SysinternalsEBPF
SysinternalsEBPF copied to clipboard
Linux compiler fixes (GCC & CLANG)
Modify the eBPF programlet compilation to add -fno-stack-protector similar to https://github.com/Sysinternals/SysmonForLinux/pull/42
Additionally, the compiler warnings identified two calls to labs(...) that would always evaluate to true due to them operating on an unsigned value. I modified the less-than comparison to move the subtracted value from the left-hand side to be an added value to the right-hand side, and removed the labs(...) calls.