package
2.0.0+incompatible
Repository: https://github.com/rabbitstack/fibratus.git
Documentation: pkg.go.dev

# Packages

No description provided by the author

# Functions

EnableTokenPrivileges enables the specified privileges in the given Token.
EnumDevices returns metadata about device drivers encountered in the system.
GetLogicalDrives returns available device drive letters in the system.
GetMappedFile checks whether the specified address is within a memory-mapped file in the address space of the specified process.
IsProcessRunning determines whether the process is in a running state.
IsWintrustFound indicates if the wintrust DLL is present in the system.
LookupActiveWTS finds the active Windows Terminal Session.
NewWintrustData creates a new instance of WintrustData prepared to verify file or catalog trust.
PathIsDirectory determines if the provided path is a directory.
QueryDosDevice translates the DOS device name to hard disk drive letter.
QueryInformationProcess consults the specified process information class and returns a pointer to the structure containing process information.
QueryObject consults the specified object information class and returns a pointer to the structure containing object information.
ReadProcessMemory reads from the process virtual address space starting at specified address.
SetDebugPrivilege sets the debug privilege in the current running process.

# Constants

AlpcBasicPortInformationClass is the information class for obtaining basic ALPC port information.
DevSize specifies the initial size used to allocate the driver base addresses.
ErrorNotAllAsigned specifies that the token does not have one or more of the privileges specified in the state parameter.
No description provided by the author
InvalidProcessID represents the value of an invalid process identifier.
MutantBasicInformationClass is the information class for getting basic mutant information.
ObjectNameInformationClass returns the object name information.
ObjectTypeInformationClass returns the object type information.
ObjectTypesInformationClass returns handle object types.
PrivilegedEnabled enables the privilege.
ProcessStatusStillActive represents the status of the running process.
SeDebugPrivilege is the name of the privilege used to debug programs.
WtdChoiceCatalog specifies the file object is verified through catalog by the trust provider.
WtdChoiceFile specifies the file object is verified by the trust provider.
WtdRevokeNone dictates that no additional revocation checking will be done when the WtdRevokeNone flag is used in conjunction with the HTTPSPROV_ACTION value set in the action parameter of the WinVerifyTrust function.
WtdSaferFlag is the trust provider flag.
WtdStateActionClose frees the StateData member previously allocated with the WtdStateActionVerify action.
WtdStateActionVerify verifies the trust of the object (typically a file) that is specified by the UnionChoice member.
WtdUIAll display all UI interface.
WtdUINoBad do not display any negative UI.
WtdUINoGood do not display any positive UI.
WtdUINone display no UI.
WTSUserName is the WTS class that returns a null-terminated string containing the name of the user associated with the active session.

# Variables

ErrNoSession signals that the active Windows Terminal Session is not available.
WintrustActionGenericVerifyV2 is the action that indicates the file or object should be verified by using the Authenticode policy provider.

# Structs

CatalogInfo structure contains the name of a catalog file.
Driver contains device driver metadata for each driver found in the system.
FileFsDeviceInformation provides file system device information about the type of device object associated with a file object.
No description provided by the author
ObjectNameInformation stores object name information.
ObjectTypeInformation contains object type data.
ObjectTypesInformation stores the number of resolved object type names.
ProcessHandleSnapshotInformation is the structure that holds the process handle table.
ProcessHandleTableEntryInfo is the structure that describes the process handle entry.
SystemHandleInformationEx is the structures that holds the process handle table.
SystemHandleTableEntryInfoEx is the structure that describes the process handle entry.
WintrustCatalogInfo structure is used when calling WinVerifyTrust to verify a member of a Microsoft catalog.
WintrustData structure is used when calling WinVerifyTrust to pass necessary information into the trust providers.
WintrustFileInfo structure is used when calling WinVerifyTrust to verify an individual file.
WintrustSignatureSettings structure can be used to specify the signatures on a file.
WTS contains information about the current Windows Terminal Session.