Struct owlyshield_ransom::driver_com::Driver

pub struct Driver {
    handle: HANDLE,
}

A minifilter is identified by a port (know in advance), like a named pipe used for communication, and a handle, retrieved by Self::open_kernel_driver_com.

Fields

handle: HANDLE

Implementations

impl Driver

pub fn _close_kernel_communication(&self) -> bool

Can be used to properly close the communication (and unregister) with the minifilter. If this fn is not used and the program has stopped, the handle is automatically closed, seemingly without any side-effects.

pub fn driver_set_app_pid(&self) -> Result<(), Error>

The usermode running app (this one) has to register itself to the driver.

pub fn open_kernel_driver_com() -> Result<Driver, Error>

Try to open a com canal with the minifilter before this app is registered. This fn can fail is the minifilter is unreachable:

• if it is not started (try sc start owlyshieldransomfilter first
• if a connection is already established: it can accepts only one at a time. In that case the Error is raised by the OS (windows::Error) and is generally readable.

pub fn get_irp(&self, vecnew: &mut Vec<u8>) -> Option<ReplyIrp>

Ask the driver for a ReplyIrp, if any. This is a low-level function and the returned object uses C pointers. Managing C pointers requires a special care, because of the Rust timelines. ReplyIrp is optional since the minifilter returns null if there is no new activity.

pub fn try_kill(&self, gid: c_ulonglong) -> Result<HRESULT, Error>

Ask the minifilter to kill all pids related to the given gid. Pids are killed in drivermode by calls to NtClose.

fn string_to_commessage_buffer(bufstr: &str) -> [wchar_t; 520]

fn build_irp_msg(
    commsgtype: DriverComMessageType,
    pid: Pid,
    gid: u64,
    path: &str
) -> DriverComMessage

Trait Implementations

impl Debug for Driver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.