Generate Nt* system call sequence

[shikharvaish28]

I have managed to run the code after which we have some doubts. Please clear some of those. The primary motive is to get a list of sequence Nt* calls as you have used in your paper System Call-Based Detection of Malicious Processes.

1. The database generated contains only the processes and their path such as chrome.exe etc. How should we extract the 'Nt*' process calls from the same?
   

2. debug_log.txt contains too many lines mentioning something like this but with different addresses 'UNKNOWN System Call Enter NT FFFFF802702D11D4 on core 3. ' What is this address pointing?

3. 100s of *_trace files generated with the size of 0 kb. How did you use them?
   

EDIT:

1. In one of our Windows 7 systems, we have got *_trace file with some size. Since they are binary files written using BinaryWriter, how should I open it and read it's content? (Same is the case with host_trace_data

2. When executing the tool in the util directory, it is generating an empty symbol file.

[rcanzanese]

1. The trace files are the actual system call traces.

2. What version of Windows are you using? I don't recall if this issue was because of having incorrect or incomplete symbol tables or something else. Did you successfully load the symbol talble?

3. The software generates the trace files for every running process. The default behavior is to only actually record the traces for processes when they first start. This behavior will lead to empty traces for all the already-running processes.

[shikharvaish28]

The trace files are the actual system call traces.

Yes, we were able to figure that out, but since these are binary files, we don't know how to open it.

What version of Windows are you using?

We have tried using Windows 10, 8.1, 8 and 7. On some of our systems, the kernel version is matching with the symbol files in the repository itself.

Did you successfully load the symbol table?

I guess it as a yes because while building the project in Visual Studio 2015, we are getting several outputs as Symbols loaded.

This behaviour will lead to empty traces for all the already-running processes.

Okay. So, only trace some files would have some size while the rest would be of 0 KB