microsoft / ntosebpfext

eBPF-For-Windows extension to provide access to Windows kernel functionality
MIT License
15 stars 11 forks source link

Add support for very long command lines in ntosebpfext process data #76

Closed Austin-Lamb closed 4 months ago

Austin-Lamb commented 4 months ago

Description

Previously we were limited to a few hundred characters for command lines. This isn't long enough in many cases - such as cl.exe compiler invocations that have long include paths on them. This uses the new support in 0.17 to help with marshaling long strings, so I allow up to 32k characters now which I believe is the maximum possible on Windows because UNICODE_STRING has a USHORT MaximumLength and that is the byte count, so character count is "max USHORT / 2" or 32k.

Testing

Added a test that verifies a process with very long arguments (>5k characters) comes through as expected.

Documentation

No docs need updated AFAIK.

Installation

No installer impact.