microsoft / microsoft/perfview

TraceParserGen does NOT support field type "win:SID"

Open
#1,004 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
4.7k
Forks
775
Avg merge
5d 11h
Merged PRs (30d)
9

Description

In Windows 10 Update 1903, the "Microsoft-Windows-Kernel-Process" manifest was updated, and a new type "win:SID" was introduced.
This type is of variable length, it is a simple security identifier.

TraceParserGen has an internal "SkipSID" method, which is misleading, because it is actually a "SkipTokenUserAndSID", or "SkipWBEMSID".

A correct implementation of SkipSID is:

		internal int SkipSID(int offset)
		{
			// This is a Security Token.  Either it is null, which takes 4 bytes,
			// Otherwise it is an SID, which is variable size (sigh) depending on the 2nd byte in the SID
			int sid = GetInt32At(offset);
			if (sid == 0) return offset + 4;

			// 8 bytes for the SID (1 byte revision, 1 byte authorities count, 6 bytes identifier authority)
			int numAuthorities = GetByteAt(offset + 1); // Each authority is 4 bytes long
			return offset + 8 + 4 * numAuthorities;
		}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in TraceParserGen by locating the existing SkipSID method and compare its behavior with the win:SID description in this issue. Verify handling of null and variable-length security identifiers, then confirm that Microsoft-Windows-Kernel-Process traces using win:SID are parsed correctly without breaking existing token handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.