Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
public static void OnRenamed(object source, RenamedEventArgs e)
{
// Specify what is done when a file is renamed.
string message = "" + DateTime.Now +
"" + GlobalClass.user + ""
+ e.ChangeType + "" + e.FullPath +
"";
}
// Pass the ‘message’ to the next stage.
sendmsg(message);
Figure 22: Capturing Events
5.2.4 HMAC
Figure 23 shows the code that is used to generate the HMAC checksum. The ‘key’ is
taken from a user input when the application is first launched; it is then passed into
the following code along with the events that have been generated by the
‘FileSystemWatcher’ class. The resulting checksum value is then wrapped in XML
tags and attached to the end of the captured events string.
// Declare a new instance of Ascii Ecnoding called ‘encoding’.
System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding();
// Convert the HMAC key to a byte value.
byte[] keyByte = encoding.GetBytes(key);
// Create a new instance of HMAC with SHA1.
HMACSHA1 hmac = new HMACSHA1(keyByte);
// Convert the message to a byte value.
byte[] messageBytes = encoding.GetBytes(chkMessage);
// Compute the hash signature.
byte[] hashmessage = hmac.ComputeHash(messageBytes);
// Update the value of the ‘chkMessage’ string.
chkMessage = chkMessage + "" + ByteToString(hashmessage) +
"";
Figure 23: Generating an HMAC hash signature
5.2.5 Encrypting
Figure 24 shows the code that is used to encrypt the Event Message, the code for it is
from a program by Mathew Schlabaugh (CodeProject, 2008). The cipher text is
generated by breaking down the plain text into blocks that are smaller than the key
that is used to encode them. The smaller blocks are then encoded with the Servers
public key, this then makes them ready to be sent to the server.
43