Skip to content

Move NT process-telemetry declarations into a public header - #316

Merged
mikeagun merged 2 commits into
microsoft:mainfrom
mikeagun:share-nt-process-info
Jul 28, 2026
Merged

Move NT process-telemetry declarations into a public header#316
mikeagun merged 2 commits into
microsoft:mainfrom
mikeagun:share-nt-process-info

Conversation

@mikeagun

Copy link
Copy Markdown
Contributor

Summary

PsGetProcessStartKey is implemented on top of the native NT
PROCESS_TELEMETRY_ID_INFORMATION structure and the NtQueryInformationProcess
API. Per Microsoft's documentation these have no public SDK header and must be
declared by hand, and today usersim declares them privately inside src/ps.cpp.
Because the declarations live in a .cpp, anything else that needs the same
native definitions cannot reuse them and has to maintain a separate,
drift-prone copy.

Promote those declarations to a public leaf header,
inc/usersim/nt_process_info.h, so they are defined once and can be reused by
usersim consumers.

Changes

  • Add inc/usersim/nt_process_info.h declaring PROCESS_TELEMETRY_ID_INFORMATION,
    the ProcessTelemetryIdInformation information-class value, and the
    NtQueryInformationProcess_t function-pointer typedef.
  • src/ps.cpp includes the new header and drops its local declarations; the
    PsGetProcessStartKey logic is unchanged.
  • Register the header in src/usersim.vcxproj.

Design notes

The header is intentionally a leaf: it declares only native NT types and depends
solely on basic Windows types (ULONG/HANDLE/NTSTATUS/NTAPI/...), with no
usersim platform dependencies, so it can be included on its own without pulling
in usersim's internal headers. NtQueryInformationProcess_t uses ULONG for the
information-class parameter so the header does not also need to carry a
PROCESSINFOCLASS enum.

Testing

  • usersim builds clean (Debug/x64); no functional change.
  • The new header is self-contained and compiles when included standalone.

Context

Prompted by review of the corresponding eBPF for Windows change
(microsoft/ebpf-for-windows#5383).

PROCESS_TELEMETRY_ID_INFORMATION and the NtQueryInformationProcess prototype
were declared privately in src/ps.cpp and independently duplicated in the
eBPF for Windows api_test. Move them into a new leaf header,
inc/usersim/nt_process_info.h, so usersim and its consumers share one
definition instead of maintaining divergent copies.

The header declares only native NT types (no usersim platform dependencies)
so consumers can include it without pulling in usersim's internal headers.
ps.cpp now includes it and drops its local PROCESS_TELEMETRY_ID_INFORMATION,
PROCESSINFOCLASS, and NtQueryInformationProcess_t declarations; the query
logic is unchanged.
@mikeagun
mikeagun marked this pull request as ready for review July 28, 2026 18:27
mikeagun pushed a commit to mikeagun/ebpf-for-windows that referenced this pull request Jul 28, 2026
Bump the external/usersim submodule to mikeagun/usersim@43e2294
(share-nt-process-info) and repoint its .gitmodules URL at the fork so CI can
build against usersim/nt_process_info.h before microsoft/usersim#316 merges.

Revert once microsoft#316 merges: restore the URL to microsoft/usersim and bump the
submodule to the merged commit on usersim main.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4
@mikeagun
mikeagun merged commit fc3c2a2 into microsoft:main Jul 28, 2026
9 checks passed
@github-project-automation github-project-automation Bot moved this from Todo to Done in eBPF for Windows Triage Jul 28, 2026
mikeagun pushed a commit to mikeagun/ebpf-for-windows that referenced this pull request Jul 28, 2026
Point the external/usersim submodule at usersim main (fc3c2a2), which now
includes usersim/nt_process_info.h from microsoft/usersim#316. This replaces
the temporary fork/branch pin used while that PR was in review; the submodule
URL is back to microsoft/usersim.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants