Struct IOMessage 

#[repr(C)]
pub struct IOMessage {

    pub extension: [wchar_t; 12],
    pub file_id_vsn: c_ulonglong,
    pub file_id_id: [u8; 16],
    pub mem_sized_used: c_ulonglong,
    pub entropy: f64,
    pub pid: c_ulong,
    pub irp_op: c_uchar,
    pub is_entropy_calc: u8,
    pub file_change: c_uchar,
    pub file_location_info: c_uchar,
    pub filepathstr: String,
    pub gid: c_ulonglong,
    pub runtime_features: RuntimeFeatures,
    pub file_size: i64,
    pub time: SystemTime,
}

Represents a driver message.

Fields

extension: [wchar_t; 12]

The file extension

file_id_vsn: c_ulonglong

Hard Disk Volume Serial Number where the file is saved (from FILE_ID_INFO)

file_id_id: [u8; 16]

File ID on the disk (FILE_ID_INFO)

mem_sized_used: c_ulonglong

Number of bytes transferred (IO_STATUS_BLOCK.Information)

entropy: f64

(Optional) File Entropy calculated by the driver

pid: c_ulong

Pid responsible for this io activity

irp_op: c_uchar

Windows IRP Type caught by the minifilter:

• NONE (0)
• READ (1)
• WRITE (2)
• SETINFO (3)
• CREATE (4)
• CLEANUP (5)

is_entropy_calc: u8

Is the entropy calculated?

file_change: c_uchar

Type of i/o operation:

• FILE_CHANGE_NOT_SET (0)
• FILE_OPEN_DIRECTORY (1)
• FILE_CHANGE_WRITE (2)
• FILE_CHANGE_NEW_FILE (3)
• FILE_CHANGE_RENAME_FILE (4)
• FILE_CHANGE_EXTENSION_CHANGED (5)
• FILE_CHANGE_DELETE_FILE (6)
• FILE_CHANGE_DELETE_NEW_FILE (7)
• FILE_CHANGE_OVERWRITE_FILE (8)

file_location_info: c_uchar

The driver has the ability to monitor specific directories only (feature currently not used):

• FILE_NOT_PROTECTED (0): Monitored dirs do not contained this file
• FILE_PROTECTED (1)
• FILE_MOVED_IN (2)
• FILE_MOVED_OUT (3)

filepathstr: String

File path on the disk

gid: c_ulonglong

Group Identifier (maintained by the minifilter) of the operation

runtime_features: RuntimeFeatures

see class RuntimeFeatures

file_size: i64

Size of the file. Can be equal to -1 if the file path is not found.

time: SystemTime

Rough time at which the IRP was created

Implementations

impl IOMessage

pub fn from(c_drivermsg: &CDriverMsg) -> Self

Make a new IOMessage from a received CDriverMsg

pub fn exepath(&mut self)

Opens an existing local process object to retrieve the name of the executable file for the specified process.

Trait Implementations

impl Clone for IOMessage

fn clone(&self) -> IOMessage

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IOMessage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IOMessage

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Ord for IOMessage

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for IOMessage

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for IOMessage

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for IOMessage

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for IOMessage