VOLUME"},

1543

{0x90028, "FSCTL_IS_VOLUME_MOUNTED"},

1544

{0x9002c, "FSCTL_IS_PATHNAME_VALID"},

1545

{0x90030, "FSCTL_MARK_VOLUME_DIRTY"},

1546

{0x9003b, "FSCTL_QUERY_RETRIEVAL_POINTERS"},

1547

{0x9003c, "FSCTL_GET_COMPRESSION"},

1548

{0x90050, "FSCTL_OPLOCK_BREAK_ACK_NO_2"},

1549

{0x90058, "FSCTL_QUERY_FAT_BPB"},

1550

{0x9005c, "FSCTL_REQUEST_FILTER_OPLOCK"},

1551

{0x90060, "FSCTL_FILESYSTEM_GET_STATISTICS"},

1552

{0x90064, "FSCTL_GET_NTFS_VOLUME_DATA"},

1553

{0x90068, "FSCTL_GET_NTFS_FILE_RECORD"},

1554

{0x9006f, "FSCTL_GET_VOLUME_BITMAP"},

1555

{0x90073, "FSCTL_GET_RETRIEVAL_POINTERS"},

1556

{0x90074, "FSCTL_MOVE_FILE"},

1557

{0x90078, "FSCTL_IS_VOLUME_DIRTY"},

1558

{0x90083, "FSCTL_ALLOW_EXTENDED_DASD_IO"},

1559

{0x90087, "FSCTL_READ_PROPERTY_DATA"},

1560

{0x9008b, "FSCTL_WRITE_PROPERTY_DATA"},

1561

{0x9008f, "FSCTL_FIND_FILES_BY_SID"},

1562

{0x90097, "FSCTL_DUMP_PROPERTY_DATA"},

1563

{0x90098, "FSCTL_SET_OBJECT_ID"},

1564

{0x9009c, "FSCTL_GET_OBJECT_ID"},

1565

{0x900a0, "FSCTL_DELETE_OBJECT_ID"},

1566

{0x900a4, "FSCTL_SET_REPARSE_POINT"},

1567

{0x900a8, "FSCTL_GET_REPARSE_POINT"},

1568

{0x900ac, "FSCTL_DELETE_REPARSE_POINT"},

1569

{0x900b3, "FSCTL_ENUM_USN_DATA"},

1570

{0x900bb, "FSCTL_READ_USN_JOURNAL"},

1571

{0x900bc, "FSCTL_SET_OBJECT_ID_EXTENDED"},

1572

{0x900c0, "FSCTL_CREATE_OR_GET_OBJECT_ID"},

1573

{0x900c4, "FSCTL_SET_SPARSE"},

1574

{0x900d7, "FSCTL_SET_ENCRYPTION"},

1575

{0x900db, "FSCTL_ENCRYPTION_FSCTL_IO"},

1576

{0x900df, "FSCTL_WRITE_RAW_ENCRYPTED" },

1577

{0x900e3, "FSCTL_READ_RAW_ENCRYPTED" },

1578

{0x900e7, "FSCTL_CREATE_USN_JOURNAL" },

1579

{0x900eb, "FSCTL_READ_FILE_USN_DATA" },

1580

{0x900ef, "FSCTL_WRITE_USN_CLOSE_RECORD" },

1581

{0x900f0, "FSCTL_EXTEND_VOLUME" },

1582

{0x900f4, "FSCTL_QUERY_USN_JOURNAL" },

1583

{0x900f8, "FSCTL_DELETE_USN_JOURNAL" },

1584

{0x900fc, "FSCTL_MARK_HANDLE" },

1585

{0x90100, "FSCTL_SIS_COPYFILE" },

1586

{0x90120, "FSCTL_FILE_PREFETCH" },

1587

{0x901af, "CSC_FSCTL_OPERATION_QUERY_HANDLE" },

1588

{0x901f0, "FSCTL_QUERY_DEPENDENT_VOLUME" },

1589

{0x90230, "FSCTL_GET_BOOT_AREA_INFO" },

1590

{0x90240, "FSCTL_REQUEST_OPLOCK" },

1591

{0x90244, "FSCTL_CSV_TUNNEL_REQUEST" },

1592

{0x9024c, "FSCTL_QUERY_FILE_SYSTEM_RECOGNITION" },

1593

{0x90254, "FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT" },

1594

{0x90258, "FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME" },

1595

{0x9025c, "FSCTL_IS_FILE_ON_CSV_VOLUME" },

1596

{0x90260, "FSCTL_CORRUPTION_HANDLING" },

1597

{0x90270, "FSCTL_SET_PURGE_FAILURE_MODE" },

1598

{0x90277, "FSCTL_QUERY_FILE_LAYOUT" },

1599

{0x90278, "FSCTL_IS_VOLUME_OWNED_BYCSVFS" },

1600

{0x9027c, "FSCTL_GET_INTEGRITY_INFORMATION" },

1601

{0x90284, "FSCTL_QUERY_FILE_REGIONS" },

1602

{0x902b0, "FSCTL_SCRUB_DATA" },

1603

{0x902b8, "FSCTL_DISABLE_LOCAL_BUFFERING" },

1604

{0x9030c, "FSCTL_SET_EXTERNAL_BACKING" },

1605

{0x90310, "FSCTL_GET_EXTERNAL_BACKING" },

1606

{0x940b7, "FSCTL_SECURITY_ID_CHECK" },

1607

{0x940cf, "FSCTL_QUERY_ALLOCATED_RANGES" },

1608

{0x941e4, "FSCTL_TXFS_LIST_TRANSACTIONS" },

1609

{0x94264, "FSCTL_OFFLOAD_READ" },

1610

{0x980c8, "FSCTL_SET_ZERO_DATA" },

1611

{0x980d0, "FSCTL_ENABLE_UPGRADE" },

1612

{0x98208, "FSCTL_FILE_LEVEL_TRIM" },

1613

{0x98268, "FSCTL_OFFLOAD_WRITE" },

1614

{0x9c040, "FSCTL_SET_COMPRESSION" },

1615

{0x9c104, "FSCTL_SIS_LINK_FILES" },

1616

{0x9c108, "FSCTL_HSM_MSG" },

1617

{0x9c2b4, "FSCTL_REPAIR_COPIES" },

1618

{0xc4003, "FSCTL_MAILSLOT_PEEK" },

1619

{0x110000, "FSCTL_PIPE_ASSIGN_EVENT" },

1620

{0x110004, "FSCTL_PIPE_DISCONNECT" },

1621

{0x110008, "FSCTL_PIPE_LISTEN" },

1622

{0x110010, "FSCTL_PIPE_QUERY_EVENT" },

1623

{0x110018, "FSCTL_PIPE_WAIT" },

1624

{0x11001c, "FSCTL_PIPE_IMPERSONATE" },

1625

{0x110020, "FSCTL_PIPE_SET_CLIENT_PROCESS" },

1626

{0x110024, "FSCTL_QUERY_CLIENT_PROCESS" },

1627

{0x11400c, "FSCTL_PIPE_PEEK" },

1628

{0x116000, "FSCTL_PIPE_INTERNAL_READ" },

1629

{0x119ff8, "FSCTL_PIPE_INTERNAL_WRITE" },

1630

{0x11c017, "FSCTL_PIPE_TRANSCEIVE" },

1631

{0x11dfff, "FSCTL_PIPE_INTERNAL_TRANSCEIVE" },

1632

{0x140191, "FSCTL_LMR_START" },

1633

{0x140193, "IOCTL_SMBMRX_START" },

1634

{0x140194, "FSCTL_LMR_STOP" },

1635

{0x140197, "IOCTL_SMBMRX_STOP" },

1636

{0x140198, "IOCTL_SMBMRX_GETSTATE" },

1637

{0x140199, "FSCTL_NETWORK_SET_CONFIGURATION_INFO" },

1638

{0x14019e, "FSCTL_NETWORK_GET_CONFIGURATION_INFO" },

1639

{0x1401a3, "FSCTL_NETWORK_GET_CONNECTION_INFO" },

1640

{0x1401a7, "FSCTL_NETWORK_ENUMERATE_CONNECTIONS" },

1641

{0x1401ab, "FSCTL_LMR_FORCE_DISCONNECT" },

1642

{0x1401ac, "FSCTL_NETWORK_DELETE_CONNECTION" },

1643

{0x1401b0, "FSCTL_LMR_BIND_TO_TRANSPORT" },

1644

{0x1401b4, "FSCTL_LMR_UNBIND_FROM_TRANSPORT" },

1645

{0x1401bb, "FSCTL_LMR_ENUMERATE_TRANSPORTS" },

1646

{0x1401c4, "FSCTL_LMR_GET_HINT_SIZE" },

1647

{0x1401c8, "FSCTL_LMR_TRANSACT" },

1648

{0x1401cc, "FSCTL_LMR_ENUMERATE_PRINT_INFO" },

1649

{0x1401d0, "FSCTL_NETWORK_GET_STATISTICS" },

1650

{0x1401d4, "FSCTL_LMR_START_SMBTRACE" },

1651

{0x1401d8, "FSCTL_LMR_END_SMBTRACE" },

1652

{0x1401dc, "FSCTL_LMR_START_RBR" },

1653

{0x1401e0, "FSCTL_NETWORK_SET_DOMAIN_NAME" },

1654

{0x1401e4, "FSCTL_LMR_SET_SERVER_GUID" },

1655

{0x1401e8, "FSCTL_LMR_QUERY_TARGET_INFO" },

1656

{0x1401ec, "FSCTL_LMR_QUERY_DEBUG_INFO" },

1657

{0x1401f4, "IOCTL_SMBMRX_ADDCONN" },

1658

{0x1401f8, "IOCTL_SMBMRX_DELCONN" },

1659

{0x140378, "IOCTL_UMRX_RELEASE_THREADS" },

1660

{0x14037e, "IOCTL_UMRX_GET_REQUEST" },

1661

{0x140382, "IOCTL_UMRX_RESPONSE_AND_REQUEST" },

1662

{0x140386, "IOCTL_UMRX_RESPONSE" },

1663

{0x140388, "IOCTL_UMRX_GET_LOCK_OWNER" },

1664

{0x14038c, "IOCTL_LMR_QUERY_REMOTE_SERVER_NAME" },

1665

{0x140390, "IOCTL_LMR_DISABLE_LOCAL_BUFFERING" },

1666

{0x140394, "IOCTL_UMRX_PREPARE_QUEUE" },

1667

{0x140397, "IOCTL_LMR_LWIO_POSTIO" },

1668

{0x14039b, "IOCTL_LMR_LWIO_PREIO" },

1669

{0x1403e8, "FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT" },

1670

{0x140fdb, "IOCTL_SHADOW_END_REINT" },

1671

{0x140fff, "IOCTL_GETSHADOW" },

1672

{0x2d0800, "IOCTL_STORAGE_CHECK_VERIFY2" },

1673

{0x2d080c, "IOCTL_STORAGE_LOAD_MEDIA2" },

1674

{0x2d0940, "IOCTL_STORAGE_EJECTION_CONTROL" },

1675

{0x2d0944, "IOCTL_STORAGE_MCN_CONTROL" },

1676

{0x2d0c00, "IOCTL_STORAGE_GET_MEDIA_TYPES" },

1677

{0x2d0c04, "IOCTL_STORAGE_GET_MEDIA_TYPES_EX" },

1678

{0x2d0c10, "IOCTL_STORAGE_GET_MEDIA_SERIAL_NUMBER" },

1679

{0x2d0c14, "IOCTL_STORAGE_GET_HOTPLUG_INFO" },

1680

{0x2d1080, "IOCTL_STORAGE_GET_DEVICE_NUMBER" },

1681

{0x2d1100, "IOCTL_STORAGE_PREDICT_FAILURE" },

1682

{0x2d1400, "IOCTL_STORAGE_QUERY_PROPERTY" },

1683

{0x2d4800, "IOCTL_STORAGE_CHECK_VERIFY" },

1684

{0x2d4804, "IOCTL_STORAGE_MEDIA_REMOVAL" },

1685

{0x2d4808, "IOCTL_STORAGE_EJECT_MEDIA" },

1686

{0x2d480c, "IOCTL_STORAGE_LOAD_MEDIA" },

1687

{0x2d4810, "IOCTL_STORAGE_RESERVE" },

1688

{0x2d4814, "IOCTL_STORAGE_RELEASE" },

1689

{0x2d4818, "IOCTL_STORAGE_FIND_NEW_DEVICES" },

1690

{0x2d5000, "IOCTL_STORAGE_RESET_BUS" },

1691

{0x2d5004, "IOCTL_STORAGE_RESET_DEVICE" },

1692

{0x2d5014, "IOCTL_STORAGE_BREAK_RESERVATION" },

1693

{0x2d5018, "IOCTL_STORAGE_PERSISTENT_RESERVE_IN" },

1694

{0x2d5140, "IOCTL_STORAGE_READ_CAPACITY" },

1695

{0x2d518c, "IOCTL_STORAGE_QUERY_DEPENDENT_DISK" },

1696

{0x2dcc18, "IOCTL_STORAGE_SET_HOTPLUG_INFO" },

1697

{0x2dd01c, "IOCTL_STORAGE_PERSISTENT_RESERVE_OUT" },

1698

{0x38a813, "IOCTL_CHANNEL_GET_SNDCHANNEL" },

1699

{0x4d0000, "IOCTL_MOUNTDEV_QUERY_UNIQUE_ID" },

1700

{0x4d0004, "IOCTL_MOUNTDEV_UNIQUE_ID_CHANGE_NOTIFY" },

1701

{0x4d0008, "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" },

1702

{0x4d000c, "IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME" },

1703

{0x4d0010, "IOCTL_MOUNTDEV_LINK_CREATED" },

1704

{0x4d0014, "IOCTL_MOUNTDEV_LINK_DELETED" },

1705

{0x530018, "IOCTL_VOLSNAP_QUERY_NAMES_OF_SNAPSHOTS" },

1706

{0x530024, "IOCTL_VOLSNAP_QUERY_DIFF_AREA" },

1707

{0x53002c, "IOCTL_VOLSNAP_QUERY_DIFF_AREA_SIZES" },

1708

{0x530034, "IOCTL_VOLSNAP_AUTO_CLEANUP" },

1709

{0x53003c, "IOCTL_VOLSNAP_QUERY_REVERT" },

1710

{0x530040, "IOCTL_VOLSNAP_REVERT_CLEANUP" },

1711

{0x530048, "IOCTL_VOLSNAP_QUERY_REVERT_PROGRESS" },

1712

{0x53004c, "IOCTL_VOLSNAP_CANCEL_REVERT" },

1713

{0x530050, "IOCTL_VOLSNAP_QUERY_EPIC" },

1714

{0x53005e, "IOCTL_VOLSNAP_QUERY_COPY_FREE_BITMAP" },

1715

{0x530190, "IOCTL_VOLSNAP_QUERY_ORIGINAL_VOLUME_NAME" },

1716

{0x53019c, "IOCTL_VOLSNAP_QUERY_CONFIG_INFO" },

1717

{0x5301a0, "IOCTL_VOLSNAP_HAS_CHANGED" },

1718

{0x5301a4, "IOCTL_VOLSNAP_SET_SNAPSHOT_PRIORITY" },

1719

{0x5301a8, "IOCTL_VOLSNAP_QUERY_SNAPSHOT_PRIORITY" },

1720

{0x5301ae, "IOCTL_VOLSNAP_QUERY_DELTA_BITMAP" },

1721

{0x5301b2, "IOCTL_VOLSNAP_QUERY_SNAPSHOT_SUPPLEMENTAL" },

1722

{0x5301b6, "IOCTL_VOLSNAP_QUERY_COPIED_BITMAP" },

