Dev win plugins rs

.github/workflows/ci-edriver.yaml

@@ -103,6 +103,12 @@ jobs:
       - name: Cache cargo registry
         uses: actions/cache@v4
         with:
+          # Intentionally do NOT cache plugins/edriver/target across commits:
+          # Cargo's build-script fingerprint does not always invalidate on
+          # [build].rustflags / config.toml changes, so a restored stale
+          # target/ would reuse a build-script binary linked without -lzstd
+          # and break the ZSTD fix. Re-linking from scratch is cheap; the
+          # registry cache (much larger) still provides the speedup.
           path: |
             ~/.cargo/registry
             ~/.cargo/git

README-zh_CN.md

@@ -37,6 +37,7 @@ Hades 是一个基于 eBPF 的主机入侵检测系统，同时兼容低版本
 - [EDriver](https://github.com/chriskaliX/Hades/tree/main/plugins/edriver)
 - [Collector](https://github.com/chriskaliX/Hades/tree/main/plugins/collector)
 - [Eguard](https://github.com/chriskaliX/Hades/tree/main/plugins/eguard)
+- [WDriver](https://github.com/chriskaliX/Hades/tree/main/plugins/wdriver)
 - [NCP](https://github.com/chriskaliX/Hades/tree/main/plugins/ncp)
 - Scanner
 - Logger

README.md

@@ -41,6 +41,7 @@ Declaration: This project is based on [Tracee](https://github.com/aquasecurity/t
 - [EDriver](https://github.com/chriskaliX/Hades/tree/main/plugins/edriver)
 - [Collector](https://github.com/chriskaliX/Hades/tree/main/plugins/collector)
 - [Eguard](https://github.com/chriskaliX/Hades/tree/main/plugins/eguard)
+- [WDriver](https://github.com/chriskaliX/Hades/tree/main/plugins/wdriver)
 - [NCP](https://github.com/chriskaliX/Hades/tree/main/plugins/ncp)
 - Scanner
 - Logger

plugins/edriver/Cargo.toml

@@ -7,6 +7,12 @@ description = "Rust version of hades edriver"
 
 [features]
 debug = ["sdk/debug"]
+# The `static` feature chains to libbpf-rs/static → libbpf-sys/static, which
+# links the system libelf.a.  On Ubuntu 24.04+ that libelf.a is compiled with
+# USE_ZSTD and references ZSTD_* symbols.  libbpf-sys does NOT emit
+# `cargo:rustc-link-lib=zstd`, so we must add `-lzstd` manually in
+# .cargo/config.toml ([build].rustflags for host build-scripts, and
+# [target.*-musl].rustflags for the final binary).
 static = ["libbpf-rs/static"]
 # Enable vendored elfutils compilation via libbpf-sys.
 # Only needed on glibc hosts (Ubuntu) where the system libelf.a is compiled

plugins/eguard/Cargo.toml

@@ -32,4 +32,4 @@ sdk = { path = "../../SDK/rust" }
 tokio = { version = "1", features = ["full"] }
 
 [build-dependencies]
-libbpf-cargo = "0.21.2"
+libbpf-cargo = "0.21.2"

plugins/eguard/src/bpf/rules/l7_acl.h

@@ -84,7 +84,7 @@ static __always_inline int l7_acl_rule(net_packet_t pkt, struct __sk_buff *skb)
         // trim key
         struct dns_policy_key key = {0};
         key.prefixlen = DNS_MAX_PRELEN;
-
+        
         bpf_skb_load_bytes(skb, DNS_OFFSET, (void *)&pkt.buf_p->buf[SIZE_CONTEXT], SIZE_DNSHDR);
         int offset = load_dns(pkt, &key, skb);
         void *output_data = pkt.buf_p->buf;

