param( [Parameter(Mandatory = $true)] [string]$Name, [Parameter(Mandatory = $true)] [string[]]$HarnessArgs ) $ErrorActionPreference = 'Stop' $Root = Resolve-Path (Join-Path $PSScriptRoot '..\..') $Dumpcap = 'C:\Program Files\Wireshark\dumpcap.exe' $Harness = Join-Path $Root 'src\MxTraceHarness\bin\Release\net481\MxTraceHarness.exe' $FridaScript = Join-Path $Root 'analysis\frida\mx-nmx-trace.js' $CaptureDir = Join-Path $Root "captures\$Name" New-Item -ItemType Directory -Force $CaptureDir | Out-Null $Pcap = Join-Path $CaptureDir 'loopback.pcapng' $HarnessLog = Join-Path $CaptureDir 'harness.log' $FridaOut = Join-Path $CaptureDir 'frida.stdout.jsonl' $FridaErr = Join-Path $CaptureDir 'frida.stderr.txt' $DumpOut = Join-Path $CaptureDir 'dumpcap.stdout.txt' $DumpErr = Join-Path $CaptureDir 'dumpcap.stderr.txt' $CommandFile = Join-Path $CaptureDir 'command.txt' foreach ($Path in @($Pcap, $HarnessLog, $FridaOut, $FridaErr, $DumpOut, $DumpErr)) { if (Test-Path $Path) { Remove-Item -LiteralPath $Path -Force } } $FullHarnessArgs = @($HarnessArgs + @("--log=$HarnessLog", "--client=MxFridaLoopback-$Name")) $Frida = (Get-Command frida.exe -ErrorAction Stop).Source $FridaArguments = @('-f', $Harness, '-l', $FridaScript, '--') + $FullHarnessArgs "dumpcap=$Dumpcap" | Out-File -Encoding UTF8 $CommandFile "frida=$Frida" | Out-File -Encoding UTF8 -Append $CommandFile "harness=$Harness" | Out-File -Encoding UTF8 -Append $CommandFile ("args=" + ($FridaArguments -join ' ')) | Out-File -Encoding UTF8 -Append $CommandFile $Dump = Start-Process -FilePath $Dumpcap ` -ArgumentList @('-i', '\Device\NPF_Loopback', '-w', $Pcap, '-q') ` -PassThru ` -WindowStyle Hidden ` -RedirectStandardOutput $DumpOut ` -RedirectStandardError $DumpErr Start-Sleep -Seconds 2 try { $Process = Start-Process -FilePath $Frida ` -ArgumentList $FridaArguments ` -Wait ` -PassThru ` -NoNewWindow ` -RedirectStandardOutput $FridaOut ` -RedirectStandardError $FridaErr "exit_code=$($Process.ExitCode)" | Out-File -Encoding UTF8 (Join-Path $CaptureDir 'frida-exit.txt') } finally { if (-not $Dump.HasExited) { Stop-Process -Id $Dump.Id -Force -ErrorAction SilentlyContinue } Wait-Process -Id $Dump.Id -Timeout 10 -ErrorAction SilentlyContinue | Out-Null } Get-ChildItem $CaptureDir | Select-Object Name, Length, LastWriteTime