Giter Club home page Giter Club logo

fsfilter-rs's Introduction

fsfilter-rs

Rust Crates.io docs.rs

A rust library to monitor filesystem and more in windows.

shared_def

Also see poc-windows-rust-filter for a pure Rust minifilter.

MINIFILTER

See MINIFILTER.md for building the minifilter or just right click install using the .inf file provided in releases.

You can also build using EWDK if you don't want to install Visual Studio, SDK and WDK.

NOTE: By default, it is built for Windows 10 and above.

NOTE: Enable Loading of Test Signed Drivers by executing Bcdedit.exe -set TESTSIGNING ON in administrative cmd.

RUNNING EXAMPLE

Use cargo run --bin minifilter --release to run the example application or just run the .exe provided in releases as administrator( for some reason the new default terminal (not the one that opens when you run it as administrator) on 2H22 is very, very slow).

The program starts to print the IOMessage which is defined like:

#[repr(C)]
pub struct IOMessage {
    /// The file extension
    pub extension: [wchar_t; 12],
    /// Hard Disk Volume Serial Number where the file is saved (from [`FILE_ID_INFO`])
    pub file_id_vsn: c_ulonglong,
    /// File ID on the disk ([`FILE_ID_INFO`])
    pub file_id_id: [u8; 16],
    /// Number of bytes transferred (`IO_STATUS_BLOCK.Information`)
    pub mem_sized_used: c_ulonglong,
    /// (Optional) File Entropy calculated by the driver
    pub entropy: f64,
    /// Pid responsible for this io activity
    pub pid: c_ulong,
    /// Windows IRP Type caught by the minifilter:
    /// - NONE (0)
    /// - READ (1)
    /// - WRITE (2)
    /// - SETINFO (3)
    /// - CREATE (4)
    /// - CLEANUP (5)
    pub irp_op: c_uchar,
    /// Is the entropy calculated?
    pub is_entropy_calc: u8,
    /// Type of i/o operation:
    /// - FILE_CHANGE_NOT_SET (0)
    /// - FILE_OPEN_DIRECTORY (1)
    /// - FILE_CHANGE_WRITE (2)
    /// - FILE_CHANGE_NEW_FILE (3)
    /// - FILE_CHANGE_RENAME_FILE (4)
    /// - FILE_CHANGE_EXTENSION_CHANGED (5)
    /// - FILE_CHANGE_DELETE_FILE (6)
    /// - FILE_CHANGE_DELETE_NEW_FILE (7)
    /// - FILE_CHANGE_OVERWRITE_FILE (8)
    pub file_change: c_uchar,
    /// The driver has the ability to monitor specific directories only (feature currently not used):
    /// - FILE_NOT_PROTECTED (0): Monitored dirs do not contained this file
    /// - FILE_PROTECTED (1)
    /// - FILE_MOVED_IN (2)
    /// - FILE_MOVED_OUT (3)
    pub file_location_info: c_uchar,
    /// File path on the disk
    pub filepathstr: String,
    /// Group Identifier (maintained by the minifilter) of the operation
    pub gid: c_ulonglong,
    /// see class [`RuntimeFeatures`]
    pub runtime_features: RuntimeFeatures,
    /// Size of the file. Can be equal to -1 if the file path is not found.
    pub file_size: i64,
    /// Rough time at which the IRP was created
    pub time: SystemTime,
}

We end the process using ctrl + c in the example video: video

PERFORMANCE

The performance of the minifilter doesn't really exceed <1% of the CPU usage (I never saw it tickle even to 1% while running scripts to make multiple temporary files). Although depending on you console if you try running cargo run --bin minifilter --release you might see spikes reaching 1-3% but that is because of the console itself( comment out the writeln! in the bin example) or try changing consoles (maybe run minifilter.exe directly).

DEBUGGING

See DEBUG for setting up VMware windows machine debugging with VirtualKD-Redux and WinDbg.

MAINTAINERS

Feel free to open issues to ask any questions/queries. You're free to ping the current maintainers.

Currently maintained by the following:

  • sn99 (original author)

Previous maintainers:

  • N/A

LICENSE

This project is licensed under the terms of the MIT license.

ACKNOWLEDGEMENTS

fsfilter-rs's People

Contributors

olljanat avatar sn99 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

fsfilter-rs's Issues

Minifilter.exe Access Violation on Windows 11 VirtualBox VM

Upon further inspection, changing the "extension" attribute for the IOMessage struct from [wchar_t; 12] to [wchar_t; 24] did the trick and it ran fine after that. This was done in src/shared_def.rs at lines 110, 179, and 350.

The length of the message coming from the driver just needed a larger struct to hold it. I'm unsure if this is different on different versions of Windows, but it might be worth looking into.

Thank you!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.