1723

{0x5301b8, "IOCTL_VOLSNAP_QUERY_MOVE_LIST" },

1724

{0x5301be, "IOCTL_VOLSNAP_QUERY_PRE_COPIED_BITMAP" },

1725

{0x5301c2, "IOCTL_VOLSNAP_QUERY_USED_PRE_COPIED_BITMAP" },

1726

{0x5301c6, "IOCTL_VOLSNAP_QUERY_DEFRAG_PRE_COPIED_BITMAP" },

1727

{0x5301ca, "IOCTL_VOLSNAP_QUERY_FREESPACE_PRE_COPIED_BITMAP" },

1728

{0x5301ce, "IOCTL_VOLSNAP_QUERY_HOTBLOCKS_PRE_COPIED_BITMAP" },

1729

{0x5301d0, "IOCTL_VOLSNAP_QUERY_DIFF_AREA_FILE_SIZES" },

1730

{0x534054, "IOCTL_VOLSNAP_QUERY_OFFLINE" },

1731

{0x534058, "IOCTL_VOLSNAP_QUERY_DIFF_AREA_MINIMUM_SIZE" },

1732

{0x534064, "IOCTL_VOLSNAP_BLOCK_DELETE_IN_THE_MIDDLE" },

1733

{0x534070, "IOCTL_VOLSNAP_QUERY_APPLICATION_FLAGS" },

1734

{0x534080, "IOCTL_VOLSNAP_QUERY_PERFORMANCE_COUNTERS" },

1735

{0x534088, "IOCTL_VOLSNAP_QUERY_PRE_COPY_AMOUNTS" },

1736

{0x53408c, "IOCTL_VOLSNAP_QUERY_DEFAULT_PRE_COPY_AMOUNTS" },

1737

{0x53c000, "IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES" },

1738

{0x53c004, "IOCTL_VOLSNAP_RELEASE_WRITES" },

1739

{0x53c008, "IOCTL_VOLSNAP_PREPARE_FOR_SNAPSHOT" },

1740

{0x53c00c, "IOCTL_VOLSNAP_ABORT_PREPARED_SNAPSHOT" },

1741

{0x53c010, "IOCTL_VOLSNAP_COMMIT_SNAPSHOT" },

1742

{0x53c014, "IOCTL_VOLSNAP_END_COMMIT_SNAPSHOT" },

1743

{0x53c01c, "IOCTL_VOLSNAP_CLEAR_DIFF_AREA" },

1744

{0x53c020, "IOCTL_VOLSNAP_ADD_VOLUME_TO_DIFF_AREA" },

1745

{0x53c028, "IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE" },

1746

{0x53c030, "IOCTL_VOLSNAP_DELETE_OLDEST_SNAPSHOT" },

1747

{0x53c038, "IOCTL_VOLSNAP_DELETE_SNAPSHOT" },

1748

{0x53c044, "IOCTL_VOLSNAP_REVERT" },

1749

{0x53c068, "IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE_TEMP" },

1750

{0x53c06c, "IOCTL_VOLSNAP_SET_APPLICATION_FLAGS" },

1751

{0x53c07c, "IOCTL_VOLSNAP_SET_BC_FAILURE_MODE" },

1752

{0x53c084, "IOCTL_VOLSNAP_SET_PRE_COPY_AMOUNTS" },

1753

{0x53c090, "IOCTL_VOLSNAP_PRE_EXPOSE_DEVICES" },

1754

{0x53c198, "IOCTL_VOLSNAP_SET_APPLICATION_INFO" },

1755

{0x560000, "IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS" },

1756

{0x560038, "IOCTL_VOLUME_GET_GPT_ATTRIBUTES" },

1757

{0x700010, "IOCTL_DISK_QUERY_DEVICE_STATE" },

1758

{0x704008, "IOCTL_DISK_QUERY_DISK_SIGNATURE" },

1759

{ 0, NULL((void*)0) }

1760

};

1761

static value_string_ext ioctl_code_vals_ext = VALUE_STRING_EXT_INIT(ioctl_code_vals){ _try_val_to_str_ext_init, 0, (sizeof (ioctl_code_vals) / sizeof
((ioctl_code_vals)[0]))-1, ioctl_code_vals, "ioctl_code_vals"
, ((void*)0) };

1762

1763

1764

static const value_string sync_type_vals[] = {

1765

{ 0x0, "Other" },

1766

{ 0x1, "Create Section" },

1767

{ 0, NULL((void*)0) }

1768

};

1769

1770

static const value_string page_protection_vals[] = {

1771

{ 0x0, "None" },

1772

{ 0x01, "No Access" },

1773

{ 0x02, "Read Only" },

1774

{ 0x04, "Read/Write" },

1775

{ 0x08, "Write Copy" },

1776

{ 0x10, "Execute" },

1777

{ 0x20, "Execute Read" },

1778

{ 0x40, "Execute Read/Write" },

1779

{ 0x200, "No Cache" },

1780

{ 0, NULL((void*)0) }

1781

};

1782

1783

static const value_string file_information_class_vals[] = {

1784

{0, "Unknown"},

1785

{1, "File Directory Information"},

1786

{2, "File Full Directory Information"},

1787

{3, "File Both Directory Information"},

1788

{4, "File Basic Information"},

1789

{5, "File Standard Information"},

1790

{6, "File Internal Information"},

1791

{7, "File Ea Information"},

1792

{8, "File Access Information"},

1793

{9, "File Name Information"},

1794

{10, "File Rename Information"},

1795

{11, "File Link Information"},

1796

{12, "File Names Information"},

1797

{13, "File Disposition Information"},

1798

{14, "File Position Information"},

1799

{15, "File Full Ea Information"},

1800

{16, "File Mode Information"},

1801

{17, "File Alignment Information"},

1802

{18, "File All Information"},

1803

{19, "File Allocation Information"},

1804

{20, "File End Of File Information"},

1805

{21, "File Alternate Name Information"},

1806

{22, "File Stream Information"},

1807

{23, "File Pipe Information"},

1808

{24, "File Pipe Local Information"},

1809

{25, "File Pipe Remote Information"},

1810

{26, "File Mailslot Query Information"},

1811

{27, "File Mailslot Set Information"},

1812

{28, "File Compression Information"},

1813

{29, "File ObjectId Information"},

1814

{30, "File Completion Information"},

1815

{31, "File Move Cluster Information"},

1816

{32, "File Quota Information"},

1817

{33, "File Reparse Point Information"},

1818

{34, "File Network Open Information"},

1819

{35, "File Attribute Tag Information"},

1820

{36, "File Tracking Information"},

1821

{37, "File Id Both Directory Information"},

1822

{38, "File Id Full Directory Information"},

1823

{39, "File Valid Data Length Information"},

1824

{40, "File Short Name Information"},

1825

{41, "File Io Completion Notification Information"},

1826

{42, "File Io Status Block Range Information"},

1827

{43, "File Io Priority Hint Information"},

1828

{44, "File Sfio Reserve Information"},

1829

{45, "File Sfio Volume Information"},

1830

{46, "File Hard Link Information"},

1831

{47, "File Process Ids Using File Information"},

1832

{48, "File Normalized Name Information"},

1833

{49, "File Network Physical Name Information"},

1834

{50, "File Id Global Tx Directory Information"},

1835

{51, "File Is Remote Device Information"},

1836

{52, "File Unused Information"},

1837

{53, "File Numa Node Information"},

1838

{54, "File Standard Link Information"},

1839

{55, "File Remote Protocol Information"},

1840

{56, "File Rename Information Bypass Access Check"},

1841

{57, "File Link Information Bypass Access Check"},

1842

{58, "File Volume Name Information"},

1843

{59, "File Id Information"},

1844

{60, "File Id Extended Directory Information"},

1845

{61, "File Replace Completion Information"},

1846

{62, "File Hard Link Full Id Information"},

1847

{63, "File Id Extended Both Directory Information"},

1848

{64, "File Disposition Information Ex"},

1849

{65, "File Rename Information Ex"},

1850

{66, "File Rename Information Ex Bypass Access Check"},

1851

{67, "File Desired Storage Class Information"},

1852

{68, "File Stat Information"},

1853

{69, "File Memory Partition Information"},

1854

{70, "File Maximum Information"},

1855

{71, "SeShutdownPrivilege"},

1856

{72, "SeChangeNotifyPrivilege"},

1857

{73, "SeUndockPrivilege"},

1858

{74, "SeIncreaseWorkingSetPrivilege"},

1859

{75, "SeTimeZonePrivilege"},

1860

{ 0, NULL((void*)0) }

1861

};

1862

static value_string_ext file_information_class_vals_ext = VALUE_STRING_EXT_INIT(file_information_class_vals){ _try_val_to_str_ext_init, 0, (sizeof (file_information_class_vals
) / sizeof ((file_information_class_vals)[0]))-1, file_information_class_vals
, "file_information_class_vals", ((void*)0) };

1863

1864

1865

static bool_Bool dissect_procmon_filesystem_event(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, uint32_t operation, tvbuff_t* extra_details_tvb)

1866

{

1867

proto_tree* filesystem_tree;

1868

int offset = 0, extra_offset = 0;

1869

uint32_t sub_operation, ioctl_value = 0, file_information_class = 0;

1870

int size_of_pointer;

1871

bool_Bool is_path_ascii;

1872

uint16_t path_char_count;

1873

const value_string* sub_op_vals = NULL((void*)0);

1874

uint32_t file_system_access_mask_mapping[4] = {0x120089, 0x120116, 0x1200a0, 0x1f01ff};

1875

static const value_string file_system_access_mask_vals[] = {

1876

{0x1f01ff, "All Access"},

1877

{0x1201bf, "Generic Read/Write/Execute"},

1878

{0x12019f, "Generic Read/Write"},

1879

{0x1200a9, "Generic Read/Execute"},

1880

{0x1201b6, "Generic Write/Execute"},

1881

{0x120089, "Generic Read"},

1882

{0x120116, "Generic Write"},

1883

{0x1200a0, "Generic Execute"},

1884

{0x1, "Read Data/List Directory"},

1885

{0x2, "Write Data/Add File"},

1886

{0x4, "Append Data/Add Subdirectory/Create Pipe Instance"},

1887

{0x8, "Read EA"},

1888

{0x10, "Write EA"},

1889

{0x20, "Execute/Traverse"},

1890

{0x40, "Delete Child"},

1891

{0x80, "Read Attributes"},

1892

{0x100, "Write Attributes"},

1893

{0x10000, "Delete"},

1894

{0x20000, "Read Control"},

1895

{0x40000, "Write DAC"},

1896

{0x80000, "Write Owner"},

1897

{0x100000, "Synchronize"},

1898

{0x1000000, "Access System Security"},

1899

{0x2000000, "Maximum Allowed"},

1900

{ 0, NULL((void*)0) }

1901

};

1902

static const value_string file_system_io_flags_vals[] = {

1903

{0x10, "Buffered"},

1904

{0x1, "Non-cached"},

1905

{0x2, "Paging I/O"},

1906

{0x4, "Synchronous"},

1907

{0x40, "Synchronous Paging I/O"},

1908

{0x400000, "Write Through"},

1909

{ 0, NULL((void*)0) }

1910

};

1911

1912

if (pinfo->pseudo_header->procmon.system_bitness)

1913

{

1914

size_of_pointer = 8;

1915

}

1916

else

1917

{

1918

size_of_pointer = 4;

