add descriptor to proc data (#43549)

### What does this PR do?
This PR adds the process name from the file property of the executable to the process data we send.

### Motivation
https://datadoghq.atlassian.net/browse/WINA-2023

### Describe how you validated your changes
Adds unit tests.

### Additional Notes
How big should the cache for this property be? I have made it 512, which seems appropriate. 

Notes on Live Processes changes: https://docs.google.com/document/d/1o6gVZRMP4rp69qu4Z4MbudXiLe3dqnPPufg7lInM_8I/edit?tab=t.0

Co-authored-by: jack.phillips <jack.phillips@datadoghq.com>

Author: jack0x2

pkg/process/procutil/process_model.go

@@ -6,9 +6,10 @@
 package procutil
 
 import (
+	"github.com/DataDog/gopsutil/cpu"
+
 	"github.com/DataDog/datadog-agent/pkg/discovery/tracermetadata"
 	"github.com/DataDog/datadog-agent/pkg/languagedetection/languagemodels"
-	"github.com/DataDog/gopsutil/cpu"
 
 	// using process.FilledProcess
 	"github.com/DataDog/gopsutil/process"
@@ -77,6 +78,7 @@ func (p *Process) DeepCopy() *Process {
 		Name:           p.Name,
 		Cwd:            p.Cwd,
 		Exe:            p.Exe,
+		Comm:           p.Comm,
 		Username:       p.Username,
 		PortsCollected: p.PortsCollected,
 	}

pkg/process/procutil/process_windows.go

@@ -16,6 +16,8 @@ import (
 
 	"golang.org/x/sys/windows"
 
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+
 	"github.com/DataDog/datadog-agent/pkg/util/log"
 	"github.com/DataDog/datadog-agent/pkg/util/pdhutil"
 	"github.com/DataDog/datadog-agent/pkg/util/winutil"
@@ -44,6 +46,41 @@ var (
 	PIDBufferIncrement uint32 = 1024
 )
 
+var fileDescCache *simplelru.LRU[string, string]
+
+func init() {
+	var err error
+	fileDescCache, err = simplelru.NewLRU[string, string](512, nil)
+	if err != nil {
+		log.Errorf("Failed to create file description cache: %v", err)
+	}
+}
+
+// getFileDescriptionCached gets the file description for a given executable path
+func getFileDescriptionCached(exePath string) string {
+	if exePath == "" {
+		return ""
+	}
+
+	// Check cache first
+	if cached, ok := fileDescCache.Get(exePath); ok {
+		return cached
+	}
+
+	// Cache miss - get from Windows API
+	desc, err := winutil.GetFileDescription(exePath)
+	if err != nil {
+		log.Debugf("Could not get file description for %s: %v", exePath, err)
+		// for now cache these as a blank string as it could mean they
+		// don't have a description
+		desc = ""
+	}
+
+	// Cache the result
+	fileDescCache.Add(exePath, desc)
+	return desc
+}
+
 // NewProcessProbe returns a Probe object
 func NewProcessProbe(...Option) Probe {
 	p := &probe{}
@@ -520,6 +557,7 @@ func fillProcessDetails(pid int32, proc *Process) error {
 		if processCmdParams != nil {
 			proc.Cmdline = ParseCmdLineArgs(processCmdParams.CmdLine)
 			proc.Exe = processCmdParams.ImagePath
+			proc.Comm = getFileDescriptionCached(processCmdParams.ImagePath)
 			if len(processCmdParams.CmdLine) > 0 && len(proc.Cmdline) == 0 {
 				log.Warnf("Failed to parse the cmdline:%s for pid:%d", processCmdParams.CmdLine, pid)
 			}

pkg/process/procutil/process_windows_test.go

@@ -115,6 +115,7 @@ func TestWindowsProbe(t *testing.T) {
 			assert.Equal(t, []string{"powershell.exe", "-c", `"sleep 10; foo bar baz"`}, p.Cmdline)
 			assert.Equal(t, int32(os.Getpid()), p.Ppid)
 			assert.Equal(t, int32(cmd.Process.Pid), p.Pid)
+			assert.Equal(t, "Windows PowerShell", p.Comm)
 
 			assert.WithinRange(t, time.Unix(0, p.Stats.CreateTime*1000_000), now, now.Add(5*time.Second))
 

