AntiRansomwarePage.hpp

1. Overview

The AntiRansomwarePage.hpp header defines the AntiRansomwarePage class, which implements the graphical user interface for the Anti-Ransomware subsystem in BastionGuard.

This page acts as a control and visualization layer, allowing the user to:

  • Start and stop the ransomware protection daemon
  • Select files or directories for manual scanning
  • Execute YARA-based scans on demand
  • View real-time logs and detection events
  • Receive alert notifications for matched rules

The implementation is based on Gtkmm (GTK4) and integrates directly with the YARA scanning engine and a background log reader thread.

2. Dependencies and Includes

#include <gtkmm.h>
#include <giomm.h>
#include <filesystem>
#include <string>
#include <vector>
#include <yara.h>
#include <thread>
#include <atomic>
  • gtkmm / giomm – GTK4 C++ UI widgets and I/O integration
  • <filesystem> – recursive directory traversal for scans
  • <yara.h> – YARA API for rule compilation and scanning
  • <thread> – background log reader execution
  • <atomic> – thread-safe state control

3. Class Declaration

class AntiRansomwarePage : public Gtk::Box

The class derives from Gtk::Box, allowing it to be embedded as a page inside a notebook or main application layout.

4. Public Interface

4.1 Constructor and Destructor

AntiRansomwarePage(Gtk::Window& parent);
virtual ~AntiRansomwarePage();
  • The constructor initializes the UI layout, binds callbacks, and stores a reference to the parent window.
  • The destructor ensures proper shutdown of background threads and cleanup of YARA-related resources.

4.2 selectedPath

std::string selectedPath;

Holds the currently selected file or directory path used for manual scan operations.

4.3 sendAlert()

void sendAlert(const std::string& file,
               const std::string& ruleName);

Emits a ransomware detection alert, typically when a YARA rule matches a scanned file.

  • file – path of the detected file
  • ruleName – name of the matched YARA rule

This method is intended to integrate with higher-level notification or logging systems.

4.4 appendLog()

void appendLog(const Glib::ustring& text);

Appends a log message to the internal Gtk::TextView, providing real-time feedback to the user.

This method is typically invoked from the GTK main loop to ensure thread-safe UI updates.

5. UI Components

5.1 Parent Window

Gtk::Window& parentWindow;

Reference to the parent application window, used for modal dialogs (file/folder choosers, alerts).

5.2 Control Buttons

Gtk::Box buttonBox;
Gtk::Button btnStart;
Gtk::Button btnStop;
Gtk::Button btnChooseFile;
Gtk::Button btnChooseFolder;
Gtk::Button btnScan;
Gtk::Button btnTest;

The button box provides user controls for:

  • Starting and stopping ransomware protection
  • Selecting files or directories
  • Running manual scans
  • Triggering test alerts

5.3 Log View

Gtk::TextView textView;
Glib::RefPtr<Gtk::TextBuffer> textBuffer;

Displays runtime logs, scan results, and detection messages. The buffer is updated incrementally as new events arrive.

5.4 Daemon State

bool daemonRunning = false;

Tracks whether the anti-ransomware daemon is currently active, allowing UI state (buttons, actions) to be updated accordingly.

6. YARA Integration

YR_COMPILER* yaraCompiler;
YR_RULES* yaraRules;

Holds the YARA compiler and compiled rule set used for scanning. These resources are initialized during rule loading and released during destruction.

6.1 loadYaraRules()

void loadYaraRules();

Loads and compiles YARA rules into memory. Compilation errors or warnings are expected to be reported through the log view.

6.2 runYaraOnPath()

void runYaraOnPath(const std::string& path);

Executes YARA scanning on the specified file or directory path. If the path is a directory, scanning is delegated to the recursive walker.

6.3 scanDirectoryRecursively()

void scanDirectoryRecursively(const std::string& path);

Recursively traverses a directory using std::filesystem and scans each file with the loaded YARA rules.

7. UI Callbacks

void onStartDaemon();
void onStopDaemon();
void onChooseFile();
void onChooseFolder();
void onManualScan();
void onTestAlert();

Callback handlers bound to UI actions. These methods orchestrate daemon lifecycle control, user input dialogs, scan execution, and alert testing.

8. Realtime Log Reader

std::thread logThread;
std::atomic<bool> logThreadRunning;

A dedicated background thread is used to read and process log output in real time, decoupling log ingestion from the GTK main loop.

8.1 startRealtimeLogReader()

void startRealtimeLogReader();

Starts the background thread responsible for monitoring log output and forwarding parsed lines to the UI.

8.2 processLogLine()

void processLogLine(const std::string& line);

Processes a single log line and converts it into a user-facing message appended to the log view.

9. Runtime and Concurrency Considerations

  • GTK thread safety: all UI updates must occur on the GTK main thread; background threads should dispatch via idle handlers.
  • Deterministic shutdown: background threads must be stopped and joined before object destruction.
  • YARA resource safety: compiler and rules must be released correctly to avoid memory leaks.
  • Filesystem traversal: recursive scanning should handle permission errors and symbolic links safely.
Published on:
Last updated on: