Enum Bus 

pub enum Bus {
    Usb,
    Mtp,
    FireWire,
    Thunderbolt,
    Pcie,
    Esata,
    SdMmc,
    Bluetooth,
    ExpressCard,
    ScsiSas,
    Nvme,
    Unknown,
}

The physical/logical bus a peripheral attached through.

The variant drives the DMA-capability and storage-class threat lenses downstream (see DeviceConnection::dma_capable).

Variants

Usb

USB (host-controller mediated; not directly DMA-capable as mass storage).

Mtp

Media Transfer Protocol (phones/cameras) — surfaced via WpdBusEnumRoot.

FireWire

IEEE 1394 FireWire — bus-mastering DMA.

Thunderbolt

Thunderbolt — PCIe tunnelled, bus-mastering DMA.

Pcie

PCI Express — bus-mastering DMA.

Esata

External SATA — SATA/storage transport, explicitly NOT DMA.

SdMmc

SD/MMC card.

Bluetooth

Bluetooth (typically HID/wireless).

ExpressCard

ExpressCard — PCIe-backed, bus-mastering DMA.

ScsiSas

SCSI / SAS storage transport.

Nvme

NVMe storage.

Unknown

Bus could not be determined from the enumerator.

Implementations

impl Bus

pub fn from_enumerator(enumerator: &str) -> Self

Classify a bus from a setupapi/instance-id enumerator prefix — the leading token of a device instance id (USBSTOR, USB, 1394, PCI, SCSI, SD, WpdBusEnumRoot, …), matched case-insensitively.

Returns Bus::Unknown for an unrecognized or empty enumerator; the caller never gets a panic.

pub fn is_dma_capable(self) -> bool

Whether this bus can perform bus-mastering DMA, the property that makes a device a direct-memory-access attack surface (MITRE T1200).

DMA-capable: FireWire, Thunderbolt, PCIe, ExpressCard. Storage-class transports (USB mass storage, eSATA, SD/MMC, SCSI/SAS, NVMe) and HID/wireless transports (USB-HID, Bluetooth) are NOT DMA in this model.

Caveat: SD-Express tunnels PCIe and can be DMA-capable; this v0.1 classifier treats bare SD as the legacy non-DMA SD/MMC bus, the common case. Distinguishing SD-Express needs the device-capability bits that the registry/EVTX v0.2 source carries.

pub fn is_mass_storage(self) -> bool

Whether this bus is a removable mass-storage transport (the data-exfiltration / autorun lens, MITRE T1052.001 / T1091).

Trait Implementations

impl Clone for Bus

fn clone(&self) -> Bus

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Bus

impl Debug for Bus

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Bus

impl Hash for Bus

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for Bus

fn eq(&self, other: &Bus) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Bus