PyKD ETW Event Monitor

Description

PyKD ETW Event Monitor is a python script that runs inside WinDBG and controls the debug interface by using the WinDBG extension PyKD. The python script intercepts function calls in debugee Windows kernel and parses function arguments to extract live ETW event objects while debugee system is running.

Getting Started

1. Start WinDBG and instantiate a kernel debugger session (KD) with debuggee system.
2. Break execution
3. Load PyKD extension .load C:\windbg_ext\pykd_ext_2.0.0.25_symbols\x64\pykd.dll
4. Start script !py C:\windbg_ext\etw-event-extractor\src\EtwEventExtractor.py
5. now the script is running and ETW events will be extracted
6. Stop script by pressing CTRL + BREAK or clicking on Debug/Break

Output

The extracted ETW events will be stored in a binary format called "Extracted Event Data" (XED). The XED files (.*xed) can be read by the ETW Event Data Analyzer.

Cofiguration

You can configure wich event objects should be extracted by a lot of filter settings.

The configuration can be changed by editing the config.ini file.

C:\windbg_ext\etw-event-extractor\src\config.ini

    [export file]

	filename = "C:\windbg_ext\output\etw2.xed"
	
	
	
	[filter settings]
	
	enable = True

	order = "Provider Event Context"



	[context filter]

	enable = FALSE
	
	cpuIdIncludeFilter = [0, 1, 2, 3]
	cpuIdExcludeFilter = [0, 1]
	cpuIdMinFilter     = 4
	cpuIdMaxFilter     = 10
	
	irqlIncludeFilter = [0, 2, 3]
	irqlExcludeFilter = [1, 4, 5]
	irqlMinFilter     = 1
	irqlMaxFilter     = 5
	
	threadIdIncludeFilter = [4532, 478, 25413]
	threadIdExcludeFilter = [123, 1234]
	threadIdMinFilter     = 100
	threadIdMaxFilter     = 10000
	
	processIdIncludeFilter = [2568, 3565, 445]
	processIdExcludeFilter = [1, 11, 23]
	processIdMinFilter     = 100
	processIdMaxFilter     = 10000
	
	imageNameIncludeFilter = ["system", "msedge.exe"]
	imageNameExcludeFilter = ["explorer.exe", "init", "registry"]
	
	imageFileNameIncludeFilter = ["\Program Files\", "\Program Files (x86)\", "temp"] 
	imageFileNameExcludeFilter = ["\Windows\", ".srv"]
	
	
	
	[provider class filter]
	
	enable = TRUE
	
	providerClassGuidIncludeFilter = ["{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}", "{56d126ed-048e-4535-bea2-f519c349f154}", "{fcac2899-9f97-4d2c-bffb-71542dedf860}"]
	providerClassGuidExcludeFilter = ["{6c69edd1-ae4d-435c-81f8-6aad815cd0dd}", "{5d7b24aa-755d-4229-987f-86b37771c82e}", "{0724cac6-a62f-4654-8433-ebcd7559b189}"]



	[event descriptor filter]

	enable = FALSE

	eventIdIncludeFilter = [1, 2, 4, 7, 9]
	eventIdExcludeFilter = [3, 6, 8]
	eventIdMinFilter     = 2
	eventIdMaxFilter     = 5
	
	eventVersionIncludeFilter = [3, 4]
	eventVersionExcludeFilter = [0, 1, 2]
	eventVersionMinFilter     = 3
	eventVersionMaxFilter     = 4

	eventChannelIncludeFilter = [5, 10]
	eventChannelExcludeFilter = [13, 27]
	eventChannelMinFilter     = 1
	eventChannelMaxFilter     = 15
	
	eventLevelIncludeFilter = [3, 4, 5]
	eventLevelExcludeFilter = [0, 6]
	eventLevelMinFilter     = 3
	eventLevelMaxFilter     = 5
	
	eventOpcodeIncludeFilter = [1, 2, 4, 9]
	eventOpcodeExcludeFilter = [3, 8]
	eventOpcodeMinFilter     = 1
	eventOpcodeMaxFilter     = 4
	
	eventTaskIncludeFilter = [3, 4, 9, 12]
	eventTaskExcludeFilter = [1, 2, 3]
	eventTaskMinFilter     = 3
	eventTaskMaxFilter     = 10
	
	eventKeywordsMatchAllFilter    = 0xFFCC0012_34AACC00
	eventKeywordsMatchAnyFilter    = 0x1234AACC_FFCC0012
	eventKeywordsNotMatchAllFilter = 0x01010101_10101010
	eventKeywordsNotMatchAnyFilter = 0xFFFFFFFF_00000000

References

I developed this tool during my research into the inner workings of Event Tracing for Windows (ETW), Virtual Machine Introspection (VMI), and how to monitor ETW events using VMI.

See:

• HypErSIS Project
• Schmitz, A. Decoding, enrichment and filtering of ETW event data outside of Windows environments. 2023. PDF download.
• Schmitz, A. Event‑based system monitoring of Windows PCs. 2022. PDF downlaod.
• Schmitz, A. Hardware-assisted Virtualization for Malware Analysis and Intrusion Detection. 2021. PDF download.