Correctly handle kernel addresses in an x86 stack trace

microsoft · Aug 13, 2024 · 6fb29ce · 6fb29ce
1 parent e39e9b7
commit 6fb29ce
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 12 deletions.
diff --git a/Microsoft.O365.Security.Native.ETW/EventRecord.hpp b/Microsoft.O365.Security.Native.ETW/EventRecord.hpp
@@ -774,12 +774,12 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
         /// Retrieves the call stack associated with the record, if enabled.
         /// </summary>
         /// <returns>a list of return addresses</returns>
-        virtual List<UIntPtr>^ GetStackTrace()
+        virtual List<UInt64>^ GetStackTrace()
         {
-            auto stackTrace = gcnew List<UIntPtr>();
+            auto stackTrace = gcnew List<UInt64>();
             for (auto& returnAddress : schema_->stack_trace())
             {
-                stackTrace->Add(UIntPtr(returnAddress));
+                stackTrace->Add(UInt64(returnAddress));
             }
             return stackTrace;
         }

diff --git a/Microsoft.O365.Security.Native.ETW/IEventRecord.hpp b/Microsoft.O365.Security.Native.ETW/IEventRecord.hpp
@@ -407,7 +407,7 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
         ///  Retrieves the call stack associated with the record, if enabled.
         /// </summary>
         /// <returns>a list of return addresses</returns>
-        List<UIntPtr>^ GetStackTrace();
+        List<UInt64>^ GetStackTrace();
     };
 
 } } } }
diff --git a/examples/ManagedExamples/UserTrace007_StackTrace.cs b/examples/ManagedExamples/UserTrace007_StackTrace.cs
@@ -47,7 +47,6 @@ public static void Start()
                     return; // ignore failures
 
                 var callStack = record.GetStackTrace()
-                                .Select(a => a.ToUInt64())
                                 .Where(a => a < 0xFFFF000000000000) // skip kernel addresses (for now)
                                 .Select(a => MemoryMap.GetClosestSymbol(processId, a));
 

diff --git a/krabs/krabs/schema.hpp b/krabs/krabs/schema.hpp
@@ -256,11 +256,11 @@ namespace krabs {
         *    void on_event(const EVENT_RECORD &record, const krabs::trace_context &trace_context)
         *    {
         *        krabs::schema schema(record, trace_context.schema_locator);
-        *        std::vector<ULONG_PTR> stack_trace = schema.stack_trace();
+        *        std::vector<ULONG64> stack_trace = schema.stack_trace();
         *    }
         * </example>
         */
-        std::vector<ULONG_PTR> stack_trace() const;
+        std::vector<ULONG64> stack_trace() const;
 
     private:
         const EVENT_RECORD &record_;
@@ -277,8 +277,8 @@ namespace krabs {
         friend GUID activity_id(const schema&);
         friend int event_id(const EVENT_RECORD &);
         friend int event_id(const schema &);
-        friend std::vector<ULONG_PTR> stack_trace(const schema&);
-        friend std::vector<ULONG_PTR> stack_trace(const EVENT_RECORD&);
+        friend std::vector<ULONG64> stack_trace(const schema&);
+        friend std::vector<ULONG64> stack_trace(const EVENT_RECORD&);
 
         friend class parser;
         friend class property_iterator;
@@ -408,9 +408,9 @@ namespace krabs {
         return record_.EventHeader.ActivityId;
     }
 
-    inline std::vector<ULONG_PTR> schema::stack_trace() const
+    inline std::vector<ULONG64> schema::stack_trace() const
     {
-        std::vector<ULONG_PTR> call_stack;
+        std::vector<ULONG64> call_stack;
         if (record_.ExtendedDataCount != 0) {
             for (USHORT i = 0; i < record_.ExtendedDataCount; i++)
             {

diff --git a/krabs/krabs/testing/extended_data_builder.hpp b/krabs/krabs/testing/extended_data_builder.hpp
@@ -136,7 +136,7 @@ namespace krabs { namespace testing {
         auto array_ptr = reinterpret_cast<EVENT_HEADER_EXTENDED_DATA_ITEM*>(data_buffer);
         auto data_ptr = data_buffer + array_part_size;
 
-        for (int i = 0; i < items_.size(); i++)
+        for (size_t i = 0; i < items_.size(); i++)
         {
             // 2a: write the struct
             auto& destination = array_ptr[i];