Tracing The Pain Away Module 6 - Introduction to DTrace
Added 2024-09-12 14:00:02 +0000 UTCAn introduction to DTRace and D-generate.
References
DTrace on Windows
https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtraceExample DTrace Scripts
https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace-programming#additional-sample-scriptsD-Generate
https://raw.githubusercontent.com/jonaslyk/temp/main/dg.batJonas D-Generate release thread (X)
https://x.com/jonasLyk/status/1568450498579111936
Lab 5 - DTrace
In this lab we use DTrace to trace syscalls from the kernel. DTrace can be configured to using multiple different providers including a userland tracing provider PID but for this lab we will solely focus on it’s ability to monitor syscalls from the kernel.
DTrace: Indirect Syscalls
Run the lab4.exe binary from the previous lab using DTrace and observe the detailed API argument reporting provided by D-Generate. Make sure you have your symbols setup correctly!
Launch DTrace with the syslog.d script and the binary lab4.exe.
dtrace -s syslog.d lab4.exeOnce DTrace is running launch the lab4.exe executable and observe the logged syscalls in DTrace. It is helpful to redirect the output of DTrace to a file.
Identify key APIs that would be useful to log and update the D-Generate script to log only these APIs.
Launch the D-Generate script passing as an lab4.exe argument.
Run lab4.exe again this observe the detailed logging in D-Generate.
Repeat the same process with the other labs.
⭐ Update - Example D-Generate Script
It can be a bit confusing to know what syscalls to remove when first looking at the whole D-Generate script. To help highlight what parts should be updated I have uploaded a modified D-Generate script db_ntwritevirtualmemory.bat where only NtWriteVirtualMemory is logged. You can compare this modified script with the original to highlight the definitions that can me added/removed.
