{"id":100138,"date":"2021-05-11T16:22:58","date_gmt":"2021-05-11T14:22:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows"},"modified":"2021-05-11T16:22:58","modified_gmt":"2021-05-11T14:22:59","slug":"microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","title":{"rendered":"Microsoft has prepared an eBPF implementation for Windows","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Microsoft has released an implementation of the eBPF subsystem for Windows, allowing arbitrary handlers to run at the operating system kernel level. eBPF features a built-in kernel bytecode interpreter, enabling the creation of user-space loadable network operation handlers, controlling access, and tracking system performance. eBPF has been included in the Linux kernel since version 3.18, allowing for the processing of incoming and outgoing network packets, redirecting packets, managing bandwidth, intercepting system calls, controlling access, and performing tracing. Thanks to JIT compilation, bytecode is dynamically translated into machine instructions and executed with the performance of compiled code. The source code for eBPF on Windows is open under the MIT license. <\/p>\n
eBPF for Windows can be used with existing eBPF tools and provides a standard API applicable to eBPF applications in Linux. The project also allows compiling C code into eBPF bytecode using the built-in eBPF compiler based on Clang and running eBPF handlers created for Linux on top of the Windows kernel, providing a special compatibility layer and supporting the standard Libbpf API for compatibility with applications interacting with eBPF programs. Additionally, layers are offered that provide Linux-like hooks for XDP (eXpress Data Path) and socket bind, abstracting access to the Windows networking stack and network drivers. Future plans include providing full compatibility at the source code level with standard Linux eBPF handlers.
<\/center> <\/p>\n
A key difference in the eBPF implementation for Windows is the use of an alternative bytecode verifier, initially proposed by employees of VMware and researchers from Canadian and Israeli universities. The verifier runs in a separate isolated process in user space and is applied before executing BPF programs to identify errors and block possible malicious activity. <\/p>\n
To verify eBPF for Windows, a static analysis method based on Abstract Interpretation is applied, which, compared to the eBPF verifier for Linux, demonstrates a lower rate of false positives, supports loop analysis, and provides good scalability. The method takes into account numerous execution patterns derived from analyzing existing eBPF programs. <\/p>\n
After verification, the bytecode is passed to an interpreter that operates at the kernel level or is processed through a JIT compiler, followed by the execution of the resulting machine code with kernel privileges. To isolate eBPF handlers at the kernel level, the HVCI (HyperVisor-enforced Code Integrity) mechanism is used, which utilizes virtualization tools to protect kernel processes and ensures the integrity of the executed code through a digital signature. A limitation of HVCI is that it can only verify interpreted eBPF programs and cannot be used alongside JIT (a choice is provided \u2014 either performance or additional security). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Microsoft](\"\/wp-content\/uploads\/2021\/05\/1daa28968dafec017e92e435fc479cae.png\")
<\/center> <\/p>\n