pkg/process/procutil/process_windows_toolhelp.go

@@ -211,6 +211,7 @@ func (p *windowsToolhelpProbe) ProcessesByPID(_ time.Time, collectStats bool) (m
 			Stats:    stats,
 			Exe:      cp.executablePath,
 			Username: cp.userName,
+			Comm:     cp.comm,
 		}
 	}
 	for pid := range knownPids {
@@ -226,6 +227,7 @@ type cachedProcess struct {
 	userName       string
 	executablePath string
 	commandLine    string
+	comm           string
 	procHandle     windows.Handle
 	parsedArgs     []string
 }
@@ -243,7 +245,7 @@ func (cp *cachedProcess) fillFromProcEntry(pe32 *w32.PROCESSENTRY32) (err error)
 	}
 	cp.executablePath = winutil.ConvertWindowsString16(pe32.SzExeFile[:])
 	cp.commandLine = cp.executablePath
-
+	cp.comm = getFileDescriptionCached(cp.executablePath)
 	// we cannot read the command line if the process is protected
 	if !isProtected {
 		commandParams, cmderr := winutil.GetCommandParamsForProcess(cp.procHandle, false)

pkg/util/winutil/process.go

@@ -20,10 +20,14 @@ import (
 var (
 	modntdll                       = windows.NewLazyDLL("ntdll.dll")
 	modkernel                      = windows.NewLazyDLL("kernel32.dll")
+	modversion                     = windows.NewLazyDLL("version.dll")
 	procNtQueryInformationProcess  = modntdll.NewProc("NtQueryInformationProcess")
 	procReadProcessMemory          = modkernel.NewProc("ReadProcessMemory")
 	procIsWow64Process             = modkernel.NewProc("IsWow64Process")
 	procQueryFullProcessImageNameW = modkernel.NewProc("QueryFullProcessImageNameW")
+	procGetFileVersionInfoSizeW    = modversion.NewProc("GetFileVersionInfoSizeW")
+	procGetFileVersionInfoW        = modversion.NewProc("GetFileVersionInfoW")
+	procVerQueryValueW             = modversion.NewProc("VerQueryValueW")
 )
 
 // C definition from winternl.h
@@ -480,3 +484,92 @@ func IsCurrentProcessLocalSystem() (bool, error) {
 
 	return currentUser.Equals(localSystem), nil
 }
+
+// GetFileDescription returns the file description for given executable path
+func GetFileDescription(executablePath string) (string, error) {
+	// Convert path to UTF16
+	pathPtr, err := syscall.UTF16PtrFromString(executablePath)
+	if err != nil {
+		return "", fmt.Errorf("failed to convert path to UTF16: %w", err)
+	}
+
+	// Get the size of the version information
+	var handle uint32
+	size, _, err := procGetFileVersionInfoSizeW.Call(
+		uintptr(unsafe.Pointer(pathPtr)),
+		uintptr(unsafe.Pointer(&handle)),
+	)
+	if size == 0 {
+		if err != nil && err != syscall.Errno(0) {
+			return "", fmt.Errorf("GetFileVersionInfoSizeW failed: %w", err)
+		}
+		return "", fmt.Errorf("no version information available for %s", executablePath)
+	}
+
+	// Allocate buffer for version info
+	data := make([]byte, size)
+
+	// Get the version information
+	ret, _, err := procGetFileVersionInfoW.Call(
+		uintptr(unsafe.Pointer(pathPtr)),
+		uintptr(handle),
+		uintptr(size),
+		uintptr(unsafe.Pointer(&data[0])),
+	)
+	// returns non-zero if successful, and zero if not
+	if ret == 0 {
+		return "", fmt.Errorf("GetFileVersionInfoW failed: %w", err)
+	}
+
+	// Query the language and code page
+	// First get the translation table
+	subBlockPtr, err := syscall.UTF16PtrFromString("\\VarFileInfo\\Translation")
+	if err != nil {
+		return "", fmt.Errorf("failed to create subblock string: %w", err)
+	}
+
+	var langCodePagePtr *uint16
+	var langCodePageLen uint32
+	ret, _, err = procVerQueryValueW.Call(
+		uintptr(unsafe.Pointer(&data[0])),
+		uintptr(unsafe.Pointer(subBlockPtr)),
+		uintptr(unsafe.Pointer(&langCodePagePtr)),
+		uintptr(unsafe.Pointer(&langCodePageLen)),
+	)
+
+	var langCodePage string
+	if ret == 0 || langCodePageLen < 4 {
+		return "", fmt.Errorf("no language code page found: %w", err)
+	}
+
+	pair := (*[2]uint16)(unsafe.Pointer(langCodePagePtr))
+
+	// Extract the first language/codepage pair
+	langCode := pair[0]
+	codePage := pair[1]
+	langCodePage = fmt.Sprintf("%04x%04x", langCode, codePage)
+
+	// Query for FileDescription
+	fileDescQuery := fmt.Sprintf("\\StringFileInfo\\%s\\FileDescription", langCodePage)
+	fileDescQueryPtr, err := syscall.UTF16PtrFromString(fileDescQuery)
+	if err != nil {
+		return "", fmt.Errorf("failed to create file description query: %w", err)
+	}
+
+	var fileDescPtr *uint16
+	var fileDescLen uint32
+	ret, _, err = procVerQueryValueW.Call(
+		uintptr(unsafe.Pointer(&data[0])),
+		uintptr(unsafe.Pointer(fileDescQueryPtr)),
+		uintptr(unsafe.Pointer(&fileDescPtr)),
+		uintptr(unsafe.Pointer(&fileDescLen)),
+	)
+
+	if ret == 0 || fileDescLen == 0 {
+		return "", fmt.Errorf("FileDescription not found in version info: %w", err)
+	}
+
+	// Convert the UTF16 string to Go string
+	fileDesc := windows.UTF16PtrToString((*uint16)(unsafe.Pointer(fileDescPtr)))
+	return fileDesc, nil
+}

