Move NT process-telemetry declarations into a public header - #316
Merged
Conversation
PROCESS_TELEMETRY_ID_INFORMATION and the NtQueryInformationProcess prototype were declared privately in src/ps.cpp and independently duplicated in the eBPF for Windows api_test. Move them into a new leaf header, inc/usersim/nt_process_info.h, so usersim and its consumers share one definition instead of maintaining divergent copies. The header declares only native NT types (no usersim platform dependencies) so consumers can include it without pulling in usersim's internal headers. ps.cpp now includes it and drops its local PROCESS_TELEMETRY_ID_INFORMATION, PROCESSINFOCLASS, and NtQueryInformationProcess_t declarations; the query logic is unchanged.
mikeagun
marked this pull request as ready for review
July 28, 2026 18:27
mikeagun
pushed a commit
to mikeagun/ebpf-for-windows
that referenced
this pull request
Jul 28, 2026
Bump the external/usersim submodule to mikeagun/usersim@43e2294 (share-nt-process-info) and repoint its .gitmodules URL at the fork so CI can build against usersim/nt_process_info.h before microsoft/usersim#316 merges. Revert once microsoft#316 merges: restore the URL to microsoft/usersim and bump the submodule to the merged commit on usersim main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4
3 tasks
Alan-Jowett
approved these changes
Jul 28, 2026
mikeagun
pushed a commit
to mikeagun/ebpf-for-windows
that referenced
this pull request
Jul 28, 2026
Point the external/usersim submodule at usersim main (fc3c2a2), which now includes usersim/nt_process_info.h from microsoft/usersim#316. This replaces the temporary fork/branch pin used while that PR was in review; the submodule URL is back to microsoft/usersim. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PsGetProcessStartKeyis implemented on top of the native NTPROCESS_TELEMETRY_ID_INFORMATIONstructure and theNtQueryInformationProcessAPI. Per Microsoft's documentation these have no public SDK header and must be
declared by hand, and today usersim declares them privately inside
src/ps.cpp.Because the declarations live in a
.cpp, anything else that needs the samenative definitions cannot reuse them and has to maintain a separate,
drift-prone copy.
Promote those declarations to a public leaf header,
inc/usersim/nt_process_info.h, so they are defined once and can be reused byusersim consumers.
Changes
inc/usersim/nt_process_info.hdeclaringPROCESS_TELEMETRY_ID_INFORMATION,the
ProcessTelemetryIdInformationinformation-class value, and theNtQueryInformationProcess_tfunction-pointer typedef.src/ps.cppincludes the new header and drops its local declarations; thePsGetProcessStartKeylogic is unchanged.src/usersim.vcxproj.Design notes
The header is intentionally a leaf: it declares only native NT types and depends
solely on basic Windows types (
ULONG/HANDLE/NTSTATUS/NTAPI/...), with nousersim platform dependencies, so it can be included on its own without pulling
in usersim's internal headers.
NtQueryInformationProcess_tusesULONGfor theinformation-class parameter so the header does not also need to carry a
PROCESSINFOCLASSenum.Testing
Context
Prompted by review of the corresponding eBPF for Windows change
(microsoft/ebpf-for-windows#5383).