4 ms·

Wow, I'm really stoked to see this! This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as trac

Wow, I'm really stoked to see this! This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as tracing file system and registry calls, you've got to write drivers. And drivers are very tricky to write, and it's very easy to miss corner cases - which can result in the dreaded BSOD. Plus, drivers need to go through a verification and signing process by Microsoft. Having access to that capability from user-mode, without having to write drivers... that would be amazing.

dd21223 5y ago
It is really great to see that eBPF is causing an industry wide change instead of just a Linux one!
Someone1234 5y ago
Everything you described is already available on Windows in userland via filters (FileSystemWatcher/ReadDirectoryChangesW, RegNotifyChangeKeyValue, et al). Obviously you can only monitor whatever lives in your security context. eBPF looks cool since it is a VM, that could have access to more kernel structures (network?), but solving the issues you described is largely a solved problem on the platform.
- GordonS 5y ago
  Nope, with FileSystemWatcher (and the Windows APIs it uses under the hood) you get minimal information - only using a driver can you get contextual information, such as the handle of the thread, process and user that made the call. And RegNotifyChangeKeyValue is only useful for watching a single, specific value - if you monitor a tree, it doesn't even tell you what changed, only that something matching the filter did. And as with file system changes, if you want to know which thread/process/user made the change, you need to use a driver.
dataflow 5y ago
If all you want is user-mode tracing, there's ETW. Where you run into problems is that it doesn't let you block on calls, etc.
- GordonS 5y ago
  I do need to block on calls. I also need the process and user that made the change, and ETW doesn't provide those (to get them myself would require blocking).
Genbox 5y ago
Sysinternal's Process Monitor does that from a process perspective: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon https://docs.microsoft.com/en-us/sysinternals/downloads/proc... There is also System Monitor which logs the events to EventLog: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon https://docs.microsoft.com/en-us/sysinternals/downloads/sysm... Are those not enough?
- GordonS 5y ago
  Process Monitor is a great utility, but I need programmatic access to this information. SysMon is a great tool, but the license prevents distribution (such as bundling with an installer) - users must download it from Microsoft.

dd21223 5y ago

It is really great to see that eBPF is causing an industry wide change instead of just a Linux one!

Someone1234 5y ago

Everything you described is already available on Windows in userland via filters (FileSystemWatcher/ReadDirectoryChangesW, RegNotifyChangeKeyValue, et al). Obviously you can only monitor whatever lives in your security context. eBPF looks cool since it is a VM, that could have access to more kernel structures (network?), but solving the issues you described is largely a solved problem on the platform.

GordonS 5y ago
Nope, with FileSystemWatcher (and the Windows APIs it uses under the hood) you get minimal information - only using a driver can you get contextual information, such as the handle of the thread, process and user that made the call. And RegNotifyChangeKeyValue is only useful for watching a single, specific value - if you monitor a tree, it doesn't even tell you what changed, only that something matching the filter did. And as with file system changes, if you want to know which thread/process/user made the change, you need to use a driver.

dataflow 5y ago

If all you want is user-mode tracing, there's ETW. Where you run into problems is that it doesn't let you block on calls, etc.

GordonS 5y ago
I do need to block on calls. I also need the process and user that made the change, and ETW doesn't provide those (to get them myself would require blocking).

Genbox 5y ago

Sysinternal's Process Monitor does that from a process perspective: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon https://docs.microsoft.com/en-us/sysinternals/downloads/proc... There is also System Monitor which logs the events to EventLog: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon https://docs.microsoft.com/en-us/sysinternals/downloads/sysm... Are those not enough?

GordonS 5y ago
Process Monitor is a great utility, but I need programmatic access to this information. SysMon is a great tool, but the license prevents distribution (such as bundling with an installer) - users must download it from Microsoft.