Struct MitigationPlan 

pub struct MitigationPlan { /* private fields */ }

Builder for mitigation application.

Implementations

impl MitigationPlan

pub fn new() -> Self

Create an empty mitigation plan.

pub fn enable(self, mitigation: ProcessMitigation) -> Self

Enable one mitigation in this plan.

pub fn apply_to_current(&self) -> Result<()>

Apply all configured mitigations to the current process.

pub fn emit_compile_time(&self)

Emit compile-time linker directives for enabled mitigations.

This method prints cargo:rustc-link-arg directives to stdout, intended for use in a build.rs script. Each linker directive enables binary-level protections on the compiled executable.

Supported Mitigations

Only mitigations with direct binary-level equivalents emit directives:

• MicrosoftSignedOnly → /DEPENDENTLOADFLAG:0x800 + /INTEGRITYCHECK
• DisableDynamicCode → /guard:cf (Control Flow Guard)
• RestrictPayload → /HIGHENTROPYVA (High Entropy ASLR)

The following are runtime-only and produce no compile-time output:

• BlockRemoteImages, PreferSystem32Images, BlockChildProcessCreation

Example (in build.rs)

use windows_erg::mitigation::{MitigationPlan, ProcessMitigation};

let plan = MitigationPlan::new()
    .enable(ProcessMitigation::DisableDynamicCode)
    .enable(ProcessMitigation::MicrosoftSignedOnly);

plan.emit_compile_time();

pub fn emit_compile_time_with_compat(&self, enable_compat: bool)

Emit compile-time linker directives with optional CET Shadow Stack support.

Similar to [emit_compile_time], but optionally adds /CETCOMPAT for hardware-enforced stack protection (Control-flow Enforcement Technology). Requires Windows 11+ and compatible CPU.

Arguments

• enable_compat - If true, additionally emits /CETCOMPAT

Example (in build.rs)

use windows_erg::mitigation::{MitigationPlan, ProcessMitigation};

let plan = MitigationPlan::new()
    .enable(ProcessMitigation::DisableDynamicCode);

plan.emit_compile_time_with_compat(true);

Trait Implementations

impl Clone for MitigationPlan

fn clone(&self) -> MitigationPlan

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MitigationPlan

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MitigationPlan

fn default() -> MitigationPlan

Returns the “default value” for a type.