pkg/util/winutil/process_test.go

@@ -116,3 +116,113 @@ func TestIsProcessProtected(t *testing.T) {
 		})
 	}
 }
+
+func TestGetFileDescription(t *testing.T) {
+	tests := []struct {
+		name         string
+		path         string
+		expectError  bool
+		validateFunc func(t *testing.T, desc string)
+	}{
+		{
+			name:        "notepad.exe",
+			path:        "C:\\Windows\\System32\\notepad.exe",
+			expectError: false,
+			validateFunc: func(t *testing.T, desc string) {
+				assert.Contains(t, desc, "Notepad", "notepad.exe does not match expected description")
+				t.Logf("notepad.exe description: %s", desc)
+			},
+		},
+		{
+			name:        "cmd.exe",
+			path:        "C:\\Windows\\System32\\cmd.exe",
+			expectError: false,
+			validateFunc: func(t *testing.T, desc string) {
+				assert.NotEmpty(t, desc)
+				assert.Contains(t, desc, "Command", "cmd.exe does mention not match expected description")
+				t.Logf("cmd.exe description: %s", desc)
+			},
+		},
+		{
+			name:        "explorer.exe",
+			path:        "C:\\Windows\\explorer.exe",
+			expectError: false,
+			validateFunc: func(t *testing.T, desc string) {
+				assert.Contains(t, desc, "Windows Explorer", "explorer.exe does not match expected description")
+				t.Logf("explorer.exe description: %s", desc)
+			},
+		},
+		{
+			name:        "powershell.exe",
+			path:        "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+			expectError: false,
+			validateFunc: func(t *testing.T, desc string) {
+				assert.Contains(t, desc, "Windows PowerShell", "powershell.exe does not match expected description")
+				t.Logf("powershell.exe description: %s", desc)
+			},
+		},
+		{
+			name:        "kernel32.dll",
+			path:        "C:\\Windows\\System32\\kernel32.dll",
+			expectError: false,
+			validateFunc: func(t *testing.T, desc string) {
+				assert.NotEmpty(t, desc)
+				t.Logf("kernel32.dll description: %s", desc)
+			},
+		},
+		{
+			name:        "non-existent file",
+			path:        "C:\\DoesNotExist\\fake.exe",
+			expectError: true,
+			validateFunc: func(t *testing.T, desc string) {
+				assert.Empty(t, desc)
+			},
+		},
+		{
+			name:        "empty path",
+			path:        "",
+			expectError: true,
+			validateFunc: func(t *testing.T, desc string) {
+				assert.Empty(t, desc)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			desc, err := GetFileDescription(tt.path)
+
+			if tt.expectError {
+				assert.Error(t, err, "Expected error for path: %s", tt.path)
+				t.Logf("Expected error: %v", err)
+			} else {
+				if err != nil {
+					t.Logf("Warning: Could not get file description for %s: %v", tt.path, err)
+					// Some systems might not have all files, so just log warning
+					return
+				}
+				assert.NoError(t, err, "Should not error for valid path: %s", tt.path)
+			}
+
+			if tt.validateFunc != nil {
+				tt.validateFunc(t, desc)
+			}
+		})
+	}
+}
+
+func TestGetFileDescriptionMultipleCalls(t *testing.T) {
+	// Test that multiple calls to the same file return consistent results
+	path := "C:\\Windows\\System32\\notepad.exe"
+
+	desc1, err1 := GetFileDescription(path)
+	if err1 != nil {
+		t.Skipf("Skipping test, notepad.exe not accessible: %v", err1)
+	}
+
+	desc2, err2 := GetFileDescription(path)
+	require.NoError(t, err2)
+
+	assert.Equal(t, desc1, desc2, "Multiple calls should return same description")
+	t.Logf("Consistent description: %s", desc1)
+}

releasenotes/notes/process-name-windows-65212a735d310076.yaml

@@ -0,0 +1,11 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+enhancements:
+  - |
+    On Windows, adds process name to live processes via file properties.