Leveraging the new WinDbgX and Time-Travel-Trace –Script to list all access to files


 

WinDbg Preview a.k.a. WinDbgX aesthetically looks like a marriage between Visual Studio (VS) and WinDbg, however VS and WinDbg have not many things in common. For me, this is the good news. The bad news is that the support for managed code is as limited as WinDbg’s. You can download the preview here: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools

 

The most impressive feature of the new debugger is by far the ability to create dump files to later be analyzed as live debugging. This is called Time-Travel-Debugging (TTD). The idea is that you can record an actual live process (at a performance penalty) to later debug going back and forth in time, thus the name. A good use for this is to capture a ‘live dump’ on a production server and analyze the dump later on another environment with access to source code and symbols. If you are a software provider, this is golden. Sometimes, only a particular environment causes the error and your logs do not show much that can help you identify the problem. Recording on a place and debugging on your development lab does not require that you ship your private symbols and source code to a customer’s environment. You may learn more here: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-overview

 

The analysis is done via a LinQ like syntax that can be used directly from the debugger command window or automated via a classic debugger extension or a JavaScript extension. In this post, I am presenting a proof-of-concept script that shows all instances when a file is accessed. More on WinDbg scripting here: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/javascript-debugger-scripting

 

Proof of concept OpenFileList.js (this script only WORKS with TTD dumps – .run files)

"use strict";
 
    var FileAccess =
    {
        FILE_READ_DATA: 0x0001,    /* file & pipe */
        FILE_LIST_DIRECTORY: 0x0001,    /* directory */
        FILE_WRITE_DATA: 0x0002,    // file & pipe
        FILE_ADD_FILE: 0x0002,    // directory
 
        FILE_APPEND_DATA: 0x0004,    // file
        FILE_ADD_SUBDIRECTORY: 0x0004,    // directory
        FILE_CREATE_PIPE_INSTANCE: 0x0004,    // named pipe
 
 
        FILE_READ_EA: 0x0008,    // file & directory
 
        FILE_WRITE_EA: 0x0010,    // file & directory
 
        FILE_EXECUTE: 0x0020,    // file
        FILE_TRAVERSE: 0x0020,    // directory
 
        FILE_DELETE_CHILD: 0x0040,    // directory
 
        FILE_READ_ATTRIBUTES: 0x0080,    // all
 
        FILE_WRITE_ATTRIBUTES: 0x0100,    // all
 
        DELETE: 0x10000,
        WRITE_DAC: 0x40000,   
        WRITE_OWNER: 0x80000, 
        SYNCHRONIZE: 0x100000, 
        ACCESS_SYSTEM_SECURITY: 0x11F01FF,
 
 
        GENERIC_READ: 0x80000000,
        GENERIC_WRITE: 0x40000000,
        GENERIC_EXECUTE: 0x20000000,
        GENERIC_ALL: 0x10000000
    };
 
    var FileShare = 
    {
        FILE_SHARE_NONE: 0,
        FILE_SHARE_READ: 0x00000001,
        FILE_SHARE_WRITE: 0x00000002,
        FILE_SHARE_DELETE: 0x00000004
 
    };
 
function PrintFileAccess(Access)
{
    var flag = "";
    if(Access == 0)
      return "None";
    if(Access & FileAccess.FILE_ADD_FILE)
       flag = "FILE_ADD_FILE";
    if(Access & FileAccess.FILE_ADD_SUBDIRECTORY)
       flag = flag.concat(" FILE_ADD_SUBDIRECTORY");
    if(Access & FileAccess.FILE_APPEND_DATA)
       flag = flag.concat(" FILE_APPEND_DATA");
    if(Access & FileAccess.FILE_CREATE_PIPE_INSTANCE)
       flag = flag.concat(" FILE_CREATE_PIPE_INSTANCE");
    if(Access & FileAccess.FILE_DELETE_CHILD)
       flag = flag.concat(" FILE_DELETE_CHILD");
    if(Access & FileAccess.FILE_EXECUTE)
       flag = flag.concat(" FILE_EXECUTE");
    if(Access & FileAccess.FILE_LIST_DIRECTORY)
       flag = flag.concat(" FILE_LIST_DIRECTORY");
    if(Access & FileAccess.FILE_READ_ATTRIBUTES)
       flag = flag.concat(" FILE_READ_ATTRIBUTES");
    if(Access & FileAccess.FILE_READ_DATA)
       flag = flag.concat(" FILE_READ_DATA");
    if(Access & FileAccess.FILE_READ_EA)
       flag = flag.concat(" FILE_READ_EA");
    if(Access & FileAccess.GENERIC_ALL)
       flag = flag.concat(" GENERIC_ALL");
    if(Access & FileAccess.GENERIC_EXECUTE)
       flag = flag.concat(" GENERIC_EXECUTE");
    if(Access & FileAccess.GENERIC_READ)
       flag = flag.concat(" GENERIC_READ");
    if(Access & FileAccess.GENERIC_WRITE)
       flag = flag.concat(" GENERIC_WRITE");
    if(Access & FileAccess.FILE_TRAVERSE)
       flag = flag.concat(" FILE_TRAVERSE");
    if(Access & FileAccess.FILE_WRITE_DATA)
       flag = flag.concat(" FILE_WRITE_DATA");
    if(Access & FileAccess.FILE_WRITE_EA)
       flag = flag.concat(" FILE_WRITE_EA");
    if(Access & FileAccess.DELETE)
       flag = flag.concat(" DELETE");
    if(Access & FileAccess.WRITE_DAC)
       flag = flag.concat(" WRITE_DAC");
    if(Access & FileAccess.WRITE_OWNER)
       flag = flag.concat(" WRITE_OWNER");
    if(Access & FileAccess.SYNCHRONIZE)
       flag = flag.concat(" SYNCHRONIZE");
    if(Access & FileAccess.ACCESS_SYSTEM_SECURITY)
       flag = flag.concat(" ACCESS_SYSTEM_SECURITY");
 