1919

}

1920

1921

filesystem_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_filesystem_event, NULL((void*)0), "File System Data");

1922

1923

/* Handle the cases where the Sub operation value string is based on the operation */

1924

sub_operation = tvb_get_uint8(tvb, offset);

1925

switch(operation)

1926

{

1927

case PROCMON_FILESYSTEM_OPERATION_QUERY_INFORMATION_FILE25:

1928

sub_op_vals = filesystem_operation_query_info_vals;

1929

break;

1930

case PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE26:

1931

sub_op_vals = filesystem_operation_set_info_vals;

1932

break;

1933

case PROCMON_FILESYSTEM_OPERATION_QUERY_VOLUME_INFORMATION30:

1934

sub_op_vals = filesystem_operation_query_volume_info_vals;

1935

break;

1936

case PROCMON_FILESYSTEM_OPERATION_SET_VOLUME_INFORMATION31:

1937

sub_op_vals = filesystem_operation_set_volume_info_vals;

1938

break;

1939

case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL32:

1940

sub_op_vals = filesystem_operation_directory_control_vals;

1941

break;

1942

case PROCMON_FILESYSTEM_OPERATION_PLUG_AND_PLAY47:

1943

sub_op_vals = filesystem_operation_pnp_vals;

1944

break;

1945

case PROCMON_FILESYSTEM_OPERATION_LOCK_UNLOCK_FILE37:

1946

sub_op_vals = filesystem_operation_lock_unlock_file_vals;

1947

break;

1948

}

1949

if (sub_op_vals != NULL((void*)0))

1950

{

1951

proto_tree_add_uint_format_value(filesystem_tree, hf_procmon_filesystem_suboperation, tvb, offset, 1, sub_operation, "%s (%u)",

1952

val_to_str_const(sub_operation, sub_op_vals, "Unknown"), sub_operation);

1953

}

1954

else

1955

{

1956

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_suboperation, tvb, offset, 1, ENC_LITTLE_ENDIAN0x80000000);

1957

}

1958

offset += 1;

1959

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, offset, 3, ENC_NA0x00000000);

1960

offset += 3;

1961

1962

switch(operation)

1963

{

1964

case PROCMON_FILESYSTEM_OPERATION_CREATE_FILE20:

1965

{

1966

static const value_string file_system_create_file_options_vals[] = {

1967

{0x1, "Directory"},

1968

{0x2, "Write Through"},

1969

{0x4, "Sequential Access"},

1970

{0x8, "No Buffering"},

1971

{0x10, "Synchronous IO Alert"},

1972

{0x20, "Synchronous IO Non-Alert"},

1973

{0x40, "Non-Directory File"},

1974

{0x80, "Create Tree Connection"},

1975

{0x100, "Complete If Oplocked"},

1976

{0x200, "No EA Knowledge"},

1977

{0x400, "Open for Recovery"},

1978

{0x800, "Random Access"},

1979

{0x1000, "Delete On Close"},

1980

{0x2000, "Open By ID"},

1981

{0x4000, "Open For Backup"},

1982

{0x8000, "No Compression"},

1983

{0x100000, "Reserve OpFilter"},

1984

{0x200000, "Open Reparse Point"},

1985

{0x400000, "Open No Recall"},

1986

{0x800000, "Open For Free Space Query"},

1987

{0x10000, "Open Requiring Oplock"},

1988

{0x20000, "Disallow Exclusive"},

1989

{ 0, NULL((void*)0) }

1990

};

1991

1992

static const value_string file_system_create_file_attribute_vals[] = {

1993

{0x1, "R"},

1994

{0x2, "H"},

1995

{0x4, "S"},

1996

{0x10, "D"},

1997

{0x20, "A"},

1998

{0x40, "D"},

1999

{0x80, "N"},

2000

{0x100, "T"},

2001

{0x200, "SF"},

2002

{0x400, "RP"},

2003

{0x800, "C"},

2004

{0x1000, "O"},

2005

{0x2000, "NCI"},

2006

{0x4000, "E"},

2007

{0x10000, "V"},

2008

{ 0, NULL((void*)0) }

2009

};

2010

2011

static const value_string file_system_create_file_shared_mode_vals[] = {

2012

{0x1, "Read"},

2013

{0x2, "Write"},

2014

{0x4, "Delete"},

2015

{ 0, NULL((void*)0) }

2016

};

2017

2018

int create_file_offset;

2019

if (size_of_pointer == 4)

2020

{

2021

create_file_offset = offset+16;

2022

}

2023

else

2024

{

2025

create_file_offset = offset+20; //Padding for 64-bit

2026

}

2027

2028

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_disposition, tvb, create_file_offset, 1, ENC_LITTLE_ENDIAN0x80000000);

2029

create_file_offset += 1;

2030

dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, create_file_offset, hf_procmon_filesystem_create_file_options, 3, NULL((void*)0), file_system_create_file_options_vals);

2031

create_file_offset += 3;

2032

2033

if (size_of_pointer == 8)

2034

create_file_offset += 4; //Padding for 64-bit

2035

2036

uint16_t attributes = tvb_get_letohs(tvb, create_file_offset);

2037

if (attributes == 0)

2038

{

2039

proto_tree_add_uint_format_value(filesystem_tree, hf_procmon_filesystem_create_file_attributes, tvb, create_file_offset, 2, attributes, "N/A");

2040

}

2041

else

2042

{

2043

dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, create_file_offset, hf_procmon_filesystem_create_file_attributes, 3, NULL((void*)0), file_system_create_file_attribute_vals);

2044

}

2045

create_file_offset += 2;

2046

dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, create_file_offset, hf_procmon_filesystem_create_file_share_mode, 2, NULL((void*)0), file_system_create_file_shared_mode_vals);

2047

create_file_offset += 2;

2048

2049

//Unknown fields

2050

create_file_offset += (4 + size_of_pointer*2);

2051

2052

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_allocation, tvb, create_file_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2053

/* create_file_offset += 4; */

2054

2055

if (tvb_reported_length(extra_details_tvb) > 0)

2056

{

2057

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_open_result, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2058

extra_offset += 4;

2059

}

2060

2061

break;

2062

}

2063

case PROCMON_FILESYSTEM_OPERATION_READ_FILE23:

2064

case PROCMON_FILESYSTEM_OPERATION_WRITE_FILE24:

2065

{

2066

int file_offset = offset;

2067

//Unknown fields

2068

file_offset += 4;

2069

2070

dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, file_offset, hf_procmon_filesystem_readwrite_file_io_flags, 4, NULL((void*)0), file_system_io_flags_vals);

2071

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_readwrite_file_priority, tvb, file_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2072

file_offset += 4;

2073

2074

//Unknown fields

2075

file_offset += 4;

2076

2077

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_readwrite_file_length, tvb, file_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2078

file_offset += 4;

2079

if (size_of_pointer == 8)

2080

file_offset += 4; //Padding for 64-bit

2081

2082

//Unknown fields

2083

file_offset += 4;

2084

if (size_of_pointer == 8)

2085

file_offset += 4; //Padding for 64-bit

2086

2087

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_readwrite_file_offset, tvb, file_offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2088

if (tvb_reported_length(extra_details_tvb) > 0)

2089

{

2090

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_readwrite_file_result_length, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2091

extra_offset += 4;

2092

}

2093

2094

break;

2095

}

2096

case PROCMON_FILESYSTEM_OPERATION_FILE_SYSTEM_CONTROL33:

2097

case PROCMON_FILESYSTEM_OPERATION_DEVICE_IO_CONTROL34:

2098

{

2099

int control_offset = offset;

2100

//Unknown fields

2101

control_offset += 8;

2102

2103

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_write_length, tvb, control_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2104

control_offset += 4;

2105

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_read_length, tvb, control_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2106

control_offset += 4;

2107

2108

if (size_of_pointer == 8)

2109

control_offset += 4; //Padding for 64-bit

2110

2111

//Unknown fields

2112

control_offset += 4;

2113

if (size_of_pointer == 8)

2114

control_offset += 4; //Padding for 64-bit

2115

2116

ioctl_value = tvb_get_letohl(tvb, control_offset);

2117

if (try_val_to_str_ext(ioctl_value, &ioctl_code_vals_ext) == NULL((void*)0))

2118

{

2119

proto_tree_add_uint_format_value(filesystem_tree, hf_procmon_filesystem_ioctl_ioctl, tvb, control_offset, 4, ioctl_value,

2120

"0x%08x (Device:0x%08x Function:%d Method: %d)", ioctl_value, ioctl_value >> 16, (ioctl_value >> 2) & 0xfff, ioctl_value & 3);

2121

}

2122

else

2123

{

2124

proto_tree_add_uint(filesystem_tree, hf_procmon_filesystem_ioctl_ioctl, tvb, control_offset, 4, ioctl_value);

2125

}

2126

/* control_offset += 4; */

2127

break;

2128

}

2129

case PROCMON_FILESYSTEM_OPERATION_CREATE_FILE_MAPPING19:

2130

{

2131

int mapping_offset = offset;

2132

//Unknown fields

2133

mapping_offset += 12;

2134

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_mapping_sync_type, tvb, mapping_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2135

mapping_offset += 4;

2136

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_create_file_mapping_page_protection, tvb, mapping_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2137

break;

2138

}

2139

case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL32:

2140

{

2141

int control_offset = offset;

2142

switch(sub_operation)

2143

{

2144

case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_QUERY0x01:

2145

//Unknown fields

2146

control_offset += 16;

2147

if (size_of_pointer == 8)

2148

control_offset += 4; //Padding for 64-bit

2149

//Unknown fields

2150

control_offset += 4;

2151

if (size_of_pointer == 8)

2152

control_offset += 4; //Padding for 64-bit

2153

2154

proto_tree_add_item_ret_uint(filesystem_tree, hf_procmon_filesystem_directory_control_file_information_class, tvb, control_offset, 4, ENC_LITTLE_ENDIAN0x80000000, &file_information_class);

2155

if (tvb_reported_length(extra_details_tvb) > 0)

2156

{

2157

uint32_t name_length, next_entry_offset;

2158

switch (file_information_class)

2159

{

2160

case 1: // File Directory Information

2161

case 2: // File Full Directory Information

2162

case 3: // File Both Directory Information

2163

case 12: // File Names Information

2164

case 37: // File Id Both Directory Information

2165

case 38: // File Id Full Directory Information

2166

do

2167

{

2168

int start_extra_offset = extra_offset;

2169

proto_item* information_item;

2170

proto_tree* information_tree = proto_tree_add_subtree(filesystem_tree, extra_details_tvb, extra_offset, 0, ett_procmon_filesystem_information, &information_item, "Information");

2171

2172

proto_tree_add_item_ret_uint(information_tree, hf_procmon_filesystem_directory_control_query_next_entry_offset, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000, &next_entry_offset);

2173

extra_offset += 4;

2174

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_file_index, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2175

extra_offset += 4;

2176

if (file_information_class == 12)

2177

{

2178

// File Names Information

2179

proto_tree_add_item_ret_uint(information_tree, hf_procmon_filesystem_directory_control_query_name_length, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000, &name_length);

2180

extra_offset += 4;

2181

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

2182

extra_offset += name_length;

2183

proto_item_set_len(information_item, extra_offset-start_extra_offset);

2184

if ((int)next_entry_offset > extra_offset - start_extra_offset)

2185

{

2186

uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset);

2187

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA0x00000000);

2188

extra_offset += next_extry_padding_length;

2189

}

2190

continue;

2191

}

2192

2193

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_creation_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

2194

extra_offset += 8;

2195

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_last_access_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

2196

extra_offset += 8;

2197

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_last_write_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

2198

extra_offset += 8;

2199

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_change_time, extra_details_tvb, extra_offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

2200

extra_offset += 8;

2201

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_end_of_file, extra_details_tvb, extra_offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2202

extra_offset += 8;

2203

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_allocation_size, extra_details_tvb, extra_offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2204

extra_offset += 8;

2205

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_file_attributes, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2206

extra_offset += 4;

2207

proto_tree_add_item_ret_uint(information_tree, hf_procmon_filesystem_directory_control_query_name_length, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000, &name_length);

2208

extra_offset += 4;

2209

if (file_information_class == 1)

2210

{

2211

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

2212

extra_offset += name_length;

2213

proto_item_set_len(information_item, extra_offset - start_extra_offset);

2214

if ((int)next_entry_offset > extra_offset - start_extra_offset)

2215

{

2216

uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset);

2217

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA0x00000000);

2218

extra_offset += next_extry_padding_length;

2219

}

2220

continue;

2221

}

2222

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_file_ea_size, extra_details_tvb, extra_offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2223

extra_offset += 4;

2224

if (file_information_class == 2)

2225

{

2226

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

2227

extra_offset += name_length;

2228

proto_item_set_len(information_item, extra_offset - start_extra_offset);

2229

if ((int)next_entry_offset > extra_offset - start_extra_offset)

2230

{

2231

uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset);

2232

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA0x00000000);

2233

extra_offset += next_extry_padding_length;

2234

}

2235

continue;

2236

}

2237

if (file_information_class == 38)

2238

{

2239

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_file_id, extra_details_tvb, extra_offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2240

extra_offset += 8;

2241

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

2242

extra_offset += name_length;

2243

proto_item_set_len(information_item, extra_offset - start_extra_offset);

2244

if ((int)next_entry_offset > extra_offset - start_extra_offset)

2245

{

2246

uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset);

2247

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA0x00000000);

2248

extra_offset += next_extry_padding_length;

2249

}

2250

continue;

2251

}

2252

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_short_name_length, extra_details_tvb, extra_offset, 1, ENC_LITTLE_ENDIAN0x80000000);

2253

extra_offset += 1;

2254

proto_tree_add_item(information_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, 1, ENC_NA0x00000000);

2255

extra_offset += 1;

2256

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_short_name, extra_details_tvb, extra_offset, 24, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

2257

extra_offset += 24;

2258

if (file_information_class == 3)

2259

{

2260

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

2261

extra_offset += name_length;

2262

proto_item_set_len(information_item, extra_offset - start_extra_offset);

2263

if ((int)next_entry_offset > extra_offset - start_extra_offset)

2264

{

2265

uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset);

2266

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA0x00000000);

2267

extra_offset += next_extry_padding_length;

2268

}

2269

continue;

2270

}

2271

proto_tree_add_item(information_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, 2, ENC_NA0x00000000);

2272

extra_offset += 2;

2273

proto_tree_add_item(information_tree, hf_procmon_filesystem_directory_control_query_name, extra_details_tvb, extra_offset, name_length, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000);

2274

extra_offset += name_length;

2275

proto_item_set_len(information_item, extra_offset - start_extra_offset);

2276

if ((int)next_entry_offset > extra_offset - start_extra_offset)

2277

{

2278

uint32_t next_extry_padding_length = next_entry_offset - (extra_offset - start_extra_offset);

2279

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, extra_details_tvb, extra_offset, next_extry_padding_length, ENC_NA0x00000000);

2280

extra_offset += next_extry_padding_length;

2281

}

2282

}

2283

while ((tvb_reported_length_remaining(extra_details_tvb, extra_offset) > 0) && (next_entry_offset != 0));

2284

break;

2285

}

2286

}

2287

break;

2288

case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_NOTIFY_CHANGE0x02:

2289

{

2290

static const value_string file_system_create_notify_change_flags_vals[] = {

2291

{0x1, "FILE_NOTIFY_CHANGE_FILE_NAME"},

2292

{0x2, "FILE_NOTIFY_CHANGE_DIR_NAME"},

2293

{0x3, "FILE_NOTIFY_CHANGE_NAME"},

2294

{0x4, "FILE_NOTIFY_CHANGE_ATTRIBUTES"},

2295

{0x8, "FILE_NOTIFY_CHANGE_SIZE"},

2296

{0x10, "FILE_NOTIFY_CHANGE_LAST_WRITE"},

2297

{0x20, "FILE_NOTIFY_CHANGE_LAST_ACCESS"},

2298

{0x40, "FILE_NOTIFY_CHANGE_CREATION"},

2299

{0x80, "FILE_NOTIFY_CHANGE_EA"},

2300

{0x100, "FILE_NOTIFY_CHANGE_SECURITY"},

2301

{0x200, "FILE_NOTIFY_CHANGE_STREAM_NAME"},

2302

{0x400, "FILE_NOTIFY_CHANGE_STREAM_SIZE"},

2303

{0x800, "FILE_NOTIFY_CHANGE_STREAM_WRITE"},

2304

{ 0, NULL((void*)0) }

2305

};

2306

2307

//Unknown fields

2308

control_offset += 16;

2309

if (size_of_pointer == 8)

2310

control_offset += 4; //Padding for 64-bit

2311

2312

dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, control_offset, hf_procmon_filesystem_directory_control_notify_change_flags, 4, NULL((void*)0), file_system_create_notify_change_flags_vals);

2313

break;

2314

}

2315

default:

2316

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_details, tvb, offset, 5 * size_of_pointer + 20, ENC_NA0x00000000);

2317

break;

2318

}

2319

break;

2320

}

2321

default:

2322

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_details, tvb, offset, 5 * size_of_pointer + 20, ENC_NA0x00000000);

2323

break;

2324

}

2325

offset += (5 * size_of_pointer + 20);

2326

2327

dissect_procmon_detail_string_info(tvb, filesystem_tree, offset,

2328

hf_procmon_filesystem_path_size, hf_procmon_filesystem_path_is_ascii, hf_procmon_filesystem_path_char_count, ett_procmon_filesystem_path,

2329

&is_path_ascii, &path_char_count);

2330

offset += 2;

2331

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, offset, 2, ENC_NA0x00000000);

2332

offset += 2;

2333

offset = dissect_procmon_detail_string(tvb, filesystem_tree, offset, is_path_ascii, path_char_count, hf_procmon_filesystem_path);

2334

2335

switch(operation)

2336

{

2337

case PROCMON_FILESYSTEM_OPERATION_CREATE_FILE20:

2338

{

2339

uint32_t sid_length;

2340

dissect_procmon_access_mask(tvb, pinfo, filesystem_tree, offset, hf_procmon_filesystem_create_file_access_mask, 4, file_system_access_mask_mapping, file_system_access_mask_vals);

2341

offset += 4;

2342

proto_tree_add_item_ret_uint(filesystem_tree, hf_procmon_filesystem_create_file_impersonating_sid_length, tvb, offset, 1, ENC_LITTLE_ENDIAN0x80000000, &sid_length);

2343

offset += 1;

2344

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, offset, 3, ENC_NA0x00000000);

2345

offset += 3;

2346

if (sid_length > 0)

2347

{

2348

uint32_t revision, count, value;

2349

uint64_t identifier_authority;

2350

int sid_offset = offset;

2351

proto_item* sid_item;

2352

wmem_strbuf_t* impersonating_strbuf = wmem_strbuf_new(pinfo->pool, "S-");

2353

proto_tree* impersonating_tree = proto_tree_add_subtree(filesystem_tree, tvb, sid_offset, sid_length, ett_procmon_filesystem_create_file_impersonating, &sid_item, "Impersonating SID");

2354

proto_tree_add_item_ret_uint(impersonating_tree, hf_procmon_filesystem_create_file_sid_revision, tvb, sid_offset, 1, ENC_LITTLE_ENDIAN0x80000000, &revision);

2355

sid_offset += 1;

2356

proto_tree_add_item_ret_uint(impersonating_tree, hf_procmon_filesystem_create_file_sid_count, tvb, sid_offset, 1, ENC_LITTLE_ENDIAN0x80000000, &count);

2357

sid_offset += 1;

2358

proto_tree_add_item_ret_uint64(impersonating_tree, hf_procmon_filesystem_create_file_sid_authority, tvb, sid_offset, 6, ENC_BIG_ENDIAN0x00000000, &identifier_authority);

2359

sid_offset += 6;

2360

wmem_strbuf_append_printf(impersonating_strbuf, "%u-%012" PRIx64"l" "x", revision, identifier_authority);

2361

for (uint32_t i = 0; i < count; i++)

2362

{

2363

proto_tree_add_item_ret_uint(impersonating_tree, hf_procmon_filesystem_create_file_sid_value, tvb, sid_offset, 4, ENC_LITTLE_ENDIAN0x80000000, &value);

2364

wmem_strbuf_append_printf(impersonating_strbuf, "-%08x", value);

2365

sid_offset += 4;

2366

}

2367

proto_item* sid_string_item = proto_tree_add_string(impersonating_tree, hf_procmon_filesystem_create_file_impersonating, tvb, offset, sid_offset - offset, wmem_strbuf_get_str(impersonating_strbuf));

2368

PROTO_ITEM_SET_GENERATED(sid_string_item)proto_item_set_generated((sid_string_item));

2369

proto_item_append_text(sid_item, " (%s)", wmem_strbuf_get_str(impersonating_strbuf));

2370

}

2371

break;

2372

}

2373

case PROCMON_FILESYSTEM_OPERATION_FILE_SYSTEM_CONTROL33:

2374

case PROCMON_FILESYSTEM_OPERATION_DEVICE_IO_CONTROL34:

2375

switch (ioctl_value)

2376

{

2377

case 0x94264: // FSCTL_OFFLOAD_READ

2378

offset += 8;

2379

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_offset, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2380

offset += 8;

2381

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_length, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2382

/* offset += 8; */

2383

break;

2384

case 0x98268: // FSCTL_OFFLOAD_WRITE

2385

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_offset, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2386

offset += 8;

2387

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_ioctl_length, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2388

/* offset += 8; */

2389

break;

2390

}

2391

break;

2392

2393

case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL32:

2394

{

2395

int control_offset = offset;

2396

switch (sub_operation)

2397

{

2398

case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_QUERY0x01:

2399

{

2400

dissect_procmon_detail_string_info(tvb, filesystem_tree, control_offset,

2401

hf_procmon_filesystem_directory_size, hf_procmon_filesystem_directory_is_ascii, hf_procmon_filesystem_directory_char_count, ett_procmon_filesystem_directory,

2402

&is_path_ascii, &path_char_count);

2403

control_offset += 2;

2404

/* control_offset = */ dissect_procmon_detail_string(tvb, filesystem_tree, control_offset, is_path_ascii, path_char_count, hf_procmon_filesystem_directory);

2405

break;

2406

}

2407

case PROCMON_FILESYSTEM_OPERATION_DIRECTORY_CONTROL_NOTIFY_CHANGE0x02:

2408

{

2409

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, control_offset, 2, ENC_NA0x00000000);

2410

/* control_offset += 2; */

2411

break;

2412

}

2413

}

2414

2415

2416

break;

2417

}

2418

case PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE26:

2419

switch (sub_operation)

2420

{

2421

case PROCMON_FILESYSTEM_OPERATION_SET_INFORMATION_FILE_DISPOSITION0x0D:

2422

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_set_info_file_disposition_delete, tvb, offset, 1, ENC_LITTLE_ENDIAN0x80000000);

2423

offset += 1;

2424

proto_tree_add_item(filesystem_tree, hf_procmon_filesystem_padding, tvb, offset, 3, ENC_NA0x00000000);

2425

/* offset += 3; */

2426

break;

2427

}

2428

break;

2429

2430

default:

2431

break;

2432

}

2433

2434

return (extra_offset > 0);

2435

}

2436

2437

#define PROCMON_PROFILING_OPERATION_THREAD0x0000 0x0000

2438

#define PROCMON_PROFILING_OPERATION_PROCESS0x0001 0x0001

2439

#define PROCMON_PROFILING_OPERATION_DEBUG_OUTPUT0x0002 0x0002

2440

2441

static const value_string profiling_operation_vals[] = {

2442

{ PROCMON_PROFILING_OPERATION_THREAD0x0000, "Thread" },

2443

{ PROCMON_PROFILING_OPERATION_PROCESS0x0001, "Process" },

2444

{ PROCMON_PROFILING_OPERATION_DEBUG_OUTPUT0x0002, "Debug Output" },

2445

{ 0, NULL((void*)0) }

2446

};

2447

2448

static bool_Bool dissect_procmon_profiling_event(tvbuff_t* tvb, packet_info* pinfo _U___attribute__((unused)), proto_tree* tree, uint32_t operation, tvbuff_t* extra_details_tvb _U___attribute__((unused)))

2449

{

2450

unsigned offset = 0;

2451

2452

proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_profiling_event, NULL((void*)0), "Profiling Data");

2453

2454

switch(operation)

2455

{

2456

case PROCMON_PROFILING_OPERATION_THREAD0x0000:

2457

case PROCMON_PROFILING_OPERATION_PROCESS0x0001:

2458

case PROCMON_PROFILING_OPERATION_DEBUG_OUTPUT0x0002:

2459

//Unknown

2460

break;

2461

default:

2462

break;

2463

}

2464

2465

return false0;

2466

}

2467

2468

#define PROCMON_NETWORK_OPERATION_UNKNOWN0x0000 0x0000

2469

#define PROCMON_NETWORK_OPERATION_OTHER0x0001 0x0001

2470

#define PROCMON_NETWORK_OPERATION_SEND0x0002 0x0002

2471

#define PROCMON_NETWORK_OPERATION_RECEIVE0x0003 0x0003

2472

#define PROCMON_NETWORK_OPERATION_ACCEPT0x0004 0x0004

2473

#define PROCMON_NETWORK_OPERATION_CONNECT0x0005 0x0005

2474

#define PROCMON_NETWORK_OPERATION_DISCONNECT0x0006 0x0006

2475

#define PROCMON_NETWORK_OPERATION_RECONNECT0x0007 0x0007

2476

#define PROCMON_NETWORK_OPERATION_RETRANSMIT0x0008 0x0008

2477

#define PROCMON_NETWORK_OPERATION_TCP_COPY0x0009 0x0009

2478

2479

static const value_string network_operation_vals[] = {

2480

{ PROCMON_NETWORK_OPERATION_UNKNOWN0x0000, "Unknown" },

2481

{ PROCMON_NETWORK_OPERATION_OTHER0x0001, "Other" },

2482

{ PROCMON_NETWORK_OPERATION_SEND0x0002, "Send" },

2483

{ PROCMON_NETWORK_OPERATION_RECEIVE0x0003, "Receive" },

2484

{ PROCMON_NETWORK_OPERATION_ACCEPT0x0004, "Accept" },

2485

{ PROCMON_NETWORK_OPERATION_CONNECT0x0005, "Connect" },

2486

{ PROCMON_NETWORK_OPERATION_DISCONNECT0x0006, "Disconnect" },

2487

{ PROCMON_NETWORK_OPERATION_RECONNECT0x0007, "Reconnect" },

2488

{ PROCMON_NETWORK_OPERATION_RETRANSMIT0x0008, "Retransmit" },

2489

{ PROCMON_NETWORK_OPERATION_TCP_COPY0x0009, "TCP Copy" },

2490

{ 0, NULL((void*)0) }

2491

};

2492

2493

static const true_false_string tfs_tcp_udp = { "TCP", "UDP" };

