tracee for Windows #913

[ghost]

We saw ebpf for Windows by Microsoft, is it possible even as an idea to support Windows too or fork the project and build Windows specific version?

[yanivagman]

Good question, but unfortunately, this is not possible.
Tracee is based on events which are very specific to the Linux operating system, including internal kernel functions.
From what I know (mainly from https://cloudblogs.microsoft.com/opensource/2021/05/10/making-ebpf-work-on-windows/) ebpf for windows is currently limited to network related hooks.
For even considering this idea, windows should first add support for hooking file-system related events, as well as process events. Even then, the API exposed to user-space by windows is very different than that of Linux, and its internals are not open sourced.

So, things might change in the future as microsoft will probably add new hooks to not only the network subsystem, but even then, a new and different design will be required.

[ghost]

Thanks Yaniv