Winshark – Wireshark plugin to work with Event Tracing for Windows

Winshark is powered by cmake:

git clone https://github.com/airbus-cert/winshark --recursive
mkdir build_winshark
cd build_winshark
cmake ..Winshark
cmake --build . --target package --config release

To better understand how Winshark works, we need to understand how ETW works first.

ETW is split into three parts:

• A Provider that will emit log and identified by a unique ID
• A Session that will mix one or more providers
• A Consumer that will read logs emitted by a session

There is a lot of different kinds of providers. The most common, and usable, are registered providers. A registered provider, or a manifest-based provider, is recorded under the registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTPublishers. This makes the link between a provider ID and a dll. The manifest is encompassed into the associated dll into a resource name WEVT_TEMPLATE.

You can list all providers registered on your machine using logman:

logman query providers

You can also list all providers bound by a particular process:

logman query providers -pid 1234

Sessions are created to collect logs from more than one provider. You can create your own session using logman:

logman start Mysession -p "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS" -ets -rt
logman update MySession -p "Microsoft-Windows-NDIS-PacketCapture" -ets -rt

You can list all active sessions from an admin command line:

logman query -ets

Data Collector Set                      Type                          Status
-------------------------------------------------------------------------------
...
EventLog-Application                    Trace                         Running
EventLog-Microsoft-Windows-Sysmon-Operational Trace                         Running
EventLog-System                         Trace                         Running
...
The command completed successfully.

You can see here some interesting sessions use by the event logger to capture logs from Application and System sessions and from Sysmon.

A consumer is a simple program that will read logs from a session. Well-known consumers are:

• Event Logger
• logman
• netsh
• tracert

And now Winshark!!! Winshark is a simple ETW consumer. The real underlying consumer is libpcap, (wpcap.dll for Windows) which is used by dumpcap.exe which is the process in charge of packet capture.

Wireshark is split into three parts (yes, him too):

• Wireshark.exe which is in charge of parsing and dissecting protocols
• dumpcap.exe which is in charge of capturing packets
• libpcap (wpcap.dll) which is in charge of interfacing between dumpcap.exe and the Operating System

Winshark takes place in the first and last parts. It implements a backend for libpcap to capture ETW events.Winshark works on ETW sessions, this is why you can select an ETW session in place of the Network interface at the start of capture. Then Winshark generates lua dissectors for each manifest-based provider registered on your computer, during the installation step. Winshark is also able to parse trace logging-based providers.

To capture network traffic using Winshark, you have to simply activate network tracing through netsh:

netsh.exe trace start capture=yes report=no correlation=no

And then create an ETW session associated with the Microsoft-Windows-NDIS-PacketCapture provider:

logman start Winshark-PacketCapture -p "Microsoft-Windows-NDIS-PacketCapture" -rt -ets

Then launch Wireshark with administrator privileges and select the Winshark-PacketCapture interface:

• Pass driver signing check in test mode

bcdedit /set testsigning on

• Open a cmd.exe in Admin mode
• Start the driver

sc start NpEtw

• Create an ETW Session

logman start namedpipe -p NpEtw -ets -rt

• Start Wireshark and select the namedpipe session. Enjoy!