plugins/wdriver/Cargo.toml

@@ -0,0 +1,50 @@
+[package]
+name = "wdriver"
+version = "24.12.4"
+edition = "2021"
+
+[dependencies]
+log = "0.4.22"
+fern = "0.7.0"
+chrono = "0.4.38"
+version = "3.0.0"
+process_path = "0.1"
+yaml-rust = "0.4"
+fast_log = "1.5.51"
+serde = { version = "1.0.211", features = ["derive"] }
+serde_json = "1.0.132"
+prost = "0.13"
+md5 = "0.7"
+windows-sys = { version = "0.61.2", features = [
+    "Win32_Foundation",
+    "Win32_Storage_FileSystem",
+    "Win32_System_Diagnostics_Etw",
+    "Win32_System_Memory",
+    "Win32_System_Threading",
+    "Win32_System_Time",
+] }
+napi = { version = "2.16.12", default-features = false, features = ["napi4", "serde-json", "tokio_rt"] }
+napi-derive = "2.16.12"
+tokio = { version = "1.40.0", features = ["rt-multi-thread", "sync", "io-util", "time", "process", "macros", "rt", "fs", "net"] }
+tokio-util = "0.7.12"
+
+winreg = "0.52.0"
+sysinfo = "0.33.0"
+netstat2 = "0.11.0"
+windows-service = "0.7.0"
+win_etw_macros = "0.1.*"
+win_etw_provider = "0.1.*"
+
+[dependencies.windows]
+version = "0.58.0"
+features = [
+    "Win32_Security",
+    "Win32_System_IO",
+    "Win32_Foundation",
+    "Win32_System_Services",
+    "Win32_System_Threading",
+    "Win32_Storage_FileSystem",
+]
+
+[profile.test]
+debug-assertions = false

plugins/wdriver/README.md

@@ -0,0 +1,83 @@
+# wdriver
+
+`wdriver` is the Windows Rust plugin track for Hades. It is intended to align
+with the Hades-Windows C++ service/plugin semantics while keeping the transport
+protocol unchanged.
+
+`wdriver` 是 Hades 的 Windows Rust 插件方向，用于逐步对齐
+Hades-Windows C++ 服务/插件语义，同时保持现有传输协议不变。
+
+## Current Scope / 当前范围
+
+- Plugin transport uses Windows stdin/stdout framing: `uint32 little-endian length + protobuf payload`.
+- 插件传输使用 Windows stdin/stdout 帧格式：`uint32 小端长度 + protobuf payload`。
+- Reports are encoded as `Record { data_type, timestamp, data.fields }`.
+- 上报数据编码为 `Record { data_type, timestamp, data.fields }`。
+- Windows event payload keeps the existing server convention: `fields["data_type"]` and `fields["udata"]`.
+- Windows 事件载荷保持 server 现有约定：`fields["data_type"]` 和 `fields["udata"]`。
+- Task acknowledgements use data type `5100` with `token`, `status`, and `msg`.
+- 任务回执使用数据类型 `5100`，字段为 `token`、`status`、`msg`。
+
+## Phase 1 Collection / 一期采集
+
+The current minimal loop supports server-triggered collection tasks:
+
+当前最小闭环支持 server 下发触发的采集任务：
+
+- `200`: process snapshot / 进程快照
+- `202`: autorun registry snapshot / 自启动注册表快照
+- `203`: network socket snapshot / 网络连接快照
+- `207`: local account snapshot / 本地账户快照
+- `208`: installed software snapshot / 已安装软件快照
+
+The field names intentionally match the existing Hades-Linux Windows handlers
+and Hades-Windows C++ reports. Keep the outer protocol stable; future expansion
+should add fields inside `udata` instead of changing the transport frame or
+top-level `Record` semantics.
+
+字段名刻意保持与 Hades-Linux Windows handler 和 Hades-Windows C++ 上报一致。
+外层协议需要保持稳定；后续扩展优先在 `udata` 内增加字段，不改变传输帧或
+顶层 `Record` 语义。
+
+## ETW Direction / ETW 方向
+
+ETW should be implemented as active reporting: after startup or explicit task
+enablement, the plugin owns the ETW session and pushes events to stdout without
+waiting for a polling task. This should follow the same `Record + udata` shape
+used by the C++ path:
+
+ETW 应按主动上报实现：插件启动或收到显式启用任务后，由插件持有 ETW session，
+并主动向 stdout 推送事件，不依赖轮询任务。上报结构应继续沿用 C++ 链路的
+`Record + udata` 形态：
+
+- `300`: process ETW / 进程 ETW
+- `301`: thread ETW / 线程 ETW
+- `302`: image load ETW / 镜像加载 ETW
+- `303`: network ETW / 网络 ETW
+- `304`: registry ETW / 注册表 ETW
+- `305`: file I/O ETW / 文件 I/O ETW
+
+Keep ETW session start/stop, callback dispatch, and report throttling isolated
+from the task collection loop so task handling cannot block active event upload.
+
+ETW session 启停、回调分发、上报限速应与任务采集循环隔离，避免任务处理阻塞
+主动事件上报。
+
+## Relationship To Hades-Windows / 与 Hades-Windows 的关系
+
+The Rust plugin is not a rewrite of the full Windows C++ service yet. The
+long-term goal is to gradually align with these Hades-Windows components:
+
+当前 Rust 插件还不是完整 Windows C++ 服务的重写版本。长期目标是逐步对齐以下
+Hades-Windows 组件能力：
+
+- `HadSvc`: service/plugin orchestration and report transport / 服务、插件编排与上报传输
+- `MonitorEvent/sysmonuserlib`: user-mode collection and ETW / 用户态采集与 ETW
+- `MonitorEvent/sysmondrvlib`: kernel monitor bridge / 内核监控桥接
+- `MonitorEvent/netdrvlib`: kernel network bridge / 内核网络桥接
+- `RuleEngineSvc`: rule evaluation and blocking semantics / 规则评估与阻断语义
+
+Driver and blocking capabilities should be added only after the reporting
+semantics are stable and compatible with the server handlers.
+
+驱动和阻断能力应在上报语义稳定、且与 server handler 兼容后再逐步补齐。

