Want to Join Us ?

you'll be able to discuss, share and send private messages.

Python fibratus Tool for exploration and tracing of the Windows rabbitstackkernel by fibratus

Discussion in 'Source Code' started by storm shadow, Jun 2, 2016.

Share This Page

  1. storm shadow

    Techbliss Owner Admin Ida Pro Expert Developer


    [​IMG] [​IMG] [​IMG]
    Fibratus is a tool which is able to capture the most of the Windows kernel activity - process/thread creation and termination, file system I/O, registry, network activity, DLL loading/unloading and much more. Fibratus has a very simple CLI which encapsulates the machinery to start the kernel event stream collector, set kernel event filters or run the lightweight Python modules called filaments. You can use filaments to extend Fibratus with your own arsenal of tools.

    Download the latest installer and in a blink of an eye you are ready to go.

    Compiling Fibratus from sources requires the Nuitka Python compiler. In the first place, compile the kernel event stream collector (Visual C++ 2012+ and Cython >=0.23.4 should be installed).
    $ python setup.py build_ext --inplace

    Make sure all dependencies are satisfied before running Nuitka:
    Code (Text):
    $ pip install -U nuitka
    $ pip install -r requirements.txt
    $ nuitka --recurse-all --standalone --output-dir= --verbose fibratus\cli.py
    $ cd
    $ ren cli.exe fibratus.exe
    Running Fibratus

    Fibratus is composed of a single binary which can be run from terminal console. Although default Windows console would suffice, for better user experience a more sophisticated terminal emulators like ConEmu or Cmder are recommended. Runfibratus --help for usage instructions.
    Code (Text):
        fibratus run ([--filament=<filament>] | [--filters <kevents>...])
        fibratus list-kevents
        fibratus list-filaments
        fibratus -h | --help
        fibratus --version
    Code (Text):
        -h --help                Show this screen.
        --filament=<filament>    Specify the filament to execute.
        --version                Show version.
    To capture all of the supported kernel events, execute fibratus run command without any argument. After the collector has been initialized, the continuous stream of kernel events will render on the standard output.
    Code (Text):
    5550 20:28:14.882000 3 cmd.exe (4396) - UnloadImage (base=0x77950000, checksum=1313154, image=ntdll.dll, path=\Device\HarddiskVolume2\Windows\SysWOW64\ntdll.dll, pid=4396, size=1536.0)
    5551 20:28:14.882000 3 erl.exe (2756) - TerminateProcess (comm=C:\Windows\system32\cmd.exe /cdir /-C /W c:/Users/Nedo/AppData/Roaming/RabbitMQ/db/rabbit@NEDOPC-mnesia, exe=C:\Windows\system32\cmd.exe, name=cmd.exe, pid=4396, ppid=2756)
    5552 20:28:14.882000 3 erl.exe (2756) - CloseFile (file=\Device\HarddiskVolume2\Windows, tid=1672)
    5631 20:28:17.286000 2 taskmgr.exe (3532) - RegQueryKey (hive=REGISTRY\MACHINE\SYSTEM, key=ControlSet001\Control\Nls\Locale, pid=3532, status=0, tid=4324)
    5632 20:28:17.286000 2 taskmgr.exe (3532) - RegOpenKey (hive=REGISTRY\MACHINE\SYSTEM, key=ControlSet001\Control\Nls\Locale\Software\Microsoft\DirectUI, pid=3532, status=3221225524, tid=4324)
    5633 20:28:17.288000 2 taskmgr.exe (3532) - CreateFile (file=\Device\HarddiskVolume2\Windows\system32\xmllite.dll, file_type=REPARSE_POINT, operation=OPEN, share_mask=rwd, tid=4324)
    5634 20:28:17.288000 2 taskmgr.exe (3532) - CloseFile (file=\Device\HarddiskVolume2\Windows\system32\xmllite.dll, tid=4324)
    5635 20:28:17.288000 2 taskmgr.exe (3532) - CreateFile (file=\Device\HarddiskVolume2\Windows\system32\xmllite.dll, file_type=FILE, operation=OPEN, share_mask=r-d, tid=4324)
    5636 20:28:17.288000 2 taskmgr.exe (3531) - LoadImage (base=0x7fefab90000, checksum=204498, image=xmllite.dll, path=\Windows\System32\xmllite.dll, pid=3532, size=217088)
    5637 20:28:17.288000 2 taskmgr.exe (3532) - CloseFile (file=\Device\HarddiskVolume2\Windows\system32\xmllite.dll, tid=4324)
    5638 20:28:17.300000 2 taskmgr.exe (3532) - RegQueryKey (hive=REGISTRY\MACHINE\SYSTEM, key=ControlSet001\Control\Nls\Locale\, pid=3532, status=0, tid=4324)
    5639 20:28:17.300000 2 taskmgr.exe (3532) - RegOpenKey (hive=REGISTRY\MACHINE\SYSTEM, key=ControlSet001\Control\Nls\Locale\SOFTWARE\Microsoft\CTF\KnownClasses, pid=3532, status=3221225524, tid=4324)
    5640 20:28:17.300000 3 taskmgr.exe (3532) - RegQueryKey (hive=REGISTRY\MACHINE\SYSTEM, key=ControlSet001\Control\Nls\Locale\, pid=3532, status=0, tid=4324)
    5641 20:28:17.300000 3 taskmgr.exe (3532) - RegOpenKey (hive=REGISTRY\MACHINE\SYSTEM, key=ControlSet001\Control\Nls\Locale\SOFTWARE\Microsoft\CTF\KnownClasses, pid=3532, status=3221225524, tid=4324)
    5642 20:28:17.302000 2 taskmgr.exe (3532) - UnloadImage (base=0x7fefab90000, checksum=204498, image=xmllite.dll, path=\Windows\System32\xmllite.dll, pid=3532, size=212.0)
    Hit Ctrl+C to stop Fibratus. Note that depending on the system load, you might have to hit Ctrl+C multiple times until kernel event buffers are consumed.
    Every line contains the information of the kernel event according to the following format:
    • id - kernel event's incremental identifier. The value of the identifier is reseted on every single execution.
    • timestamp - temporal occurrence of the event.
    • cpu - the CPU core where the event has been generated.
    • process - process name which triggered the kernel's event.
    • pid - the identifier of the after-mentioned process.
    • kevent - name of the kernel event.
    • params - event's parameters.

