1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
.. _third-party-modules-ping:
"third-party-modules" ping
==========================
This ping contains information about events whereby third-party modules
were loaded into Firefox processes.
.. code-block:: js
{
"type": "third-party-modules",
... common ping data
"clientId": <UUID>,
"environment": { ... },
"payload": {
"structVersion": 1,
// List of DLL filenames that are on the dynamic blocklist
"blockedModules": [<string>],
"modules": [
{
// The sanitized name of the module as resolved by the Windows loader.
"resolvedDllName": <string>,
// Version of the DLL as contained in its resources's fixed version information.
"fileVersion": <string>,
// The value of the CompanyName field as extracted from the DLL's version information. This property is only present when such version info is present, and when the 'signedBy' property is absent.
"companyName": <string>,
// The organization whose certificate was used to sign the DLL. Only present for signed modules.
"signedBy": <string>,
// Flags that indicate this module's level of trustworthiness. This corresponds to one or more mozilla::ModuleTrustFlags OR'd together.
"trustFlags": <unsigned int>
},
... Additional modules (maximum 100)
],
"processes": {
<string containing processType and pid, formatted as `${processType}.0x${pid}">`: {
// Except for Default (which is remapped to "browser"), one of the process string names specified in xpcom/build/GeckoProcessTypes.h.
"processType": <string>,
// Elapsed time since process creation that this object was generated, in seconds.
"elapsed": <number>,
// Time spent loading xul.dll in milliseconds.
"xulLoadDurationMS": <number>,
// Number of dropped events due to failures sanitizing file paths.
"sanitizationFailures": <int>,
// Number of dropped events due to failures computing trust levels.
"trustTestFailures": <int>,
// Array of module load events for this process. The entries of this array are ordered to be in sync with the combinedStacks.stacks array (see below)
"events": [
{
// Elapsed time since process creation that this event was generated, in milliseconds.
"processUptimeMS": <int>,
// Time spent loading this module, in milliseconds.
"loadDurationMS": <number>,
// Thread ID for the thread that loaded the module.
"threadID": <int>,
// Name of the thread that loaded the module, when applicable.
"threadName": <string>,
// The sanitized name of the module that was requested by the invoking code. Only exists when it is different from resolvedDllName.
"requestedDllName": <string>,
// The base address to which the loader mapped the module.
"baseAddress": <string formatted as "0x%x">,
// Index of the element in the modules array that contains details about the module that was loaded during this event.
"moduleIndex": <int>,
// True if the module is included in the executable's Import Directory Table.
"isDependent": <bool>,
// The status of DLL load. This corresponds to enum ModuleLoadInfo::Status.
"loadStatus": <int>
},
... Additional events (maximum 50)
],
"combinedStacks": [
"memoryMap": [
[
// Name of the module symbol file, e.g. ``xul.pdb``
<string>,
// Breakpad identifier of the module, e.g. ``08A541B5942242BDB4AEABD8C87E4CFF2``
<string>
],
... Additional modules
],
// Array of stacks for this process. These entries are ordered to be in sync with the events array
"stacks": [
[
[
// The module index or -1 for invalid module indices
<integer>,
// The program counter relative to its module base, or an absolute pc if the module index is -1
<unsigned integer>
],
... Additional stack frames (maximum 512)
],
... Additional stack traces (maximum 50)
]
]
},
... Additional processes (maximum 100)
}
}
}
payload.processes[...].events[...].resolvedDllName
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The effective path to the module file, sanitized to remove any potentially
sensitive information. In most cases, the directory path is removed leaving only
the leaf name, e.g. ``foo.dll``. There are three exceptions:
* Paths under ``%ProgramFiles%`` are preserved, e.g. ``%ProgramFiles%\FooApplication\foo.dll``
* Paths under ``%SystemRoot%`` are preserved, e.g. ``%SystemRoot%\System32\DriverStore\FileRepository\nvlt.inf_amd64_97992900c592012e\nvinitx.dll``
* Paths under the temporary path are preserved, e.g. ``%TEMP%\bin\foo.dll``
payload.processes[...].events[...].requestedDllName
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The name of the module as it was requested from the OS. This string is also
sanitized in a similar fashion to to ``resolvedDllName``. This string is
omitted from the ping when it is identical to ``resolvedDllName``.
Notes
~~~~~
* The client id is submitted with this ping.
* The :doc:`Telemetry Environment <../data/environment>` is submitted in this ping.
* String fields within ``payload`` are limited in length to 260 characters.
* This ping is sent once daily.
* If there are no events to report, this ping is not sent.
Version History
~~~~~~~~~~~~~~~
- Firefox 110: Added ``blockedModules`` (`bug 1808158 <https://bugzilla.mozilla.org/show_bug.cgi?id=1808158>`_).
- Firefox 77: Added ``isDependent`` (`bug 1620118 <https://bugzilla.mozilla.org/show_bug.cgi?id=1620118>`_).
- Firefox 71: Renamed from untrustedModules to third-party-modules with a revised schema (`bug 1542830 <https://bugzilla.mozilla.org/show_bug.cgi?id=1542830>`_).
- Firefox 70: Added ``%SystemRoot%`` as an exemption to path sanitization (`bug 1573275 <https://bugzilla.mozilla.org/show_bug.cgi?id=1573275>`_).
- Firefox 66:
- Added Windows Side-by-side directory trust flag (`bug 1514694 <https://bugzilla.mozilla.org/show_bug.cgi?id=1514694>`_).
- Added module load times (``xulLoadDurationMS``, ``loadDurationMS``) and xul.dll trust flag (`bug 1518490 <https://bugzilla.mozilla.org/show_bug.cgi?id=1518490>`_).
- Added SysWOW64 trust flag (`bug 1518798 <https://bugzilla.mozilla.org/show_bug.cgi?id=1518798>`_).
- Firefox 65: Initial support (`bug 1435827 <https://bugzilla.mozilla.org/show_bug.cgi?id=1435827>`_).
|
