AntiRansomEngine.hpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#pragma once
#include <string>
#include <thread>
#include <atomic>
#include <sigc++/sigc++.h>
#include <yara.h>
 
 
class AntiRansomEngine {
public:
    AntiRansomEngine();
    ~AntiRansomEngine();
 
    void start();
    void stop();
 
 
    sigc::signal<void(const std::string&)>& signal_event();
 
private:
    void run();
    void scan_file(const std::string& path);
    void load_yara_rules();
 
    std::atomic<bool> running_;
    std::thread worker_;
 
    YR_RULES* yara_rules_;
 
    sigc::signal<void(const std::string&)> sig_event_;
};