microsoft / microsoft/ebpf-for-windows
eBPF for Windows should support ETW, syscall and kprobe style hooks
Open
ebpf-km
help wanted
triaged
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
eBPF for Windows should support ETW, syscall and kprobe style hooks
One of the strong points of BPF on Linux is the ability to execute BPF programs in response to kprobes and system calls. This provides a very rich set of diagnostic tools to the developer and administrator of Linux systems. eBPF for Windows would benefit from adding equivalent functionality.
Contributor guide
Research direction
No files, tests, or entry points are named. Start by surveying the eBPF-for-Windows codebase for existing hook and event mechanisms, then define how ETW, syscall, and kprobe-style hooks should be supported. Done means providing equivalent functionality for these three hook styles.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100