microsoft / microsoft/ebpf-for-windows

Add an API interface to access the ImagePath of the process triggering a hook

Open
#4,775 8 comments 0 reactions 1 assignee Assigned to @nmlud21 View on GitHub
enhancement P2 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the feature you'd like supported

Allow for an ebpf program to access the full path of the process triggering the hook, similar to [bpf_get_current_comm](https://docs.ebpf.io/linux/helper-function/bpf_get_current_comm/) which only gives the process name without the full path.

### Proposed solution

This is useful to make decisions based on the process name directly on the ebpf program, without relying on process ids which can be dynamic, or depend on user-space logic.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.