plugins/wdriver/build.rs

@@ -0,0 +1 @@
+pub fn main() {}

plugins/wdriver/config/directoryRuleConfig.json

@@ -0,0 +1,13 @@
+[
+	{
+		"FileIORuleMod": 1,
+		"processName": "CreateFile.exe|powershell.exe",
+		"Directory": "D:\\Document\\|C:\\System\\AppData\\|C:\\testIPS"
+	},
+
+	{
+		"FileIORuleMod": 2,
+		"processName": "explorer.exe|cmd.exe",
+		"Directory": "D:\\Document1\\|C:\\System\\AppData1\\|C:\\testIPS"
+	}
+]

plugins/wdriver/config/networkRuleConfig.yaml

@@ -0,0 +1,28 @@
+tc:
+  - name: "eguard_egress_test_project"
+    address: "192.168.1.1/24"
+    protocol: TCP # ALL/TCP/UDP
+    ports:        # empty means all ports. 32(single port like 80), 16(range like 8079-8080)
+      - 80
+      - 8079-8080
+    action: DENY  # DENY/LOG
+    level: INFO
+
+  - name: "test_tcp_redirect"
+    #address: ""
+    protocol: "TCP"   # TCP
+    #ports:         # empty means all ports.
+    #  - 80
+    #  - 8079-8080
+    processname: "1.exe|2.exe"    # empty means all process.
+    redirectip: "192.168.188.188" # redirect to ipaddrss
+    redirectport: "88"            # redirect to port
+    action: REDIRECT
+    level: INFO
+dns:
+  - name: "eguard_egress_test_dns"
+    action: DENY
+    domain: "grpc.hades.store"
+  - name: "eguard_egress_test_dns_1"
+    action: DENY
+    domain: "*.baidu.com"

plugins/wdriver/config/processRuleConfig.json

@@ -0,0 +1,4 @@
+{
+	"processRuleMod": 2,
+	"processName": "cmd.exe|powershell.exe"
+}

plugins/wdriver/config/registerRuleConfig.json

@@ -0,0 +1,8 @@
+[
+	{
+		"registerRuleMod": 1,
+		"processName": "AddRegister.exe|cmd.exe",
+		"registerValuse": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run|\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
+		"permissions": "1111111"
+	}
+]

plugins/wdriver/config/registerRuleConfig_.json

@@ -0,0 +1,22 @@
+[
+	{
+		"registerRuleMod": 2,
+		"processName": "cmd.exe|powershell.exe",
+		"registerValuse": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run|\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOne",
+		"permissions": "0000000"
+	},
+
+	{
+		"registerRuleMod": 2,
+		"processName": "AddRegister.exe|cmd.exe",
+		"registerValuse": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run|\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOne",
+		"permissions": "1111111"
+	},
+
+	{ 
+		"registerRuleMod": 1,
+		"processName": "cmd.exe|svhost.exe.exe",
+		"registerValuse": "\\Registry\\Machine\\Software\\WOW6432Node\\Policies\\Microsoft\\MUI\\Settings",
+		"permissions": "1000110"
+	}
+]

plugins/wdriver/config/threadRuleConfig.json

@@ -0,0 +1,3 @@
+{
+	"InjectIpsProcessNameArray": "WaitInject.exe|explorer.exe"
+}