Struct Driver 

pub struct Driver { /* private fields */ }

A minifilter is identified by a port (know in advance), like a named pipe used for communication, and a handle, retrieved by open_kernel_driver_com.

Implementations

impl Driver

pub fn close_kernel_communication(&self) -> bool

Can be used to properly close the communication (and unregister) with the minifilter. If this fn is not used and the program has stopped, the handle is automatically closed, seemingly without any side-effects.

pub fn driver_set_app_pid(&self) -> Result<(), Error>

The user-mode running app (this one) has to register itself to the driver.

Panics

This fn panics if it is unable to get the current pid.

Errors

This fn returns an error if it is unable to register itself to the minifilter.

pub fn open_kernel_driver_com() -> Result<Self, Error>

Try to open a com canal with the minifilter before this app is registered.

Panics

This function will panic if the minifilter port has any nul value (except the last one) in it’s name.

Errors

This fn can fail is the minifilter is unreachable:

• if it is not started (try sc start snFilter first
• if a connection is already established: it can accepts only one at a time.

In that case the Error is raised by the OS (windows::Error) and is generally readable.

pub fn get_irp(&self, vecnew: &mut Vec<u8>) -> Option<ReplyIrp>

Ask the driver for a ReplyIrp, if any. This is a low-level function and the returned object uses C pointers. Managing C pointers requires a special care, because of the Rust timelines. ReplyIrp is optional since the minifilter returns null if there is no new activity.

Panics

This fn panics if it is unable to get the current pid or cannot get driver message from the minifilter.

pub fn try_kill(&self, gid: c_ulonglong) -> Result<HRESULT, Error>

Ask the minifilter to kill all pids related to the given gid. Pids are killed in driver-mode by calls to NtClose.

Trait Implementations

impl Debug for Driver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.