Repolode
Submit
microsoft

microsoft/ebpf-for-windows

eBPF runtime for Windows that lets existing Linux eBPF toolchains, APIs and programs run on top of the Windows kernel.

View on GitHub
Stars
3,588
Forks
310
Open issues
322
Last commit
22 hours ago

What is it?

eBPF for Windows brings the eBPF programming model to Windows. It reuses existing eBPF projects, such as the uBPF JIT compiler and the PREVAIL verifier, and adds a Windows hosting layer so that programs built with standard eBPF toolchains like clang can be loaded into the kernel. Libbpf-compatible APIs and the bpftool command-line tool are provided for loading and managing programs.

Programs can be deployed in three modes: native, where the bytecode is converted to C and built into a Windows driver (the preferred mode and the one that works with HVCI enabled); JIT compilation through a user-mode service; and an interpreter that is only present in debug builds. Programs attach to kernel hooks and call helper functions that wrap public Windows kernel APIs. The project supports Windows 11 and Windows Server 2022 or later.

Key features

  • 01Runs eBPF programs built with standard toolchains such as clang on Windows.
  • 02Provides Libbpf-compatible APIs and bpftool support for loading programs.
  • 03Offers a native mode that compiles eBPF bytecode into Windows drivers, compatible with HVCI.
  • 04Includes a JIT compilation path using the uBPF compiler.
  • 05Exposes hooks and helper functions that wrap public Windows kernel APIs.

Use cases

  • Running observability or DoS-protection logic in the Windows kernel using eBPF tooling.
  • Porting eBPF-based networking or tracing programs to Windows with minimal source changes.
  • Deploying kernel-level eBPF programs on systems with HVCI enabled.

Quick start

  1. 1

    Read the Getting Started Guide in docs/GettingStarted.md to install and try the project

Things to know

  • Requires Windows 11 or later, or Windows Server 2022 or later.
  • The project describes itself as a work-in-progress.
  • With HVCI enabled, only native-mode eBPF programs work, because JIT-compiled programs cannot run and the interpreter is absent from release builds.

In collections

OpenTelemetry & observability platforms

Topics

#ebpf#windows#kernel#observability#networking

FAQ

What is ebpf-for-windows?
eBPF runtime for Windows that lets existing Linux eBPF toolchains, APIs and programs run on top of the Windows kernel. eBPF for Windows brings the eBPF programming model to Windows. It reuses existing eBPF projects, such as the uBPF JIT compiler and the PREVAIL verifier, and adds a Windows hosting layer so that programs built with standard eBPF toolchains like clang can be loaded into the kernel. Libbpf-compatible APIs and the bpftool command-line tool are provided for loading and managing programs.
Is ebpf-for-windows free to use? What license does it have?
ebpf-for-windows is open source under the MIT license. Check the license terms before using it in commercial products.
Is ebpf-for-windows still maintained?
Actively maintained. The last commit to ebpf-for-windows was on Nov 7, 2026.
What can I use ebpf-for-windows for?
Running observability or DoS-protection logic in the Windows kernel using eBPF tooling. Porting eBPF-based networking or tracing programs to Windows with minimal source changes. Deploying kernel-level eBPF programs on systems with HVCI enabled.
How do I install ebpf-for-windows?
Read the Getting Started Guide in docs/GettingStarted.md to install and try the project
Where can I get ebpf-for-windows?
The source code and installation instructions are on GitHub: https://github.com/microsoft/ebpf-for-windows

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects