Add support for aarch64

.container/install-ubuntu-dependencies.sh

@@ -23,7 +23,6 @@ sudo apt-get install -y --no-install-recommends \
         clang \
         libzstd1 \
         libgtest-dev \
-        libc6-dev-i386 \
         apt-transport-https \
         dirmngr \
         googletest \

BUILD.md

@@ -78,6 +78,51 @@ cmake ..
 make
 ```
 
+## Cross-build for aarch64 on Ubuntu
+
+First cross-build and stage SysinternalsEBPF as described in its `BUILD.md`.
+The commands below assume its staged installation is in
+`../SysinternalsEBPF/build-arm64/staging`.
+
+Install the cross compiler and target development libraries:
+
+```shell
+sudo dpkg --add-architecture arm64
+sudo apt update
+sudo apt install crossbuild-essential-arm64 binutils-aarch64-linux-gnu \
+    libc6-dev-arm64-cross linux-libc-dev-arm64-cross \
+    libelf-dev:arm64 zlib1g-dev:arm64 libzstd-dev:arm64 \
+    libjson-glib-dev:arm64 libgtest-dev:arm64 libgmock-dev:arm64
+```
+
+Build the eBPF size checker for the build host. It inspects architecture-neutral
+eBPF objects during the cross-build and avoids executing aarch64 programs on
+the build host:
+
+```shell
+cmake -S . -B build-host
+cmake --build build-host --target checkEBPFsizes
+```
+
+Configure and build the aarch64 targets:
+
+```shell
+EBPF_STAGE="$(realpath ../SysinternalsEBPF/build-arm64/staging)"
+
+cmake -S . -B build-arm64 \
+    -DCMAKE_TOOLCHAIN_FILE=cmake/aarch64-linux-gnu.cmake \
+    -DOPENSSL_CROSS_COMPILE=aarch64-linux-gnu- \
+    -DSYSINTERNALS_EBPF_ROOT="$EBPF_STAGE/opt/sysinternalsEBPF" \
+    -DSYSINTERNALS_EBPF_INCLUDE_DIR="$EBPF_STAGE/usr/local/include" \
+    -DSYSINTERNALS_EBPF_LIBRARY="$EBPF_STAGE/usr/local/lib/libsysinternalsEBPF.so" \
+    -DSYSMON_HOST_CHECK_EBPF_SIZES="$PWD/build-host/checkEBPFsizes"
+cmake --build build-arm64 --parallel
+```
+
+The resulting `sysmon`, `sysmonLogView`, `sysmonUnitTests`, and
+`checkEBPFsizes` executables target aarch64. Run those executables and all
+runtime tests on an aarch64 Linux host; QEMU is not required.
+
 ## Test
 ```
 ./sysmonUnitTests

cmake/aarch64-linux-gnu.cmake

@@ -0,0 +1,20 @@
+set(CMAKE_SYSTEM_NAME Linux)
+set(CMAKE_SYSTEM_PROCESSOR aarch64)
+
+set(CMAKE_C_COMPILER aarch64-linux-gnu-gcc)
+set(CMAKE_CXX_COMPILER aarch64-linux-gnu-g++)
+set(CMAKE_AR aarch64-linux-gnu-ar)
+set(CMAKE_LINKER aarch64-linux-gnu-ld)
+set(CMAKE_NM aarch64-linux-gnu-nm)
+set(CMAKE_OBJCOPY aarch64-linux-gnu-objcopy)
+set(CMAKE_OBJDUMP aarch64-linux-gnu-objdump)
+set(CMAKE_RANLIB aarch64-linux-gnu-ranlib)
+set(CMAKE_STRIP aarch64-linux-gnu-strip)
+
+set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
+set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY BOTH)
+set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE BOTH)
+set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE BOTH)
+
+set(ENV{PKG_CONFIG_LIBDIR}
+    "/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig")

ebpfKern/sysmonEBPF_common.h

@@ -49,10 +49,12 @@
 #endif
 
 #include <sysinternalsEBPF_common.h>
+#ifndef EBPF_CO_RE
 #include <stdint.h>
+#endif
 #include <bpf_helpers.h>
 #include <bpf_core_read.h>
-#include <asm/unistd_64.h>
+#include <asm/unistd.h>
 #include <sysinternalsEBPFshared.h>
 #include "sysmon_defs.h"
 

ebpfKern/sysmonFileCreate_rawtp.c

@@ -42,9 +42,13 @@ int FileCreateRawExit(struct bpf_our_raw_tracepoint_args *ctx)
     }
 
     // only handle file creation events
+#ifdef __NR_creat
     if (eventArgs->syscallId != __NR_creat) {
         return 0;
     }
+#else
+    return 0;
+#endif
 
     // set the return code
     if (bpf_probe_read(&eventArgs->returnCode, sizeof(int64_t), (void *)&SYSCALL_PT_REGS_RC(regs)) != 0){
@@ -66,4 +70,3 @@ int FileCreateRawExit(struct bpf_our_raw_tracepoint_args *ctx)
 
     return 0;
 }
-

ebpfKern/sysmonFileDelete_rawtp.c

@@ -41,9 +41,13 @@ int FileDeleteRawExit(struct bpf_our_raw_tracepoint_args *ctx)
         return 0;
 
     // only handle unlink events
+#ifdef __NR_unlink
     if (eventArgs->syscallId != __NR_unlink) {
         return 0;
     }
+#else
+    return 0;
+#endif
 
     // set the return code
     if (bpf_probe_read(&eventArgs->returnCode, sizeof(int64_t), (void *)&SYSCALL_PT_REGS_RC(regs)) != 0){
@@ -64,4 +68,3 @@ int FileDeleteRawExit(struct bpf_our_raw_tracepoint_args *ctx)
 
     return 0;
 }
-

ebpfKern/sysmonFileOpen.c

@@ -78,11 +78,15 @@ static inline char* set_FileOpen_info(
     // store event time in nanoseconds for comparison
     eventTimeNs = bpf_ktime_get_ns() + config->bootNsSinceEpoch;
 
+#ifdef __NR_open
     if (eventArgs->syscallId == __NR_open) {
         event->m_Flags = (uint32_t)eventArgs->a[1];
     } else {
         event->m_Flags = (uint32_t)eventArgs->a[2];
     }
+#else
+    event->m_Flags = (uint32_t)eventArgs->a[2];
+#endif
 
     ptr = (char *)(event + 1);
     memset(event->m_Extensions, 0, sizeof(event->m_Extensions));
@@ -211,4 +215,3 @@ static inline char* set_FileOpen_info(
         return (char *)eventHdr;
     }
 }
-

ebpfKern/sysmonFileOpen_rawtp.c

@@ -41,7 +41,11 @@ int FileOpenRawExit(struct bpf_our_raw_tracepoint_args *ctx)
         return 0;
 
     // only handle open and openat events
+#ifdef __NR_open
     if (eventArgs->syscallId != __NR_open && eventArgs->syscallId != __NR_openat) {
+#else
+    if (eventArgs->syscallId != __NR_openat) {
+#endif
         return 0;
     }
 
@@ -64,4 +68,3 @@ int FileOpenRawExit(struct bpf_our_raw_tracepoint_args *ctx)
 
     return 0;
 }
-

ebpfKern/sysmonProcCreate.c

@@ -28,8 +28,6 @@
 //
 //====================================================================
 
-#include <inttypes.h>
-
 __attribute__((always_inline))
 static inline char* set_process_ext(
     PSYSMON_PROCESS_CREATE event,
@@ -191,4 +189,3 @@ static inline char* set_ProcCreate_info(
 
     return set_process_ext(event, config, task);
 }
-

linuxTypes.h

@@ -25,7 +25,9 @@
 #pragma once
 
 #include <stdbool.h>
+#ifndef EBPF_CO_RE
 #include <stdint.h>
+#endif
 #include <assert.h>
 #include <linux/limits.h>
 #include <ctype.h>
@@ -616,4 +618,3 @@ typedef struct {
 
 
 
-

linuxVersion.h.in

@@ -32,5 +32,5 @@
 //
 #define VER_COMPANY 	"Sysinternals - www.sysinternals.com"
 
-#define VER_COPYRIGHT 	"By Mark Russinovich, Thomas Garnier and Kevin Sheldrake\nCopyright (C) 2014-2025 Microsoft Corporation\nLicensed under MIT/GPLv2\nUsing pugixml. pugixml is Copyright (C) 2006-2024 Arseny Kapoulkine. MIT License."
+#define VER_COPYRIGHT 	"By Mark Russinovich, Thomas Garnier and Kevin Sheldrake\nCopyright (C) 2014-2026 Microsoft Corporation\nLicensed under MIT/GPLv2\nUsing pugixml. pugixml is Copyright (C) 2006-2024 Arseny Kapoulkine. MIT License."
 

makePackages.sh

@@ -25,8 +25,8 @@
 #################################################################################
 
 
-if [ "$5" = "" ]; then
-    echo "Usage: $0 <SourceDir> <BinaryDir> <package name> <package version> <package release> <PackageType>"
+if [ "$8" = "" ]; then
+    echo "Usage: $0 <SourceDir> <BinaryDir> <package name> <package version> <package release> <PackageType> <DebArch> <RpmArch>"
     exit 1
 fi
 
@@ -37,8 +37,10 @@ PACKAGE_NAME=$3
 PACKAGE_VER=$4
 PACKAGE_REL=$5
 PACKAGE_TYPE=$6
+DEB_ARCH=$7
+RPM_ARCH=$8
 
-DEB_PACKAGE_NAME="${PACKAGE_NAME}_${PACKAGE_VER}_amd64"
+DEB_PACKAGE_NAME="${PACKAGE_NAME}_${PACKAGE_VER}_${DEB_ARCH}"
 RPM_PACKAGE_NAME="${PACKAGE_NAME}-${PACKAGE_VER}-${PACKAGE_REL}"
 
 if [ "$PACKAGE_TYPE" = "deb" ]; then
@@ -68,7 +70,7 @@ if [ "$PACKAGE_TYPE" = "deb" ]; then
         RET=1
     fi
 
-    exit 0
+    exit $RET
 fi
 
 if [ "$PACKAGE_TYPE" = "rpm" ]; then
@@ -87,9 +89,9 @@ if [ "$PACKAGE_TYPE" = "rpm" ]; then
     # make the rpm
     if [ "$RPMBUILD" != "" ]; then
         cd "${PROJECT_BINARY_DIR}/rpm/${RPM_PACKAGE_NAME}"
-        "$RPMBUILD" --define "_topdir `pwd`" -v -bb "SPECS/${RPM_PACKAGE_NAME}.spec"
+        "$RPMBUILD" --target "${RPM_ARCH}" --define "_topdir `pwd`" -v -bb "SPECS/${RPM_PACKAGE_NAME}.spec"
         RET=$?
-        cp RPMS/x86_64/*.rpm ..
+        cp "RPMS/${RPM_ARCH}/"*.rpm ..
     else
         echo "No rpmbuild found"
         RET=1

package/DEBIAN.in/control.in

@@ -1,8 +1,7 @@
 Package: sysmonforlinux
 Version: @PROJECT_VERSION_MAJOR@.@PROJECT_VERSION_MINOR@.@PROJECT_VERSION_PATCH@
-Architecture: amd64
+Architecture: @DEB_ARCH@
 Maintainer: Sysinternals <syssite@microsoft.com>
 Description: A system monitor based on eBPF, ported from Windows, that outputs events to Syslog
-Depends: libc6 (>= 2.14), libgcc1 (>= 1:3.0), libstdc++6 (>= 5), libssl-dev, sysinternalsebpf (>= 1.6.0)
+Depends: libc6 (>= 2.14), libgcc-s1 | libgcc1, libstdc++6 (>= 5), sysinternalsebpf (>= 1.6.0)
 Installed-Size: 58934
-

sysmonforlinux.c

@@ -101,10 +101,16 @@ const ebpfSyscallTPprog         TPenterProgs[] =
 const ebpfSyscallTPprog         TPexitProgs[] =
 {   {__NR_execve, "ProcCreateExit"},
     {__NR_execveat, "ProcCreateExit"},
+#ifdef __NR_creat
     {__NR_creat, "FileCreateExit"},
+#endif
+#ifdef __NR_open
     {__NR_open, "FileOpenExit"},
+#endif
     {__NR_openat, "FileOpenExit"},
+#ifdef __NR_unlink
     {__NR_unlink, "FileDeleteExit"},
+#endif
     {__NR_unlinkat, "FileDeleteAtExit"},
     {__NR_unlinkat, "FileDeleteAtCwdExit"},
     {__NR_accept, "TCPacceptExit"},
@@ -127,12 +133,18 @@ const ebpfSyscallRTPprog        RTPexitProgs[] =
 {
     {"ProcCreateRawExit", __NR_execve},
     {"ProcCreateRawExit", __NR_execveat},
+#ifdef __NR_creat
     {"FileCreateRawExit", __NR_creat},
+#endif
+#ifdef __NR_open
     {"FileOpenRawExit", __NR_open},
+#endif
     {"FileOpenRawExit", __NR_openat},
     {"FileOpenRawExit", __NR_RAWACCESS},
     {"FileOpenRawExit", __NR_CREATE},
+#ifdef __NR_unlink
     {"FileDeleteRawExit", __NR_unlink},
+#endif
     {"FileDeleteAtRawExit", __NR_unlinkat},
     {"FileDeleteAtCwdRawExit", __NR_unlinkat},
     {"TCPacceptRawExit", __NR_accept},
@@ -906,18 +918,26 @@ void SetSyscallActive(bool *s, ULONG eventId)
             s[__NR_PROCTERM] = true;
             break;
         case SYSMONEVENT_RAWACCESS_READ_EVENT_value:
+#ifdef __NR_open
             s[__NR_open] = true;
+#endif
             s[__NR_openat] = true;
             s[__NR_RAWACCESS] = true;
             break;
         case SYSMONEVENT_FILE_CREATE_EVENT_value:
+#ifdef __NR_open
             s[__NR_open] = true;
+#endif
             s[__NR_openat] = true;
+#ifdef __NR_creat
             s[__NR_creat] = true;
+#endif
             s[__NR_CREATE] = true;
             break;
         case SYSMONEVENT_FILE_DELETE_EVENT_value:
+#ifdef __NR_unlink
             s[__NR_unlink] = true;
+#endif
             s[__NR_unlinkat] = true;
             break;
         case SYSMONEVENT_ACCESS_PROCESS_EVENT_value:
@@ -1725,4 +1745,3 @@ main(
     Usage( argv[0], &csbi );
     return ERROR_INVALID_PARAMETER;
 }
-