Basically a KrabsETW rip-off written in Rust

Overview

FerrisETW 🦀

Basically a KrabsETW rip-off written in Rust, hence the name Ferris 🦀

All credits go to the team at Microsoft who develop KrabsEtw, without it, this project probably wouldn't be a thing.

Motivation

Since lately I've been working very closely with ETW and Rust, I thought that having a tool that would simplify ETW management written in Rust and available as a crate for other to consume would be pretty neat and that's where this crate comes into play 🔥

Examples

You can find a few examples within the Examples folder. If you are familiar with KrabsETW you'll see that is very similar In case you've never used KrabsETW before, the examples are very straight forward and should be easy to follow. If you have any issues don't hesitate in asking.

The following snippet shows the basic usage of the library

fn wmi_callback(record: EventRecord, schema_locator: &mut SchemaLocator) {
    // We locate the Schema for the Event
    match schema_locator.event_schema(record) {
        Ok(schema) => {
            // We filter the event by EventId
            if schema.event_id() == 12 {
                // We obtain the Parser for the Schema
                let mut parser = Parser::create(&schema);
                // We parse the data from the Event based on the names of the fields of the Event
                // Type annotations or Fully Qualified Syntax are needed when calling TryParse
                let op: String = parser
                    .try_parse("Operation")
                    .unwrap_or(String::from("Operation missing"));
                let provider_name: String = parser
                    .try_parse("ProviderName")
                    .unwrap_or(String::from("ProviderName missing"));
                // Could also use String as type
                let provider_guid: Guid =
                    parser.try_parse("ProviderGuid").unwrap_or(Guid::zeroed());
                println!(
                    "WMI-Activity -> ProviderName {}, ProviderGuid: {:?}, Operation: {}",
                    provider_name, provider_guid, op
                );
            }
        }
        Err(err) => println!("Error {:?}", err),
    };
}

fn main() {
    // We first build a Provider
    let wmi_provider = Provider::new()
        .by_guid("1418ef04-b0b4-4623-bf7e-d74ab47bbdaa") // Microsoft-Windows-WMI-Activity
        .add_callback(wmi_callback)
        .build()
        .unwrap();
  
    // We enable the Provider in a new Trace and start the trace
    // This internally will launch a new thread
    let mut trace = UserTrace::new().enable(wmi_provider).start().unwrap();

    std::thread::sleep(Duration::new(20, 0));
  
    // We stop the trace
    trace.stop();
}

Documentation

I'm having some trouble to get docs.rs to build the documentation for the crate so at the moment is being hosted on my domain. FerrisETW Doc

Notes

  • The project is still WIP, there's still plenty of things to evaluate/investigate and things to fix and do better. Any help would be greatly appreciated, also any issues you may have!

  • The types available for parsing are those that implement the trait TryParse for Parser, basic types are already implemented. In the near future I'll add more :)

  • I tried to keep dependencies as minimal as possible, also you'll see I went with the new windows-rs instead of using the winapi. This is a personal decision mainly because I believe the Windows bindings is going to be the "standard" to interact with the Windows API in the near future.

  • Although I encourage everyone to use Rust, I do believe that, at the moment, if you plan on interacting with ETW in a production level and the programming language is not a constraint you should definitely go with KrabsETW as a more robust and tested option. Hopefully in next iterations I'll be able to remove this disclaimer 😃

Acknowledgments

  • First of all, the team at MS who develop KrabsETW!!
  • Shaddy for, pretty much, teaching me all the Rust I know 😃
Issues
  • Implement TryParse for SID type

    Implement TryParse for SID type

    A SID is a pretty common field within ETW events so providing a way to parse it into a String is a must. See KrabsETW implementation KrabsETW - parser.hpp#L368

    enhancement 
    opened by n4r1b 1
  • Fix ‘rip-off’ typo

    Fix ‘rip-off’ typo

    ‘rip off’ is a phrasal verb, ‘rip-off’ is a noun. Similarly to how ‘set up’ is a phrasal verb and ‘setup’ is sa noun.

    opened by mina86 0
  • Make KernelProviders proper const, no lazy_static

    Make KernelProviders proper const, no lazy_static

    lazy_static makes for some fairly messy documentation as it generates custom types and other noisy content. It's also fairly unnecessary: we can totally build KernelProviders in pure const fn simply by taking the guid directly as argument. Those GUIDS themselves can be built in pure const fn through from_values, at a small ergonomics cost.