2494

2495

#define NETWORK_FLAG_IS_SRC_IPv4_MASK0x0001 0x0001

2496

#define NETWORK_FLAG_IS_DEST_IPv4_MASK0x0002 0x0002

2497

#define NETWORK_FLAG_IS_TCP_MASK0x0004 0x0004

2498

2499

static bool_Bool dissect_procmon_network_event(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, uint32_t operation _U___attribute__((unused)), tvbuff_t* extra_details_tvb _U___attribute__((unused)))

2500

{

2501

proto_tree* network_event_tree;

2502

unsigned offset = 0;

2503

uint16_t flags;

2504

int detail_offset;

2505

unsigned detail_length;

2506

const char* detail_substring;

2507

wmem_strbuf_t* details = wmem_strbuf_new(pinfo->pool, "");

2508

static int* const network_flags_vals[] = {

2509

&hf_procmon_network_flags_is_src_ipv4,

2510

&hf_procmon_network_flags_is_dst_ipv4,

2511

&hf_procmon_network_flags_tcp_udp,

2512

NULL((void*)0)

2513

};

2514

2515

network_event_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_procmon_network_event, NULL((void*)0), "Network Data");

2516

2517

proto_tree_add_bitmask_with_flags(network_event_tree, tvb, offset, hf_procmon_network_flags, ett_procmon_network_flags, network_flags_vals, ENC_LITTLE_ENDIAN0x80000000, BMT_NO_APPEND0x01);

2518

flags = tvb_get_letohs(tvb, offset);

2519

offset += 2;

2520

2521

//Unknown fields

2522

offset += 2;

2523

2524

proto_tree_add_item(network_event_tree, hf_procmon_network_length, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2525

offset += 4;

2526

if (flags & NETWORK_FLAG_IS_SRC_IPv4_MASK0x0001)

2527

{

2528

proto_tree_add_item(network_event_tree, hf_procmon_network_src_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);

2529

offset += 4;

2530

proto_tree_add_item(network_event_tree, hf_procmon_network_padding, tvb, offset, 12, ENC_NA0x00000000);

2531

offset += 12;

2532

}

2533

else

2534

{

2535

proto_tree_add_item(network_event_tree, hf_procmon_network_src_ipv6, tvb, offset, IPv6_ADDR_SIZE16, ENC_NA0x00000000);

2536

offset += IPv6_ADDR_SIZE16;

2537

}

2538

if (flags & NETWORK_FLAG_IS_DEST_IPv4_MASK0x0002)

2539

{

2540

proto_tree_add_item(network_event_tree, hf_procmon_network_dest_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN0x00000000);

2541

offset += 4;

2542

proto_tree_add_item(network_event_tree, hf_procmon_network_padding, tvb, offset, 12, ENC_NA0x00000000);

2543

offset += 12;

2544

}

2545

else

2546

{

2547

proto_tree_add_item(network_event_tree, hf_procmon_network_dest_ipv6, tvb, offset, IPv6_ADDR_SIZE16, ENC_NA0x00000000);

2548

offset += IPv6_ADDR_SIZE16;

2549

}

2550

proto_tree_add_item(network_event_tree, hf_procmon_network_src_port, tvb, offset, 2, ENC_LITTLE_ENDIAN0x80000000);

2551

offset += 2;

2552

proto_tree_add_item(network_event_tree, hf_procmon_network_dest_port, tvb, offset, 2, ENC_LITTLE_ENDIAN0x80000000);

2553

offset += 2;

2554

detail_offset = offset;

2555

while (((detail_substring = (char*)tvb_get_stringz_enc(pinfo->pool, tvb, offset, &detail_length, ENC_UTF_160x00000004 | ENC_LITTLE_ENDIAN0x80000000)) != NULL((void*)0)) && (strlen(detail_substring) > 0))

2556

{

2557

wmem_strbuf_append_printf(details, " %s", detail_substring);

2558

offset += detail_length;

2559

}

2560

//Include the NULL string at the end of the list

2561

offset += 2;

2562

proto_tree_add_string(network_event_tree, hf_procmon_network_details, tvb, detail_offset, offset-detail_offset, wmem_strbuf_get_str(details));

2563

2564

return false0;

2565

}

2566

2567

static procmon_process_t *get_procmon_process(packet_info *pinfo, uint32_t process_index)

2568

{

2569

if (process_index >= pinfo->pseudo_header->procmon.process_index_map_size)

2570

{

2571

return NULL((void*)0);

2572

}

2573

2574

uint32_t proc_array_idx = pinfo->pseudo_header->procmon.process_index_map[process_index];

2575

if (proc_array_idx >= pinfo->pseudo_header->procmon.process_array_size)

2576

{

2577

return NULL((void*)0);

2578

}

2579

2580

return &pinfo->pseudo_header->procmon.process_array[proc_array_idx];

2581

}

2582

2583

static int

2584

dissect_procmon_event(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U___attribute__((unused)))

2585

{

2586

proto_item *ti, *ti_event, *ti_operation;

2587

proto_tree *procmon_tree, *header_tree, *stack_trace_tree;

2588

int offset = 0;

2589

uint32_t event_class, operation;

2590

uint32_t details_size, extra_details_offset;

2591

uint16_t extra_details_size = 0;

2592

int hf_operation;

2593

const value_string* operation_vs = NULL((void*)0);

2594

bool_Bool handle_extra_details = false0;

2595

tvbuff_t *details_tvb, *extra_details_tvb;

2596

2597

col_set_str(pinfo->cinfo, COL_PROTOCOL, "MS Procmon");

2598

col_clear(pinfo->cinfo, COL_INFO);

2599

col_set_str(pinfo->cinfo, COL_INFO, "MS Procmon Event");

2600

2601

ti = proto_tree_add_item(tree, proto_procmon, tvb, 0, -1, ENC_NA0x00000000);

2602

procmon_tree = proto_item_add_subtree(ti, ett_procmon);

2603

2604

header_tree = proto_tree_add_subtree(procmon_tree, tvb, offset, 52, ett_procmon_header, NULL((void*)0), "Event Header");

2605

2606

uint32_t process_index = tvb_get_letohl(tvb, offset);

2607

procmon_process_t *proc = get_procmon_process(pinfo, process_index);

2608

if (proc) {

2609

proto_tree_add_uint(header_tree, hf_procmon_process_id, tvb, offset, 4, proc->process_id);

2610

proto_tree_add_string(header_tree, hf_procmon_process_name, tvb, offset, 4, proc->process_name);

2611

proto_tree_add_uint(header_tree, hf_procmon_process_parent_pid, tvb, offset, 4, proc->parent_process_id);

2612

procmon_process_t *parent_proc = get_procmon_process(pinfo, proc->parent_process_index);

2613

if (parent_proc) {

2614

proto_tree_add_string(header_tree, hf_procmon_process_parent_name, tvb, offset, 4, parent_proc->process_name);

2615

}

2616

proto_tree_add_string(header_tree, hf_procmon_process_image_path, tvb, offset, 4, proc->image_path);

2617

proto_tree_add_string(header_tree, hf_procmon_process_command_line, tvb, offset, 4, proc->command_line);

2618

proto_tree_add_string(header_tree, hf_procmon_process_user_name, tvb, offset, 4, proc->user_name);

2619

proto_tree_add_time(header_tree, hf_procmon_process_start_time, tvb, offset, 4, &proc->start_time);

2620

proto_tree_add_time(header_tree, hf_procmon_process_end_time, tvb, offset, 4, &proc->end_time);

2621

proto_tree_add_uint(header_tree, hf_procmon_process_session_number, tvb, offset, 4, proc->session_number);

2622

proto_tree_add_uint64(header_tree, hf_procmon_process_authentication_id, tvb, offset, 4, proc->authentication_id);

2623

proto_tree_add_string(header_tree, hf_procmon_process_integrity, tvb, offset, 4, proc->integrity);

2624

proto_tree_add_string(header_tree, hf_procmon_process_company, tvb, offset, 4, proc->company);

2625

proto_tree_add_string(header_tree, hf_procmon_process_version, tvb, offset, 4, proc->version);

2626

proto_tree_add_string(header_tree, hf_procmon_process_description, tvb, offset, 4, proc->description);

2627

proto_tree_add_boolean(header_tree, hf_procmon_process_is_virtualized, tvb, offset, 4, proc->is_virtualized);

2628

proto_tree_add_boolean(header_tree, hf_procmon_process_is_64_bit, tvb, offset, 4, proc->is_64_bit);

2629

pinfo->user_name = proc->user_name;

2630

col_clear(pinfo->cinfo, COL_INFO);

2631

col_add_fstr(pinfo->cinfo, COL_INFO, "%s ", proc->process_name);

2632

col_set_fence(pinfo->cinfo, COL_INFO);

2633

2634

if (proc->num_modules > 0) {

2635

for (uint32_t idx = 0; idx < proc->num_modules; idx++) {

2636

proto_tree *modules_tree = proto_tree_add_subtree_format(header_tree, tvb, offset, 4, ett_procmon_process_modules, NULL((void*)0), "Module %u: %s", idx + 1, proc->modules[idx].image_path);

2637

proto_tree_add_uint64(modules_tree, hf_procmon_module_base_address, tvb, offset, 4, proc->modules[idx].base_address);

2638

proto_tree_add_uint(modules_tree, hf_procmon_module_size, tvb, offset, 4, proc->modules[idx].size);

2639

proto_tree_add_string(modules_tree, hf_procmon_module_image_path, tvb, offset, 4, proc->modules[idx].image_path);

2640

proto_tree_add_string(modules_tree, hf_procmon_module_version, tvb, offset, 4, proc->modules[idx].version);

2641

proto_tree_add_string(modules_tree, hf_procmon_module_company, tvb, offset, 4, proc->modules[idx].company);

2642

proto_tree_add_string(modules_tree, hf_procmon_module_description, tvb, offset, 4, proc->modules[idx].description);

2643

// proto_tree_add_time(modules_tree, hf_procmon_module_timestamp, tvb, offset, 4, &proc->modules[idx].timestamp);

2644

}

2645

}

2646

} else {

2647

proto_item *index_item = proto_tree_add_item(header_tree, hf_procmon_process_index, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2648

expert_add_info_format(pinfo, index_item, &ei_procmon_unknown_index, "Unknown process index: %u", process_index);

2649

}

2650

2651

offset += 4;

2652

proto_tree_add_item(header_tree, hf_procmon_thread_id, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2653

offset += 4;

2654

ti_event = proto_tree_add_item_ret_uint(header_tree, hf_procmon_event_class, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &event_class);

2655

offset += 4;

2656

2657

switch (event_class)

2658

{

2659

case PROCMON_EVENT_CLASS_TYPE_PROCESS1:

2660

operation_vs = process_operation_vals;

2661

hf_operation = hf_procmon_process_operation;

2662

break;

2663

case PROCMON_EVENT_CLASS_TYPE_REGISTRY2:

2664

operation_vs = registry_operation_vals;

2665

hf_operation = hf_procmon_registry_operation;

2666

break;

2667

case PROCMON_EVENT_CLASS_TYPE_FILE_SYSTEM3:

2668

operation_vs = filesystem_operation_vals;

2669

hf_operation = hf_procmon_filesystem_operation;

2670

break;

2671

case PROCMON_EVENT_CLASS_TYPE_PROFILING4:

2672

operation_vs = profiling_operation_vals;

2673

hf_operation = hf_procmon_profiling_operation;

2674

break;

2675

case PROCMON_EVENT_CLASS_TYPE_NETWORK5:

2676

operation_vs = network_operation_vals;

2677

hf_operation = hf_procmon_network_operation;

2678

break;

2679

default:

2680

hf_operation = hf_procmon_operation_type;

2681

break;

2682

}

2683

ti_operation = proto_tree_add_item_ret_uint(header_tree, hf_operation, tvb, offset, 2, ENC_LITTLE_ENDIAN0x80000000, &operation);

2684

offset += 2;

2685

2686

if (operation_vs != NULL((void*)0))

2687

{

2688

const char* event_class_str = val_to_str_const(event_class, event_class_vals, "Unknown");

2689

const char* operation_str = try_val_to_str(operation, operation_vs);

2690

if (operation_str == NULL((void*)0))

2691

{

2692

expert_add_info_format(pinfo, ti_operation, &ei_procmon_unknown_operation, "Unknown %s operation: 0x%04x", event_class_str, operation);

2693

col_add_fstr(pinfo->cinfo, COL_INFO, "%s Operation: Unknown (0x%04x)", event_class_str, operation);

2694

}

2695

else

2696

{

2697

col_add_fstr(pinfo->cinfo, COL_INFO, "%s Operation: %s", event_class_str, operation_str);

2698

}

2699

}

2700

2701

//Next 6 bytes are unknown

2702

offset += 6;

2703

proto_tree_add_item(header_tree, hf_procmon_duration, tvb, offset, 8, ENC_LITTLE_ENDIAN0x80000000);

2704

offset += 8;

2705

proto_tree_add_item(header_tree, hf_procmon_timestamp, tvb, offset, 8, ENC_TIME_WINDOWS0x00000034|ENC_LITTLE_ENDIAN0x80000000);

2706

offset += 8;

2707

proto_tree_add_item(header_tree, hf_procmon_event_result, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000);

2708

offset += 4;

2709

proto_tree_add_item(header_tree, hf_procmon_stack_trace_depth, tvb, offset, 2, ENC_LITTLE_ENDIAN0x80000000);

2710

offset += 2;

2711

//Next 2 bytes are unknown

2712

offset += 2;

2713

proto_tree_add_item_ret_uint(header_tree, hf_procmon_details_size, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &details_size);

2714

offset += 4;

2715

proto_tree_add_item_ret_uint(header_tree, hf_procmon_extra_details_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN0x80000000, &extra_details_offset);

2716

offset += 4;

2717

2718

//Stack trace size part of the record

2719

#define PROCMON_MAX_STACK_TRACE_COUNT100 100 // Arbitrary.