 
 
    return flag;
}
 
function PrintFileShare(Share)
{
    var flag = "";
    if(Share == 0)
      return "None";
    if(Share & FileShare.FILE_SHARE_DELETE)
       flag = "FILE_SHARE_DELETE";
    if(Share & FileShare.FILE_SHARE_READ)
       flag = flag.concat(" FILE_SHARE_READ");
    if(Share & FileShare.FILE_SHARE_WRITE)
       flag = flag.concat(" FILE_SHARE_WRITE");
    return flag;
       
}
 
function findFileHandle()
{
    var fileOper = host.currentSession
        .TTD.Calls("KERNELBASE!CreateFileW", "KERNELBASE!CreateFileA");
    var locations = [];
    for(var loc of fileOper)
    {
        var posObj = {Start: loc.TimeStart, FileNameAddr: loc.Parameters[0],
              Access: loc.Parameters[1], ShareMode: loc.Parameters[2],
              Result: loc.ReturnAddress, Ansi: loc.Function.includes("CreateFileA") };
        
        locations.push(posObj);
        
    }
    return locations;
}  
 
 
function printFileName(location)
{
    host.diagnostics.debugLog("------------------------------------------------\n");
 
    location.Start.SeekTo();
 
    host.diagnostics.debugLog((location.Result > 0 ? "(SUCCESS) " : "(Failure) ") +
                       (location.Ansi ? host.memory.readString(location.FileNameAddr) : host.memory.readWideString(location.FileNameAddr)) + "\n");
    var access = host.evaluateExpression(location.Access.toString(16)+" & 0xffffffff")
    var share = host.evaluateExpression(location.ShareMode.toString(16)+" & 0xffffffff")
 
    // host.diagnostics.debugLog(access.toString(16) + " " + share.toString(16)+" ");
                        
    host.diagnostics.debugLog("Access: ["+access.toString(16)+"] "+PrintFileAccess(access)+" Share: ["+
                    share.toString(16) + "] "+PrintFileShare(share) + "\n");  
    return;                   
}
 
function invokeScript()
{
    host.diagnostics.debugLog("Collecting File Access information...\n");
 
 
 
    var currentPosition = host.currentThread.TTD.Position;
 
    var locations = findFileHandle();
    for (var location of locations)
    {
        printFileName(location);
    }
 
    currentPosition.SeekTo();
}
 
 
 

 

This is an example of the output:

Collecting File Access information...
------------------------------------------------
Setting position: 1DB4F:4D
(2370.2184): Break instruction exception - code 80000003 (first/second chance not available)
Time Travel Position: 1DB4F:4D
KERNELBASE!CreateFileW:
00007ffe`d0258460 4883ec58        sub     rsp,58h
Collecting File Access information...
------------------------------------------------
Setting position: 1DB4F:4D
(2370.2184): Break instruction exception - code 80000003 (first/second chance not available)
Time Travel Position: 1DB4F:4D
KERNELBASE!CreateFileW:
00007ffe`d0258460 4883ec58        sub     rsp,58h
Collecting File Access information...
------------------------------------------------
Setting position: 1DB4F:4D
(SUCCESS) C:\windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.SharePoint\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.dll
Access: [0x4c4b400]  WRITE_DAC ACCESS_SYSTEM_SECURITY Share: [0x1]  FILE_SHARE_READ
------------------------------------------------
Setting position: 42094:4D
(SUCCESS) C:\windows\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll
Access: [0x4c4b400]  WRITE_DAC ACCESS_SYSTEM_SECURITY Share: [0x1]  FILE_SHARE_READ
------------------------------------------------
Setting position: 4211F:4D
(SUCCESS) C:\windows\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll
Access: [0x4c4b400]  WRITE_DAC ACCESS_SYSTEM_SECURITY Share: [0x1]  FILE_SHARE_READ
------------------------------------------------
Setting position: 1DBCD:4D
(SUCCESS) C:\windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.SharePoint\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.dll
Access: [0x4c4b400]  WRITE_DAC ACCESS_SYSTEM_SECURITY Share: [0x1]  FILE_SHARE_READ
------------------------------------------------
Setting position: 414C5:4D
(SUCCESS) C:\windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.SharePoint.Publishing\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Publishing.dll
Access: [0x4c4b400]  WRITE_DAC ACCESS_SYSTEM_SECURITY Share: [0x1]  FILE_SHARE_READ
------------------------------------------------
Setting position: 4219E:4D
(SUCCESS) C:\windows\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll
Access: [0x4c4b400]  WRITE_DAC ACCESS_SYSTEM_SECURITY Share: [0x1]  FILE_SHARE_READ
------------------------------------------------
Setting position: 1DC4B:4D
(SUCCESS) C:\windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.SharePoint\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.dll
Access: [0x4c4b400]  WRITE_DAC ACCESS_SYSTEM_SECURITY Share: [0x1]  FILE_SHARE_READ
------------------------------------------------
Setting position: 4221C:4D
(SUCCESS) C:\windows\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll
Access: [0x4c4b400]  WRITE_DAC ACCESS_SYSTEM_SECURITY Share: [0x1]  FILE_SHARE_READ
------------------------------------------------
(...)

Comments (0)

Skip to main content