    opened by roblabla 0
  • Allow cross-compilation with msvc-wine

    Allow cross-compilation with msvc-wine

    Using the full windows crate as a build-dependencies makes it impossible to cross-compile ferrisetw from linux to windows, as the windows crate tries to link on kernel32.dll and other similar libs that don't exist on linux. By instead only relying on windows_macros in the build script, we can avoid this problem.

    opened by roblabla 0
  • Implement event filtering

    Implement event filtering

    Info ETW allows filters to be defined for a Provider in a session. MSDN - Defining Filters. KrabsETW already provides a mechanism to do filtering either by events_id or by using more complicated predicates

    • https://github.com/microsoft/krabsetw/tree/master/krabs/krabs/filtering

    TODO [] Research best way to introduce filters into Ferris [] Implement a basic filtering based on events_id [] Research and implement a filtering based on more complex predicates

    enhancement 
    opened by n4r1b 0
  • Improve Error logging

    Improve Error logging

    At the moment there's pretty much no logging for errors, this has to be improved A LOT.

    Consider using crates like:

    enhancement 
    opened by n4r1b 0
Owner
n4r1B
n4r1B
🌌⭐ Git tooling of the future.

❯ Glitter Git tooling of the future. ❯ ?? Features Config files Fast Easy to use Friendly errors ❯ ?? Documentation For proper docs, see here ❯ ✋ What

Milo 86 Jun 11, 2021
Rust experiments involving Haskell-esque do notation, state, failure and Nom parsers!

Introduction As a long time Haskell developer recently delving into Rust, something I've really missed is monads and do notation. One thing monadic do

Kerfuffle 21 May 23, 2021
A library in Rust for theorem proving with Intuitionistic Propositional Logic.

Prop Propositional logic with types in Rust. A library in Rust for theorem proving with Intuitionistic Propositional Logic. Supports theorem proving i

AdvancedResearch 4 Jun 9, 2021
A DIY, IMU-based skateboard activity tracker

tracksb A DIY, IMU-based skateboard activity tracker. The idea is to come up with algorithms to track activity during skateboarding sessions. A compan

null 14 Jun 2, 2021
A library to compile USDT probes into a Rust library

sonde sonde is a library to compile USDT probes into a Rust library, and to generate a friendly Rust idiomatic API around it. Userland Statically Defi

Ivan Enderlin 25 Mar 28, 2021
A low-ish level tool for easily writing and hosting WASM based plugins.

A low-ish level tool for easily writing and hosting WASM based plugins. The goal of wasm_plugin is to make communicating across the host-plugin bounda

Alec Deason 31 Jun 4, 2021
Simple ray tracer written in Rust

Simple ray tracer written in Rust from scratch I've just finished my first semester at the Faculty of Applied Mathematics and Computer Science at the

Vladislav 190 Jun 12, 2021
A lightning fast version of tmux-fingers written in Rust, copy/pasting tmux like vimium/vimperator

tmux-thumbs A lightning fast version of tmux-fingers written in Rust for copy pasting with vimium/vimperator like hints. Usage Press ( prefix + Space

Ferran Basora 376 Jun 12, 2021
Czkawka is a simple, fast and easy to use app to remove unnecessary files from your computer.

Multi functional app to find duplicates, empty folders, similar images etc.

Rafał Mikrut 4.2k Jun 13, 2021
A cross platform tool which instantly notifies about COVID vaccine availability.

?? CoWIN Notifier ?? A cross-platform tool written in rust, which instantly notifies users about COVID-19 vaccine availability at their regions. Curre

Sanskar Jaiswal 20 May 20, 2021
[DEPRECATED] password manager thing

NOTE: this is pretty much abandoned, I recommend Bitwarden now. There is an export command in the CLI that produces CSV suitable for import into Bitwa

null 307 Apr 6, 2021
C to Rust translator

Corrode: Automatic semantics-preserving translation from C to Rust This program reads a C source file and prints an equivalent module in Rust syntax.

Jamey Sharp 2.1k Jun 11, 2021
Astronomical algorithms in Rust

astro-rust Contents API Docs About Usage Contributing References About astro-rust is a library of advanced astronomical algorithms for the Rust progra

Saurav Sachidanand 154 Jun 9, 2021
BSV stdlib written in Rust and runs in WASM environments

BSV.WASM A Rust/WASM Library to interact with Bitcoin SV Installation NodeJS: npm i bsv-wasm --save Web: npm i bsv-wasm-web --save Rust: https://crate

null 16 Jun 15, 2021