Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.Sign up
GitHub is where the world builds software
Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.
OVERVIEW -------- HFM (Hypervisor-based File Monitoring) is a Libvmi based program that is used to monitor activities related to files of Virtual Machine running on XEN. Currently, HFM just support Windows OS The activities that HFM is planning to monitor: - Monitor file created activities (TODO) - Monitor file content modify activities (TODO) - Monitor file deleted activites (and extract the deleted files in some situations) (TODO) - Monitor file attributes changed (read only, hidden, file permission, file owner ...) (TODO) INSTALL ------- ## Build the project $ make ## Unit test $ make test EXAMPLE ------- ## Run program to monitor 2 VM windows1 and windows 2 ## hfm.cfg : config file, define configurations that program will use ## hfm.pol : policy file, define the policies that decide which actions on which files/folder will be enable $ ./hfm -v windows -c hfm.cfg -p hfm.pol POLICY FILE FORMAT ------------------ Rule Definition <id> <severity> <action> <filepath> [EXTRACT] severity : WARN CRITICAL action : CREATE DELETE MODIFY_CONTENT MODIFY_LOGFILE CHANGE_ATTR_READONLY CHANGE_ATTR_PERMISSIONS CHANGE_ATTR_OWNERSHIP CHANGE_ATTR_HIDDEN filepath : linux command style regular expression for file/directory path. For example /home/bin/* : All files in /home/bin /root/**/* : All files in /root/ and it's subdirectory