Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
application will also provide the ability to search through all the events looking or any
that fail the checksum check.
4.6 Pseudo Code
Pseudo code is used in software development to give a description in a readable form
of the basic functions of a program. The purpose of this is to make it more readable
for humans, so they can understand what the program is doing, without
overcomplicating the code and introducing complex algorithms.
4.6.1 Client Side Pseudo Code
Figure 13 is the pseudo code that the client application will use. As it can be seen the
client attempts to connect to the Data Archiving System using port 13000. This port
has been selected as it outside of the range of commonly used ports. After the
connection has been established the client receives the public key from the Data
Archiving System. This key is then used to encrypt all the data that is sent to the Data
Archiving System.
Prompt user to enter a key for use with HMAC
Connect to the server on port 13000
Receive public key from server
Do Continuously
{
Monitor for files being ‘modified’
If a file is ‘modified’
{
Get system time
Get username
Get event type (changed/created/deleted/renamed)
Get path of file
Generate XML string
Generate HMAC checksum
Add HMAC to XML String
Encrypt with Servers public key
Send to Server
}
}
Figure 13: Client side pseudo code
4.6.2 Data Archiving System Pseudo Code
36