Hacker News Reader

Comment by GordonS | Hacker News Reader

Wow, I'm really stoked to see this!

This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as tracing file system and registry calls, you've got to write drivers. And drivers are very tricky to write, and it's very easy to miss corner cases - which can result in the dreaded BSOD. Plus, drivers need to go through a verification and signing process by Microsoft.

Having access to that capability from user-mode, without having to write drivers... that would be amazing.

View on HN

Everything you described is already available on Windows in userland via filters (FileSystemWatcher/ReadDirectoryChangesW, RegNotifyChangeKeyValue, et al). Obviously you can only monitor whatever lives in your security context.

eBPF looks cool since it is a VM, that could have access to more kernel structures (network?), but solving the issues you described is largely a solved problem on the platform.

Nope, with FileSystemWatcher (and the Windows APIs it uses under the hood) you get minimal information - only using a driver can you get contextual information, such as the handle of the thread, process and user that made the call.

And RegNotifyChangeKeyValue is only useful for watching a single, specific value - if you monitor a tree, it doesn't even tell you what changed, only that something matching the filter did. And as with file system changes, if you want to know which thread/process/user made the change, you need to use a driver.

Sysinternal's Process Monitor does that from a process perspective: https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

There is also System Monitor which logs the events to EventLog: https://docs.microsoft.com/en-us/sysinternals/downloads/sysm...

Are those not enough?

Process Monitor is a great utility, but I need programmatic access to this information.

SysMon is a great tool, but the license prevents distribution (such as bundling with an installer) - users must download it from Microsoft.

If all you want is user-mode tracing, there's ETW. Where you run into problems is that it doesn't let you block on calls, etc.

I do need to block on calls. I also need the process and user that made the change, and ETW doesn't provide those (to get them myself would require blocking).

It is really great to see that eBPF is causing an industry wide change instead of just a Linux one!

Reply on news.ycombinator.com