2720

unsigned full_stack_trace_size = tvb_get_letohl(tvb, offset);

2721

int size_of_pointer = pinfo->pseudo_header->procmon.system_bitness ? 8 : 4;

2722

unsigned max_stack_trace_size = PROCMON_MAX_STACK_TRACE_COUNT100 * size_of_pointer;

2723

unsigned stack_trace_size = MIN(full_stack_trace_size, max_stack_trace_size)(((full_stack_trace_size) < (max_stack_trace_size)) ? (full_stack_trace_size
) : (max_stack_trace_size));

2724

2725

offset += 4;

2726

int stack_offset = offset;

2727

if (stack_trace_size > 0)

2728

{

2729

stack_trace_tree = proto_tree_add_subtree(procmon_tree, tvb, offset, stack_trace_size, ett_procmon_stack_trace, NULL((void*)0), "Stack Trace");

2730

for (uint32_t i = 0; i < stack_trace_size; i += size_of_pointer)

2731

{

2732

proto_tree_add_item(stack_trace_tree, hf_procmon_stack_trace_address, tvb, offset, size_of_pointer, ENC_LITTLE_ENDIAN0x80000000);

2733

offset += size_of_pointer;

2734

}

2735

}

2736

// XXX Add truncation / mismatched size expert item

2737

offset = stack_offset + full_stack_trace_size;

2738

2739

details_tvb = tvb_new_subset_length(tvb, offset, details_size);

2740

offset += details_size;

2741

if (extra_details_offset > 0)

2742

{

2743

extra_details_size = tvb_get_letohs(tvb, offset);

2744

offset += 2;

2745

}

2746

2747

extra_details_tvb = tvb_new_subset_length(tvb, offset, extra_details_size);

2748

switch(event_class)

2749

{

2750

case PROCMON_EVENT_CLASS_TYPE_PROCESS1:

2751

handle_extra_details = dissect_procmon_process_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb);

2752

break;

2753

case PROCMON_EVENT_CLASS_TYPE_REGISTRY2:

2754

handle_extra_details = dissect_procmon_registry_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb);

2755

break;

2756

case PROCMON_EVENT_CLASS_TYPE_FILE_SYSTEM3:

2757

handle_extra_details = dissect_procmon_filesystem_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb);

2758

break;

2759

case PROCMON_EVENT_CLASS_TYPE_PROFILING4:

2760

handle_extra_details = dissect_procmon_profiling_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb);

2761

break;

2762

case PROCMON_EVENT_CLASS_TYPE_NETWORK5:

2763

handle_extra_details = dissect_procmon_network_event(details_tvb, pinfo, procmon_tree, operation, extra_details_tvb);

2764

break;

2765

default:

2766

expert_add_info(pinfo, ti_event, &ei_procmon_unknown_event_class);

2767

proto_tree_add_item(procmon_tree, hf_procmon_detail_data, details_tvb, 0, details_size, ENC_NA0x00000000);

2768

break;

2769

}

2770

2771

if ((extra_details_size > 0) && (!handle_extra_details))

2772

{

2773

proto_tree_add_item(procmon_tree, hf_procmon_extra_detail_data, tvb, offset, extra_details_size, ENC_NA0x00000000);

2774

offset += extra_details_size;

2775

}

2776

2777

return offset;

2778

}

2779

2780

/*

2781

* Register the protocol with Wireshark.

2782

*/

2783

void

2784

event_register_procmon(void)

2785

{

2786

static hf_register_info hf[] = {

2787

{ &hf_procmon_process_index,

2788

{ "Process Index", "procmon.process_index",

2789

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2790

},

2791

{ &hf_procmon_process_id,

2792

{ "Process ID", "procmon.process.id",

2793

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2794

},

2795

{ &hf_procmon_process_name,

2796

{ "Process Name", "procmon.process.name",

2797

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2798

},

2799

{ &hf_procmon_process_parent_name,

2800

{ "Parent Process Name", "procmon.process.parent_name",

2801

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2802

},

2803

{ &hf_procmon_process_image_path,

2804

{ "Image Path", "procmon.process.image_path",

2805

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2806

},

2807

{ &hf_procmon_process_command_line,

2808

{ "Command Line", "procmon.process.command_line",

2809

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2810

},

2811

{ &hf_procmon_process_user_name,

2812

{ "User Name", "procmon.process.user_name",

2813

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2814

},

2815

{ &hf_procmon_process_start_time,

2816

{ "Process Start Time", "procmon.process.start_time",

2817

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2818

},

2819

{ &hf_procmon_process_end_time,

2820

{ "Process End Time", "procmon.process.end_time",

2821

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2822

},

2823

{ &hf_procmon_process_session_number,

2824

{ "Process Session Number", "procmon.process.session_number",

2825

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2826

},

2827

{ &hf_procmon_process_authentication_id,

2828

{ "Process Authentication ID", "procmon.process.authentication_id",

2829

FT_UINT64, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2830

},

2831

{ &hf_procmon_process_integrity,

2832

{ "Process Integrity", "procmon.process.integrity",

2833

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2834

},

2835

{ &hf_procmon_process_company,

2836

{ "Process Company", "procmon.process.company",

2837

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2838

},

2839

{ &hf_procmon_process_version,

2840

{ "Process Version", "procmon.process.version",

2841

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2842

},

2843

{ &hf_procmon_process_description,

2844

{ "Process Description", "procmon.process.description",

2845

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2846

},

2847

{ &hf_procmon_process_is_virtualized,

2848

{ "Process Is Virtualized", "procmon.process.is_virtualized",

2849

FT_BOOLEAN, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2850

},

2851

{ &hf_procmon_process_is_64_bit,

2852

{ "Process Is 64-bit", "procmon.process.is_64_bit",

2853

FT_BOOLEAN, BASE_NONE, TFS(&process_architecture_tfs)((0 ? (const struct true_false_string*)0 : ((&process_architecture_tfs
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2854

},

2855

{ &hf_procmon_module_base_address,

2856

{ "Module Base Address", "procmon.module.base_address",

2857

FT_UINT64, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2858

},

2859

{ &hf_procmon_module_size,

2860

{ "Module Size", "procmon.module.size",

2861

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2862

},

2863

{ &hf_procmon_module_image_path,

2864

{ "Module Image Path", "procmon.module.image_path",

2865

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2866

},

2867

{ &hf_procmon_module_version,

2868

{ "Module Version", "procmon.module.version",

2869

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2870

},

2871

{ &hf_procmon_module_company,

2872

{ "Module Company", "procmon.module.company",

2873

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2874

},

2875

{ &hf_procmon_module_description,

2876

{ "Module Description", "procmon.module.description",

2877

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2878

},

2879

{ &hf_procmon_module_timestamp,

2880

{ "Module Timestamp", "procmon.module.timestamp",

2881

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2882

},

2883

{ &hf_procmon_thread_id,

2884

{ "Thread ID", "procmon.thread_id",

2885

FT_UINT32, BASE_DEC_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2886

},

2887

{ &hf_procmon_event_class,

2888

{ "Event Class", "procmon.event_class",

2889

FT_UINT32, BASE_DEC, VALS(event_class_vals)((0 ? (const struct _value_string*)0 : ((event_class_vals)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

2890

},

2891

{ &hf_procmon_operation_type,

2892

{ "Operation Type", "procmon.operation_type",

2893

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2894

},

2895

{ &hf_procmon_duration,

2896

{ "Duration", "procmon.duration",

2897

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2898

},

2899

{ &hf_procmon_timestamp,

2900

{ "Timestamp", "procmon.timestamp",

2901

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2902

},

2903

{ &hf_procmon_event_result,

2904

{ "Event Result", "procmon.event_result",

2905

FT_UINT32, BASE_DEC_HEX, VALS(system_error_code_vals)((0 ? (const struct _value_string*)0 : ((system_error_code_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2906

},

2907

{ &hf_procmon_stack_trace_depth,

2908

{ "Stack Trace Depth", "procmon.stack_trace_depth",

2909

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2910

},

2911

{ &hf_procmon_details_size,

2912

{ "Details Size", "procmon.details_size",

2913

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2914

},

2915

{ &hf_procmon_extra_details_offset,

2916

{ "Extra Details Offset", "procmon.extra_details_offset",

2917

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2918

},

2919

{ &hf_procmon_stack_trace_address,

2920

{ "Stack trace address", "procmon.stack_trace_address",

2921

FT_UINT64, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2922

},

2923

{ &hf_procmon_detail_data,

2924

{ "Detail Data", "procmon.detail_data",

2925

FT_BYTES, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2926

},

2927

{ &hf_procmon_extra_detail_data,

2928

{ "Extra detail data", "procmon.extra_detail_data",

2929

FT_BYTES, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2930

},

2931

{ &hf_procmon_process_operation,

2932

{ "Operation Type", "procmon.process.operation_type",

2933

FT_UINT16, BASE_DEC, VALS(process_operation_vals)((0 ? (const struct _value_string*)0 : ((process_operation_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

2934

},

2935

{ &hf_procmon_process_pid,

2936

{ "PID", "procmon.process.pid",

2937

FT_UINT32, BASE_DEC_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2938

},

2939

{ &hf_procmon_process_path,

2940

{ "Path", "procmon.process.path",

2941

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2942

},

2943

{ &hf_procmon_process_path_size,

2944

{ "Path Size", "procmon.process.path.size",

2945

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2946

},

2947

{ &hf_procmon_process_path_is_ascii,

2948

{ "Is ASCII", "procmon.process.path.is_ascii",

2949

FT_BOOLEAN, 16, NULL((void*)0), STRING_IS_ASCII_MASK0x8000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2950

},

2951

{ &hf_procmon_process_path_char_count,

2952

{ "Char Count", "procmon.process.path.char_count",

2953

FT_UINT16, BASE_DEC, NULL((void*)0), STRING_CHAR_COUNT_MASK0x7FFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2954

},

2955

{ &hf_procmon_process_commandline,

2956

{ "Commandline", "procmon.process.commandline",

2957

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2958

},

2959

{ &hf_procmon_process_commandline_size,

2960

{ "Commandline Size", "procmon.process.commandline.size",

2961

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2962

},

2963

{ &hf_procmon_process_commandline_is_ascii,

2964

{ "Is ASCII", "procmon.process.commandline.is_ascii",

2965

FT_BOOLEAN, 16, NULL((void*)0), STRING_IS_ASCII_MASK0x8000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2966

},

2967

{ &hf_procmon_process_commandline_char_count,

2968

{ "Char Count", "procmon.process.commandline.char_count",

2969

FT_UINT16, BASE_DEC, NULL((void*)0), STRING_CHAR_COUNT_MASK0x7FFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2970

},

2971

{ &hf_procmon_process_exit_status,

2972

{ "Exit Status", "procmon.process.exit_status",

2973

FT_UINT32, BASE_DEC_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2974

},

2975

{ &hf_procmon_process_kernel_time,

2976

{ "Kernel time", "procmon.process.kernel_time",

2977

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2978

},

2979

{ &hf_procmon_process_user_time,

2980

{ "User time", "procmon.process.user_time",

2981

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2982

},

2983

{ &hf_procmon_process_working_set,

2984

{ "Working Set", "procmon.process.working_set",

2985

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2986

},

2987

{ &hf_procmon_process_peak_working_set,

2988

{ "Peak Working Set", "procmon.process.peak_working_set",

2989

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2990

},

2991

{ &hf_procmon_process_private_bytes,

2992

{ "Private Bytes", "procmon.process.private_bytes",

2993

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2994

},

2995

{ &hf_procmon_process_peak_private_bytes,

2996

{ "Peak Private Bytes", "procmon.process.peak_private_bytes",

2997

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

2998

},

2999

{ &hf_procmon_process_thread_id,

3000

{ "Thread ID", "procmon.process.thread_id",

3001

FT_UINT32, BASE_DEC_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3002

},

3003

{ &hf_procmon_process_image_base,

3004

{ "Image Base", "procmon.process.image_base",

3005

FT_UINT64, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3006

},

3007

{ &hf_procmon_process_image_size,

3008

{ "Image Size", "procmon.process.image_size",

3009

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3010

},

3011

{ &hf_procmon_process_parent_pid,

3012

{ "Parent PID", "procmon.process.parent_pid",

3013

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3014

},

3015

{ &hf_procmon_process_curdir,

3016

{ "Current Directory", "procmon.process.curdir",

3017

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3018

},

3019

{ &hf_procmon_process_curdir_size,

3020

{ "Current Directory Size", "procmon.process.curdir.size",

3021

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3022

},

3023

{ &hf_procmon_process_curdir_is_ascii,

3024

{ "Is ASCII", "procmon.process.curdir.is_ascii",

3025

FT_BOOLEAN, 16, NULL((void*)0), STRING_IS_ASCII_MASK0x8000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3026

},

3027

{ &hf_procmon_process_curdir_char_count,

3028

{ "Char Count", "procmon.process.curdir.char_count",

3029

FT_UINT16, BASE_DEC, NULL((void*)0), STRING_CHAR_COUNT_MASK0x7FFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3030

