Struct KernelRootkit 

#[non_exhaustive]
pub struct KernelRootkit {
    pub name: String,
    pub unexpected_code_modification: bool,
    pub unexpected_read_only_data_modification: bool,
    pub unexpected_ftrace_handler: bool,
    pub unexpected_kprobe_handler: bool,
    pub unexpected_kernel_code_pages: bool,
    pub unexpected_system_call_handler: bool,
    pub unexpected_interrupt_handler: bool,
    pub unexpected_processes_in_runqueue: bool,
    /* private fields */
}

Kernel mode rootkit signatures.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

name: String

Rootkit name, when available.

unexpected_code_modification: bool

True if unexpected modifications of kernel code memory are present.

unexpected_read_only_data_modification: bool

True if unexpected modifications of kernel read-only data memory are present.

unexpected_ftrace_handler: bool

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

unexpected_kprobe_handler: bool

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

unexpected_kernel_code_pages: bool

True if kernel code pages that are not in the expected kernel or module code regions are present.

unexpected_system_call_handler: bool

True if system call handlers that are are not in the expected kernel or module code regions are present.

unexpected_interrupt_handler: bool

True if interrupt handlers that are are not in the expected kernel or module code regions are present.

unexpected_processes_in_runqueue: bool

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

Implementations

impl KernelRootkit

pub fn new() -> Self

pub fn set_name<T: Into<String>>(self, v: T) -> Self

Sets the value of name.

Example

let x = KernelRootkit::new().set_name("example");

pub fn set_unexpected_code_modification<T: Into<bool>>(self, v: T) -> Self

Sets the value of unexpected_code_modification.

Example

let x = KernelRootkit::new().set_unexpected_code_modification(true);

pub fn set_unexpected_read_only_data_modification<T: Into<bool>>( self, v: T, ) -> Self

Sets the value of unexpected_read_only_data_modification.

Example

let x = KernelRootkit::new().set_unexpected_read_only_data_modification(true);

pub fn set_unexpected_ftrace_handler<T: Into<bool>>(self, v: T) -> Self

Sets the value of unexpected_ftrace_handler.

Example

let x = KernelRootkit::new().set_unexpected_ftrace_handler(true);

pub fn set_unexpected_kprobe_handler<T: Into<bool>>(self, v: T) -> Self

Sets the value of unexpected_kprobe_handler.

Example

let x = KernelRootkit::new().set_unexpected_kprobe_handler(true);

pub fn set_unexpected_kernel_code_pages<T: Into<bool>>(self, v: T) -> Self

Sets the value of unexpected_kernel_code_pages.

Example

let x = KernelRootkit::new().set_unexpected_kernel_code_pages(true);

pub fn set_unexpected_system_call_handler<T: Into<bool>>(self, v: T) -> Self

Sets the value of unexpected_system_call_handler.

Example

let x = KernelRootkit::new().set_unexpected_system_call_handler(true);

pub fn set_unexpected_interrupt_handler<T: Into<bool>>(self, v: T) -> Self

Sets the value of unexpected_interrupt_handler.

Example

let x = KernelRootkit::new().set_unexpected_interrupt_handler(true);

pub fn set_unexpected_processes_in_runqueue<T: Into<bool>>(self, v: T) -> Self

Sets the value of unexpected_processes_in_runqueue.

Example

let x = KernelRootkit::new().set_unexpected_processes_in_runqueue(true);

Trait Implementations

impl Clone for KernelRootkit

fn clone(&self) -> KernelRootkit

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KernelRootkit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for KernelRootkit

fn default() -> KernelRootkit

Returns the “default value” for a type.

impl Message for KernelRootkit

fn typename() -> &'static str

The typename of this message.

impl PartialEq for KernelRootkit

fn eq(&self, other: &KernelRootkit) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for KernelRootkit