Struct owlyshield_ransom::driver_com::shared_def::IOMessage

#[repr(C)]
pub struct IOMessage {

    pub extension: [wchar_t; 12],
    pub file_id_vsn: c_ulonglong,
    pub file_id_id: [u8; 16],
    pub mem_sized_used: c_ulonglong,
    pub entropy: f64,
    pub pid: c_ulong,
    pub irp_op: c_uchar,
    pub is_entropy_calc: u8,
    pub file_change: c_uchar,
    pub file_location_info: c_uchar,
    pub filepathstr: String,
    pub gid: c_ulonglong,
    pub runtime_features: RuntimeFeatures,
    pub file_size: i64,
}

Represents a driver message.

• extension: The file extension
• file_id_vsn: Hard Disk Volume Serial Number where the file is saved (from FILE_ID_INFO)
• file_id_id: File ID on the disk (FILE_ID_INFO)
• mem_size_used: Number of bytes transferred (IO_STATUS_BLOCK.Information)
• entropy: (Optional) File Entropy calculated by the driver
• is_entropy_calc: is the entropy calculated?
• pid: Pid responsible for this io activity
• irp_op: Windows IRP Type catched by the minifilter:
  • NONE (0)
  • READ (1)
  • WRITE (2)
  • SETINFO (3)
  • CREATE (4)
  • CLEANUP (5)
• file_change: type of i/o operation:
  • FILE_CHANGE_NOT_SET (0)
  • FILE_OPEN_DIRECTORY (1)
  • FILE_CHANGE_WRITE (2)
  • FILE_CHANGE_NEW_FILE (3)
  • FILE_CHANGE_RENAME_FILE (4)
  • FILE_CHANGE_EXTENSION_CHANGED (5)
  • FILE_CHANGE_DELETE_FILE (6)
  • FILE_CHANGE_DELETE_NEW_FILE (7)
  • FILE_CHANGE_OVERWRITE_FILE (8)
• file_location_info: the driver has the ability to monitor specific directories only (feature currently not used):
  • FILE_NOT_PROTECTED (0): Monitored dirs do not contained this file
  • FILE_PROTECTED (1)
  • FILE_MOVED_IN (2)
  • FILE_MOVED_OUT (3)
• filepath: File path on the disk
• gid: Group Identifier (maintained by the minifilter) of the operation
• runtime_features: see class RuntimeFeatures
• file_size: size of the file. Can be equal to -1 if the file path is not found.

Fields

extension: [wchar_t; 12]

file_id_vsn: c_ulonglong

file_id_id: [u8; 16]

mem_sized_used: c_ulonglong

entropy: f64

pid: c_ulong

irp_op: c_uchar

is_entropy_calc: u8

file_change: c_uchar

file_location_info: c_uchar

filepathstr: String

gid: c_ulonglong

runtime_features: RuntimeFeatures

file_size: i64

Implementations

impl IOMessage

pub fn from(c_drivermsg: &CDriverMsg) -> IOMessage

Trait Implementations

impl Clone for IOMessage

fn clone(&self) -> IOMessage

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IOMessage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IOMessage

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
    __D: Deserializer<'de>, 

Deserialize this value from the given Serde deserializer.

impl Serialize for IOMessage

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error> where
    __S: Serializer, 

Serialize this value into the given Serde serializer.