},

3031

{ &hf_procmon_process_environment_char_count,

3032

{ "Environment Size", "procmon.process.environment.char_count",

3033

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3034

},

3035

{ &hf_procmon_process_environment,

3036

{ "Environment", "procmon.process.environment",

3037

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3038

},

3039

{ &hf_procmon_registry_operation,

3040

{ "Operation Type", "procmon.registry.operation_type",

3041

FT_UINT16, BASE_DEC, VALS(registry_operation_vals)((0 ? (const struct _value_string*)0 : ((registry_operation_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3042

},

3043

{ &hf_procmon_registry_desired_access,

3044

{ "Desired Access", "procmon.registry.desired_access",

3045

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3046

},

3047

{ &hf_procmon_registry_granted_access,

3048

{ "Granted Access", "procmon.registry.granted_access",

3049

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3050

},

3051

{ &hf_procmon_registry_disposition,

3052

{ "Disposition", "procmon.registry.disposition",

3053

FT_UINT32, BASE_DEC, VALS(registry_disposition_vals)((0 ? (const struct _value_string*)0 : ((registry_disposition_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3054

},

3055

{ &hf_procmon_registry_key,

3056

{ "Key", "procmon.registry.key",

3057

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3058

},

3059

{ &hf_procmon_registry_key_size,

3060

{ "Key Size", "procmon.registry.key.size",

3061

FT_UINT16, BASE_DEC_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3062

},

3063

{ &hf_procmon_registry_key_is_ascii,

3064

{ "Is ASCII", "procmon.registry.key.is_ascii",

3065

FT_BOOLEAN, 16, NULL((void*)0), STRING_IS_ASCII_MASK0x8000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3066

},

3067

{ &hf_procmon_registry_key_char_count,

3068

{ "Char Count", "procmon.registry.key.char_count",

3069

FT_UINT16, BASE_DEC, NULL((void*)0), STRING_CHAR_COUNT_MASK0x7FFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3070

},

3071

{ &hf_procmon_registry_new_key,

3072

{ "New Key", "procmon.registry.new_key",

3073

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3074

},

3075

{ &hf_procmon_registry_new_key_size,

3076

{ "New Key Size", "procmon.registry.new_key.size",

3077

FT_UINT16, BASE_DEC_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3078

},

3079

{ &hf_procmon_registry_new_key_is_ascii,

3080

{ "Is ASCII", "procmon.registry.new_key.is_ascii",

3081

FT_BOOLEAN, 16, NULL((void*)0), STRING_IS_ASCII_MASK0x8000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3082

},

3083

{ &hf_procmon_registry_new_key_char_count,

3084

{ "Char Count", "procmon.registry.new_key.char_count",

3085

FT_UINT16, BASE_DEC, NULL((void*)0), STRING_CHAR_COUNT_MASK0x7FFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3086

},

3087

{ &hf_procmon_registry_value,

3088

{ "Value", "procmon.registry.value",

3089

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3090

},

3091

{ &hf_procmon_registry_value_size,

3092

{ "Value Size", "procmon.registry.value.size",

3093

FT_UINT16, BASE_DEC_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3094

},

3095

{ &hf_procmon_registry_value_is_ascii,

3096

{ "Is ASCII", "procmon.registry.value.is_ascii",

3097

FT_BOOLEAN, 16, NULL((void*)0), STRING_IS_ASCII_MASK0x8000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3098

},

3099

{ &hf_procmon_registry_value_char_count,

3100

{ "Char Count", "procmon.registry.value.char_count",

3101

FT_UINT16, BASE_DEC, NULL((void*)0), STRING_CHAR_COUNT_MASK0x7FFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3102

},

3103

{ &hf_procmon_registry_length,

3104

{ "Length", "procmon.registry.length",

3105

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3106

},

3107

{ &hf_procmon_registry_key_information_class,

3108

{ "Information Class", "procmon.registry.key.information_class",

3109

FT_UINT32, BASE_DEC, VALS(registry_key_information_class_vals)((0 ? (const struct _value_string*)0 : ((registry_key_information_class_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3110

},

3111

{ &hf_procmon_registry_key_set_information_class,

3112

{ "Information Class", "procmon.registry.key.set_information_class",

3113

FT_UINT32, BASE_DEC, VALS(registry_value_set_information_class_vals)((0 ? (const struct _value_string*)0 : ((registry_value_set_information_class_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3114

},

3115

{ &hf_procmon_registry_value_information_class,

3116

{ "Information Class", "procmon.registry.value.information_class",

3117

FT_UINT32, BASE_DEC, VALS(registry_value_information_class_vals)((0 ? (const struct _value_string*)0 : ((registry_value_information_class_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3118

},

3119

{ &hf_procmon_registry_index,

3120

{ "Index", "procmon.registry.index",

3121

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3122

},

3123

{ &hf_procmon_registry_type,

3124

{ "Type", "procmon.registry.type",

3125

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3126

},

3127

{ &hf_procmon_registry_data_length,

3128

{ "Data Length", "procmon.registry.data_length",

3129

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3130

},

3131

{ &hf_procmon_registry_key_name_size,

3132

{ "Name Size", "procmon.registry.key.name_size",

3133

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3134

},

3135

{ &hf_procmon_registry_key_name,

3136

{ "Name", "procmon.registry.key.name",

3137

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3138

},

3139

{ &hf_procmon_registry_key_handle_tags,

3140

{ "Handle Tags", "procmon.registry.key.handle_tags",

3141

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3142

},

3143

{ &hf_procmon_registry_key_flags,

3144

{ "Flags", "procmon.registry.key.flags",

3145

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3146

},

3147

{ &hf_procmon_registry_key_last_write_time,

3148

{ "Last Write Time", "procmon.registry.key.last_write_time",

3149

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3150

},

3151

{ &hf_procmon_registry_key_title_index,

3152

{ "Title Index", "procmon.registry.key.title_index",

3153

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3154

},

3155

{ &hf_procmon_registry_key_subkeys,

3156

{ "Subkeys", "procmon.registry.key.subkeys",

3157

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3158

},

3159

{ &hf_procmon_registry_key_max_name_len,

3160

{ "Max Name Length", "procmon.registry.key.max_name_len",

3161

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3162

},

3163

{ &hf_procmon_registry_key_values,

3164

{ "Values", "procmon.registry.key.values",

3165

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3166

},

3167

{ &hf_procmon_registry_key_max_value_name_len,

3168

{ "Max Value Name Length", "procmon.registry.key.max_value_name_len",

3169

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3170

},

3171

{ &hf_procmon_registry_key_max_value_data_len,

3172

{ "Max Value Data Length", "procmon.registry.key.max_value_data_len",

3173

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3174

},

3175

{ &hf_procmon_registry_key_class_offset,

3176

{ "Class Offset", "procmon.registry.key.class_offset",

3177

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3178

},

3179

{ &hf_procmon_registry_key_class_length,

3180

{ "Class Length", "procmon.registry.key.class_length",

3181

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3182

},

3183

{ &hf_procmon_registry_key_max_class_len,

3184

{ "Max Class Length", "procmon.registry.key.max_class_len",

3185

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3186

},

3187

{ &hf_procmon_registry_value_reg_type,

3188

{ "Registry Type", "procmon.registry.value.reg_type",

3189

FT_UINT32, BASE_DEC, VALS(registry_value_reg_type_vals)((0 ? (const struct _value_string*)0 : ((registry_value_reg_type_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3190

},

3191

{ &hf_procmon_registry_value_offset_to_data,

3192

{ "Offset to Data", "procmon.registry.value.offset_to_data",

3193

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3194

},

3195

{ &hf_procmon_registry_value_length,

3196

{ "Length", "procmon.registry.value.length",

3197

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3198

},

3199

{ &hf_procmon_registry_value_name_size,

3200

{ "Name Size", "procmon.registry.value.name_size",

3201

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3202

},

3203

{ &hf_procmon_registry_value_name,

3204

{ "Name", "procmon.registry.value.name",

3205

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3206

},

3207

{ &hf_procmon_registry_value_dword,

3208

{ "DWORD", "procmon.registry.value.dword",

3209

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3210

},

3211

{ &hf_procmon_registry_value_qword,

3212

{ "QWORD", "procmon.registry.value.qword",

3213

FT_UINT64, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3214

},

3215

{ &hf_procmon_registry_value_sz,

3216

{ "SZ", "procmon.registry.value.sz",

3217

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3218

},

3219

{ &hf_procmon_registry_value_binary,

3220

{ "Binary", "procmon.registry.value.binary",

3221

FT_BYTES, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3222

},

3223

{ &hf_procmon_registry_value_multi_sz,

3224

{ "MultiSZ", "procmon.registry.value.multi_sz",

3225

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3226

},

3227

{ &hf_procmon_registry_key_set_information_write_time,

3228

{ "Last Write Time", "procmon.registry.key.set_information.write_time",

3229

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3230

},

3231

{ &hf_procmon_registry_key_set_information_wow64_flags,

3232

{ "WOW64 Flags", "procmon.registry.key.set_information.wow64_flags",

3233

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3234

},

3235

{ &hf_procmon_registry_key_set_information_handle_tags,

3236

{ "Handle Tags", "procmon.registry.key.set_information.handle_tags",

3237

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3238

},

3239

{ &hf_procmon_filesystem_operation,

3240

{ "Operation Type", "procmon.filesystem.operation_type",

3241

FT_UINT16, BASE_DEC, VALS(filesystem_operation_vals)((0 ? (const struct _value_string*)0 : ((filesystem_operation_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3242

},

3243

{ &hf_procmon_filesystem_suboperation,

3244

{ "Suboperation", "procmon.filesystem.suboperation",

3245

FT_UINT8, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3246

},

3247

{ &hf_procmon_filesystem_padding,

3248

{ "Padding", "procmon.filesystem.padding",

3249

FT_BYTES, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3250

},

3251

{ &hf_procmon_filesystem_details,

3252

{ "Details", "procmon.filesystem.details",

3253

FT_BYTES, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3254

},

3255

{ &hf_procmon_filesystem_path,

3256

{ "Path", "procmon.filesystem.path",

3257

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3258

},

3259

{ &hf_procmon_filesystem_path_size,

3260

{ "Path Size", "procmon.filesystem.path.size",

3261

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3262

},

3263

{ &hf_procmon_filesystem_path_is_ascii,

3264

{ "Is ASCII", "procmon.filesystem.path.is_ascii",

3265

FT_BOOLEAN, 16, NULL((void*)0), STRING_IS_ASCII_MASK0x8000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3266

},

3267

{ &hf_procmon_filesystem_path_char_count,

3268

{ "Char Count", "procmon.filesystem.path.char_count",

3269

FT_UINT16, BASE_DEC, NULL((void*)0), STRING_CHAR_COUNT_MASK0x7FFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3270

},

3271

{ &hf_procmon_filesystem_create_file_access_mask,

3272

{ "File Access Mask", "procmon.filesystem.create_file.access_mask",

3273

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3274

},

3275

{ &hf_procmon_filesystem_create_file_impersonating_sid_length,

3276

{ "Impersonating SID Length", "procmon.filesystem.create_file.impersonating_sid_length",

3277

FT_UINT8, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3278

},

3279

{ &hf_procmon_filesystem_create_file_impersonating,

3280

{ "Impersonating", "procmon.filesystem.create_file.impersonating",

3281

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3282

},

3283

{ &hf_procmon_filesystem_create_file_disposition,

3284

{ "Disposition", "procmon.filesystem.create_file.disposition",

3285

FT_UINT8, BASE_DEC, VALS(filesystem_disposition_vals)((0 ? (const struct _value_string*)0 : ((filesystem_disposition_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3286

},

3287

{ &hf_procmon_filesystem_create_file_options,

3288

{ "Options", "procmon.filesystem.create_file.options",

3289

FT_UINT24, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3290

},

3291

{ &hf_procmon_filesystem_create_file_attributes,

3292

{ "Attributes", "procmon.filesystem.create_file.attributes",

3293

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3294

},

3295

{ &hf_procmon_filesystem_create_file_share_mode,

3296

{ "Share Mode", "procmon.filesystem.create_file.share_mode",

3297

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3298

},

3299

{ &hf_procmon_filesystem_create_file_allocation,

3300

{ "Allocation", "procmon.filesystem.create_file.allocation",

3301

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3302

},

3303

{ &hf_procmon_filesystem_create_file_sid_revision,

3304

{ "Revision", "procmon.filesystem.create_file.sid.revision",

3305

FT_UINT8, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3306

},

3307

{ &hf_procmon_filesystem_create_file_sid_count,

3308

{ "Count", "procmon.filesystem.create_file.sid.count",

3309

FT_UINT8, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3310

},

3311

{ &hf_procmon_filesystem_create_file_sid_authority,

3312

{ "Authority", "procmon.filesystem.create_file.sid.authority",

3313

FT_UINT48, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3314

},

3315

{ &hf_procmon_filesystem_create_file_sid_value,

3316

{ "Value", "procmon.filesystem.create_file.sid.value",

3317

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3318

},

3319

{ &hf_procmon_filesystem_create_file_open_result,

3320

{ "Open Result", "procmon.filesystem.create_file.open_result",

3321

FT_UINT32, BASE_DEC, VALS(filesystem_open_result_vals)((0 ? (const struct _value_string*)0 : ((filesystem_open_result_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3322

},

3323

{ &hf_procmon_filesystem_readwrite_file_io_flags,

3324

{ "IO Flags", "procmon.filesystem.readwrite_file.io_flags",

3325

FT_UINT32, BASE_HEX, NULL((void*)0), 0x00EFFFFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3326