    Fibratus supports basic filtering capabilities on kernel event names. To capture the specified kernel events, use fibratus run --filters command. For example, fibratus run --filters CreateProcess Send would capture the events related to process creation and data sending over network sockets. For a full list of kernel events see the table below.
    Code (Text):
    Kernel event
    Creates a new process and its primary thread
    Creates a thread to execute within the virtual address space of the calling process
    Terminates the process and all of its threads
    Terminates a thread
    Loads the module into the address space of the calling process
    Frees the loaded module from the address space of the calling process
    Creates or opens a file or I/O device
    Closes the file or I/O device
    Deletes an existing file or directory
    Renames a file or directory
    Reads data from the file or I/O device
    Writes data to the file or I/O device
    Sends data on a connected socket
    Receives data from a connected socket
    Initiates the connection attempt from the remote or local TCP socket
    Establishes the connection to a TCP socket
    Closes the connection to a TCP socket
    Reconnects to a TCP socket
    Creates the registry key or open it if the key already exists
    Retrieves information about the registry key
    Opens the registry key
    Deletes a subkey and its values
    Retrieves the type and data of the value associated with an open registry key
    Sets the data and type of a value under a registry key
    Removes a value from the registry key
    Executing filaments

    Filaments are micro modules written in Python that run on top of Fibratus. They often perform aggregations, filtering, groupings, counting or any kind of custom logic on a kernel event stream. To execute a filament, pass the filament name via--filament argument, for example fibratus run --filament=top_hives_io. To get more information on how to create filaments, see Building filaments.
    Building filaments

    Creating a new filament is as easy as providing a Python module with on_init and on_next_kevent methods as follows:
    import collections

    Shows top TCP / UDP connections

    connections = collections.Counter()

    def on_init():
    columns(["Port", "IP", "Count"])

    def on_next_kevent(kevent):
    connections.update((kevent.params.dport, kevent.params.ip_dst))

    for t, count in connections.items():
    add_row([t[0], t[1], count])

    The on_init method is invoked upon Fibratus initialization just before the kernel event stream is being opened.

    Copyright 2015/2016 by Nedim Sabic (RabbitStack) All Rights Reserved.
    Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
    Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

    Attached Files:

    computerline and Rip Cord like this.