search

microsoft / ntosebpfext

eBPF-For-Windows extension to provide access to Windows kernel functionality
MIT License
11 stars 9 forks source link

Add process create and exit times #47

Closed Austin-Lamb closed 4 months ago

Austin-Lamb commented 4 months ago

Description

This adds process creation and exit times to ntosebpfext. As I did this, I wanted to test that these times made sense, so the previous way of testing by just writing from process_monitor to a file and reding it back in from a PowerShell script was going to be limiting, so I reimplemented the tests and test harness too.

This change also removes the x86 architecture as Windows 11 does not support x86 32-bit anyway. I also removed a number of unused Solution Configurations, so we have fewer to maintain.

Testing

  1. Ran all the existing unit tests.
  2. Added a new unit test, with the updated usersim that allows shimming the process create and exit time APIs.
  3. Reimplemented the E2E tests as 3 .NET projects. process_monitor.Library is a class library that has the logic to listen to the ntosebpfext events from process_monitor.sys and surface them as .NET events. Then process_monitor (the exe) moved from C++ to C# so it is a thin wrapper over that library that just adds console output and Ctrl+C support. Lastly, there's process_monitor.Tests which is MSTest code that exercises the library and can do things like "run a process and confirm the exit code is what we expect" or "run a process that should take at least 3 seconds, and confirm the exit time is >= 3 seconds beyond the start time. This also lays groundwork for further testing that uses richer data than text parsing a log file would benefit from.

Documentation

Yes, updated the docs on how to run the tests and set up a dev environment.

Installation

This changes what a dev needs to install to build and test this project (see updated docs), but does not change the install requirements for the ntosebpfext extension for an end-user.

poornagmsft commented 4 months ago

[like] Poorna Gaddehosur reacted to your message:

From: Austin Lamb @.> Sent: Wednesday, May 8, 2024 12:09:03 AM To: microsoft/ntosebpfext @.> Cc: Poorna Gaddehosur @.>; Review requested @.> Subject: [microsoft/ntosebpfext] User/austinl/add process create and exit times (PR #47)

Description

This adds process creation and exit times to ntosebpfext. As I did this, I wanted to test that these times made sense, so the previous way of testing by just writing from process_monitor to a file and reding it back in from a PowerShell script was going to be limiting, so I reimplemented the tests and test harness too.

Testing

  1. Ran all the existing unit tests.
  2. Added a new unit test, with the updated usersim that allows shimming the process create and exit time APIs.
  3. Reimplemented the E2E tests as 3 .NET projects. process_monitor.Library is a class library that has the logic to listen to the ntosebpfext events from process_monitor.sys and surface them as .NET events. Then process_monitor (the exe) moved from C++ to C# so it is a thin wrapper over that library that just adds console output and Ctrl+C support. Lastly, there's process_monitor.Tests which is MSTest code that exercises the library and can do things like "run a process and confirm the exit code is what we expect" or "run a process that should take at least 3 seconds, and confirm the exit time is >= 3 seconds beyond the start time. This also lays groundwork for further testing that uses richer data than text parsing a log file would benefit from.

Documentation

Yes, updated the docs on how to run the tests and set up a dev environment.

Installation

This changes what a dev needs to install to build and test this project (see updated docs), but does not change the install requirements for the ntosebpfext extension for an end-user.

You can view, comment on, or merge this pull request online at:

https://github.com/microsoft/ntosebpfext/pull/47

Commit Summary

File Changes

(34 fileshttps://github.com/microsoft/ntosebpfext/pull/47/files)

Patch Links:

— Reply to this email directly, view it on GitHubhttps://github.com/microsoft/ntosebpfext/pull/47, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AO6DOEQ2JM73KZKSFIUW4NDZBFUJ7AVCNFSM6AAAAABHL52WD2VHI2DSMVQWIX3LMV43ASLTON2WKOZSGI4DINBSG4YDANY. You are receiving this because your review was requested.Message ID: @.***>