Struct KernelRootkit 

pub struct KernelRootkit {
    pub name: Option<String>,
    pub unexpected_code_modification: Option<bool>,
    pub unexpected_ftrace_handler: Option<bool>,
    pub unexpected_interrupt_handler: Option<bool>,
    pub unexpected_kernel_code_pages: Option<bool>,
    pub unexpected_kprobe_handler: Option<bool>,
    pub unexpected_processes_in_runqueue: Option<bool>,
    pub unexpected_read_only_data_modification: Option<bool>,
    pub unexpected_system_call_handler: Option<bool>,
}

Kernel mode rootkit signatures.

This type is not used in any activity, and only used as part of another schema.

Fields

name: Option<String>

Rootkit name, when available.

unexpected_code_modification: Option<bool>

True if unexpected modifications of kernel code memory are present.

unexpected_ftrace_handler: Option<bool>

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

unexpected_interrupt_handler: Option<bool>

True if interrupt handlers that are are not in the expected kernel or module code regions are present.

unexpected_kernel_code_pages: Option<bool>

True if kernel code pages that are not in the expected kernel or module code regions are present.

unexpected_kprobe_handler: Option<bool>

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

unexpected_processes_in_runqueue: Option<bool>

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

unexpected_read_only_data_modification: Option<bool>

True if unexpected modifications of kernel read-only data memory are present.

unexpected_system_call_handler: Option<bool>

True if system call handlers that are are not in the expected kernel or module code regions are present.

Trait Implementations

impl Clone for KernelRootkit

fn clone(&self) -> KernelRootkit

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KernelRootkit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for KernelRootkit

fn default() -> KernelRootkit

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for KernelRootkit

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for KernelRootkit

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Part for KernelRootkit