},

3327

{ &hf_procmon_filesystem_readwrite_file_priority,

3328

{ "Priority", "procmon.filesystem.readwrite_file.priority",

3329

FT_UINT32, BASE_HEX, VALS(filesystem_readwrite_priority_vals)((0 ? (const struct _value_string*)0 : ((filesystem_readwrite_priority_vals
)))), 0x00E00000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3330

},

3331

{ &hf_procmon_filesystem_readwrite_file_length,

3332

{ "Length", "procmon.filesystem.readwrite_file.length",

3333

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3334

},

3335

{ &hf_procmon_filesystem_readwrite_file_offset,

3336

{ "Offset", "procmon.filesystem.readwrite_file.file_offset",

3337

FT_INT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3338

},

3339

{ &hf_procmon_filesystem_readwrite_file_result_length,

3340

{ "Result Length", "procmon.filesystem.readwrite_file.result_length",

3341

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3342

},

3343

{ &hf_procmon_filesystem_ioctl_write_length,

3344

{ "Write Length", "procmon.filesystem.ioctl.write_length",

3345

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3346

},

3347

{ &hf_procmon_filesystem_ioctl_read_length,

3348

{ "Read Length", "procmon.filesystem.ioctl.read_length",

3349

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3350

},

3351

{ &hf_procmon_filesystem_ioctl_ioctl,

3352

{ "ioctl", "procmon.filesystem.ioctl.ioctl",

3353

FT_UINT32, BASE_DEC|BASE_EXT_STRING0x00000200, &ioctl_code_vals_ext, 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3354

},

3355

{ &hf_procmon_filesystem_ioctl_offset,

3356

{ "Offset", "procmon.filesystem.ioctl.offset",

3357

FT_INT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3358

},

3359

{ &hf_procmon_filesystem_ioctl_length,

3360

{ "Length", "procmon.filesystem.ioctl.length",

3361

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3362

},

3363

{ &hf_procmon_filesystem_create_file_mapping_sync_type,

3364

{ "Sync Type", "procmon.filesystem.create_file_mapping.sync_type",

3365

FT_UINT32, BASE_HEX, VALS(sync_type_vals)((0 ? (const struct _value_string*)0 : ((sync_type_vals)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3366

},

3367

{ &hf_procmon_filesystem_create_file_mapping_page_protection,

3368

{ "Page Protection", "procmon.filesystem.create_file_mapping.page_protection",

3369

FT_UINT32, BASE_HEX, VALS(page_protection_vals)((0 ? (const struct _value_string*)0 : ((page_protection_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3370

},

3371

{ &hf_procmon_filesystem_directory,

3372

{ "Directory", "procmon.filesystem.directory",

3373

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3374

},

3375

{ &hf_procmon_filesystem_directory_size,

3376

{ "Directory Size", "procmon.filesystem.directory.size",

3377

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3378

},

3379

{ &hf_procmon_filesystem_directory_is_ascii,

3380

{ "Is ASCII", "procmon.filesystem.directory.is_ascii",

3381

FT_BOOLEAN, 16, NULL((void*)0), STRING_IS_ASCII_MASK0x8000, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3382

},

3383

{ &hf_procmon_filesystem_directory_char_count,

3384

{ "Char Count", "procmon.filesystem.directory.char_count",

3385

FT_UINT16, BASE_DEC, NULL((void*)0), STRING_CHAR_COUNT_MASK0x7FFF, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3386

},

3387

{ &hf_procmon_filesystem_directory_control_file_information_class,

3388

{ "File Information Class", "procmon.filesystem.directory_control.file_information_class",

3389

FT_UINT32, BASE_DEC|BASE_EXT_STRING0x00000200, &file_information_class_vals_ext, 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3390

},

3391

{ &hf_procmon_filesystem_directory_control_notify_change_flags,

3392

{ "Notify Change Flags", "procmon.filesystem.directory_control.notify_change_flags",

3393

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3394

},

3395

{ &hf_procmon_filesystem_set_info_file_disposition_delete,

3396

{ "Disposition Delete", "procmon.filesystem.set_info_file.disposition.delete",

3397

FT_UINT8, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3398

},

3399

{ &hf_procmon_filesystem_directory_control_query_next_entry_offset,

3400

{ "Next Entry Offset", "procmon.filesystem.directory_control.query.next_entry_offset",

3401

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3402

},

3403

{ &hf_procmon_filesystem_directory_control_query_file_index,

3404

{ "File Index", "procmon.filesystem.directory_control.query.file_index",

3405

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3406

},

3407

{ &hf_procmon_filesystem_directory_control_query_name_length,

3408

{ "Query Name Length", "procmon.filesystem.directory_control.query.name_length",

3409

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3410

},

3411

{ &hf_procmon_filesystem_directory_control_query_name,

3412

{ "Query Name", "procmon.filesystem.directory_control.query.name",

3413

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3414

},

3415

{ &hf_procmon_filesystem_directory_control_query_creation_time,

3416

{ "Creation Time", "procmon.filesystem.directory_control.query.creation_time",

3417

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3418

},

3419

{ &hf_procmon_filesystem_directory_control_query_last_access_time,

3420

{ "Last Access Time", "procmon.filesystem.directory_control.query.last_access_time",

3421

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3422

},

3423

{ &hf_procmon_filesystem_directory_control_query_last_write_time,

3424

{ "Last Write Time", "procmon.filesystem.directory_control.query.last_write_time",

3425

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3426

},

3427

{ &hf_procmon_filesystem_directory_control_query_change_time,

3428

{ "Change Time", "procmon.filesystem.directory_control.query.change_time",

3429

FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3430

},

3431

{ &hf_procmon_filesystem_directory_control_query_end_of_file,

3432

{ "End of File", "procmon.filesystem.directory_control.query.end_of_file",

3433

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3434

},

3435

{ &hf_procmon_filesystem_directory_control_query_allocation_size,

3436

{ "Allocation Size", "procmon.filesystem.directory_control.query.allocation_size",

3437

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3438

},

3439

{ &hf_procmon_filesystem_directory_control_query_file_attributes,

3440

{ "File Attributes", "procmon.filesystem.directory_control.query.file_attributes",

3441

FT_UINT32, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3442

},

3443

{ &hf_procmon_filesystem_directory_control_query_file_ea_size,

3444

{ "EA Size", "procmon.filesystem.directory_control.query.ea_size",

3445

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3446

},

3447

{ &hf_procmon_filesystem_directory_control_query_file_id,

3448

{ "File ID", "procmon.filesystem.directory_control.query.file_id",

3449

FT_UINT64, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3450

},

3451

{ &hf_procmon_filesystem_directory_control_query_short_name_length,

3452

{ "Short Name Length", "procmon.filesystem.directory_control.query.short_name_length",

3453

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3454

},

3455

{ &hf_procmon_filesystem_directory_control_query_short_name,

3456

{ "Short Name", "procmon.filesystem.directory_control.short_name",

3457

FT_STRING, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3458

},

3459

{ &hf_procmon_profiling_operation,

3460

{ "Operation Type", "procmon.profiling.operation_type",

3461

FT_UINT16, BASE_DEC, VALS(profiling_operation_vals)((0 ? (const struct _value_string*)0 : ((profiling_operation_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3462

},

3463

{ &hf_procmon_network_operation,

3464

{ "Operation Type", "procmon.network.operation_type",

3465

FT_UINT16, BASE_DEC, VALS(network_operation_vals)((0 ? (const struct _value_string*)0 : ((network_operation_vals
)))), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3466

},

3467

{ &hf_procmon_network_flags,

3468

{ "Flags", "procmon.network.flags",

3469

FT_UINT16, BASE_HEX, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3470

},

3471

{ &hf_procmon_network_flags_is_src_ipv4,

3472

{ "Is Src IPv4", "procmon.network.flags.is_src_ipv4",

3473

FT_BOOLEAN, 16, NULL((void*)0), 0x0001, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3474

},

3475

{ &hf_procmon_network_flags_is_dst_ipv4,

3476

{ "Is Dest IPv4", "procmon.network.flags.is_dst_ipv4",

3477

FT_BOOLEAN, 16, NULL((void*)0), 0x0002, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3478

},

3479

{ &hf_procmon_network_flags_tcp_udp,

3480

{ "TCP/UDP", "procmon.network.flags.tcp_udp",

3481

FT_BOOLEAN, 16, TFS(&tfs_tcp_udp)((0 ? (const struct true_false_string*)0 : ((&tfs_tcp_udp
)))), 0x0004, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0)}

3482

},

3483

{ &hf_procmon_network_length,

3484

{ "Length", "procmon.network.length",

3485

FT_UINT32, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3486

},

3487

{ &hf_procmon_network_src_ipv4,

3488

{ "Src IP", "procmon.network.src_ipv4",

3489

FT_IPv4, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3490

},

3491

{ &hf_procmon_network_src_ipv6,

3492

{ "Src IP", "procmon.network.src_ipv6",

3493

FT_IPv6, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3494

},

3495

{ &hf_procmon_network_dest_ipv4,

3496

{ "Dest IP", "procmon.network.dest_ipv4",

3497

FT_IPv4, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3498

},

3499

{ &hf_procmon_network_dest_ipv6,

3500

{ "Dest IP", "procmon.network.dest_ipv6",

3501

FT_IPv6, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3502

},

3503

{ &hf_procmon_network_src_port,

3504

{ "Src Port", "procmon.network.src_port",

3505

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3506

},

3507

{ &hf_procmon_network_dest_port,

3508

{ "Dest Port", "procmon.network.dest_port",

3509

FT_UINT16, BASE_DEC, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3510

},

3511

{ &hf_procmon_network_padding,

3512

{ "Padding", "procmon.network.padding",

3513

FT_BYTES, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3514

},

3515

{ &hf_procmon_network_details,

3516

{ "Details", "procmon.network.details",

3517

FT_STRINGZ, BASE_NONE, NULL((void*)0), 0, NULL((void*)0), HFILL-1, 0, HF_REF_TYPE_NONE, -1, ((void*)0) }

3518

},

3519

3520

};

3521

3522

/* Setup protocol subtree array */

3523

static int *ett[] = {

3524

&ett_procmon,

3525

&ett_procmon_header,

3526

&ett_procmon_stack_trace,

3527

&ett_procmon_process_event,

3528

&ett_procmon_process_modules,

3529

&ett_procmon_process_path,

3530

&ett_procmon_process_commandline,

3531

&ett_procmon_process_curdir,

3532

&ett_procmon_registry_event,

3533

&ett_procmon_registry_key,

3534

&ett_procmon_registry_new_key,

3535

&ett_procmon_registry_value,

3536

&ett_procmon_filesystem_event,

3537

&ett_procmon_filesystem_path,

3538

&ett_procmon_filesystem_create_file_impersonating,

3539

&ett_procmon_filesystem_directory,

3540

&ett_procmon_filesystem_information,

3541

&ett_procmon_profiling_event,

3542

&ett_procmon_network_event,

3543

&ett_procmon_network_flags,

3544

};

3545

3546

static ei_register_info ei[] = {

3547

{ &ei_procmon_unknown_event_class, { "procmon.event_class.unknown", PI_UNDECODED0x05000000, PI_WARN0x00600000, "Unknown event class", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE
, BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE
, -1, ((void*)0)}} }},

3548

{ &ei_procmon_unknown_operation, { "procmon.operation_type.unknown", PI_UNDECODED0x05000000, PI_WARN0x00600000, "Unknown event operation", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE
, BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE
, -1, ((void*)0)}} }},

3549

{ &ei_procmon_unknown_index, { "procmon.index.unknown", PI_UNDECODED0x05000000, PI_WARN0x00600000, "Unknown index", EXPFILL0, ((void*)0), 0, ((void*)0), {0, {((void*)0), ((void*)0), FT_NONE
, BASE_NONE, ((void*)0), 0, ((void*)0), -1, 0, HF_REF_TYPE_NONE
, -1, ((void*)0)}} }},

3550

};

3551

3552

expert_module_t* expert_procmon;

3553

3554

/* Register the protocol name and description */

3555

proto_procmon = proto_register_protocol("MS Procmon Event", "MS Procmon", "procmon");

3556

3557

/* Required function calls to register the header fields and subtrees */

3558

proto_register_field_array(proto_procmon, hf, array_length(hf)(sizeof (hf) / sizeof (hf)[0]));

3559

proto_register_subtree_array(ett, array_length(ett)(sizeof (ett) / sizeof (ett)[0]));

3560

expert_procmon = expert_register_protocol(proto_procmon);

3561

expert_register_field_array(expert_procmon, ei, array_length(ei)(sizeof (ei) / sizeof (ei)[0]));

3562

3563

procmon_handle = register_dissector("procmon", dissect_procmon_event, proto_procmon);

3564

}

3565

3566

void

3567

event_reg_handoff_procmon(void)

3568

{

3569

int file_type_subtype_procmon;

3570

3571

file_type_subtype_procmon = wtap_name_to_file_type_subtype("procmon");

3572

if (file_type_subtype_procmon != -1)

3573

dissector_add_uint("wtap_fts_rec", file_type_subtype_procmon, procmon_handle);

3574

}

3575

3576

/*

3577

* Editor modelines - https://www.wireshark.org/tools/modelines.html

3578

*

3579

* Local variables:

3580

* c-basic-offset: 4

3581

* tab-width: 8

3582

* indent-tabs-mode: nil

3583

* End:

3584

*

3585

* vi: set shiftwidth=4 tabstop=8 expandtab:

3586

* :indentSize=4:tabSize=8:noTabs=true:

3587

*/

File:	builds/wireshark/wireshark/epan/dissectors/packet-procmon.c
Warning:	line 1015, column 13 Value stored to 'offset' is never read

Bug Summary

Annotated Source Code