Struct es_event_iokit_open_t

#[repr(C)]
pub struct es_event_iokit_open_t {
    pub user_client_type: u32,
    pub user_client_class: es_string_token_t,
    /* private fields */
}

Available on macOS only.

Open a connection to an I/O Kit IOService.

This event is fired when a process calls IOServiceOpen() in order to open a communications channel with an I/O Kit driver. The event does not correspond to driver <-> device communication and is neither providing visibility nor access control into devices being attached.

This event type does not support caching.

Fields

user_client_type: u32

A constant specifying the type of connection to be created, interpreted only by the IOService’s family. This field corresponds to the type argument to IOServiceOpen().

user_client_class: es_string_token_t

Meta class name of the user client instance