Skip to content

Commit

Permalink
Merge remote-tracking branch 'origin/master'
Browse files Browse the repository at this point in the history
  • Loading branch information
sn99 committed Oct 29, 2022
2 parents e324f56 + a03b203 commit be6e7e7
Showing 1 changed file with 14 additions and 9 deletions.
23 changes: 14 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
[![Rust](https://github.com/sn99/fsfilter-rs/actions/workflows/rust.yml/badge.svg)](https://github.com/sn99/fsfilter-rs/actions/workflows/rust.yml)
[![Crates.io](https://img.shields.io/crates/v/fsfilter-rs?style=flat-square)](https://crates.io/crates/fsfilter-rs)

A rust library to monitor filesystem and more in windows
A rust library to monitor filesystem and more in windows.

Prepared as part of ongoing thesis work at uni.

Expand All @@ -14,14 +14,16 @@ Prepared as part of ongoing thesis work at uni.
See [MINIFILTER.md](MINIFILTER.md) for building the minifilter or just [right click install using the `.inf` file
provided in releases](https://github.com/sn99/fsfilter-rs/releases/latest/download/snFilter.zip).

**NOTE: By default it is built for Windows 10 and above**
**NOTE: By default it is built for Windows 10 and above.**

**NOTE: Enable Loading of Test Signed Drivers by executing `Bcdedit.exe -set TESTSIGNING ON` in administrative cmd**
**NOTE: Enable Loading of Test Signed Drivers by executing `Bcdedit.exe -set TESTSIGNING ON` in administrative cmd.**

### RUNNING EXAMPLE

Use `cargo run --bin minifilter --release` to run the example application. The program starts to print the `IOMessage`
which is defined like:
Use `cargo run --bin minifilter --release` to run the example application or just [run the `.exe` provided in
releases](https://github.com/sn99/fsfilter-rs/releases/latest/download/minifilter.exe).

The program starts to print the `IOMessage` which is defined like:

```rust
#[repr(C)]
Expand All @@ -43,12 +45,15 @@ pub struct IOMessage {
}
```

We end the process using `ctrl + c` in the example video:
![video](readme_resources/example.gif)

## PERFORMANCE

The performance of the minifilter doesn't really exceed `1%` of the CPU usage (I never saw it tickle even to 1% while
The performance of the minifilter doesn't really exceed `<1%` of the CPU usage (I never saw it tickle even to 1% while
running scripts to make multiple temporary files). Although depending on you console if you try running
`cargo run --bin minifilter` you might see spikes reaching `1-3%` but that is because of the console itself (comment out
the `writeln!` in the bin example).
`cargo run --bin minifilter --release` you might see spikes reaching `1-3%` but that is because of the console itself (comment out
the `writeln!` in the bin example) or try changing consoles (maybe run `minifilter.exe` directly).

## LICENSE

Expand All @@ -58,4 +63,4 @@ This project is licensed under the terms of the [MIT license](LICENSE.md).

- [RansomWatch](https://github.com/RafWu/RansomWatch)
- [SitinCloud](https://github.com/SitinCloud)
- [SubconsciousCompute](https://github.com/SubconsciousCompute)
- [SubconsciousCompute](https://github.com/SubconsciousCompute)

0 comments on commit be6e7e7

Please sign in to comment.