@processhacker

System Informer | Process Hacker | Windows Internals | Wrangler of Dingoes

 Australia
processhacker.sourceforge.io/
Joined March 2011
  • Tweets49
  • Following19
  • Followers425
5Media
#TaskManager and #ProcessExplorer are dead (because they lie). Long live to @SystemInformer (and shame to #Powerpoint)
1
1
5
274
My new blog post 🥳 Improving AFD Socket Visibility for Windows Forensics & Troubleshooting It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥 huntandhackett.com/blog/impr…

Improving AFD Socket Visibility for Windows Forensics & Troubleshooting

This blog post explains the basics of Ancillary Function Driver API and how it can help explore networking activity on Windows systems.

huntandhackett.com
2
40
2
91
10,092
Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩
2
21
1
115
12,496
As promised, I've updated the blog post with details and System Informer has received a patch to account for these changes in 24H2: winsiderss.github.io/si-blog…

Porting Cycle-Based CPU Usage to ARM64

In this post I will share my story porting System Informer’s cycle-based CPU usage to ARM64. I’ll explain the difference in CPU cycle tracking on Windows ARM64, compare time-based vs cycle-based...

winsiderss.github.io
1
3
7
828
Changes to cycle accounting in 24H2 ARM64: PMCCNTR_EL0 removed, multiple new branches in the accounting path, and feature flags gating idle thread changes. Working on updates to System Informer cycle-based usage on ARM64 and the blog post. winsiderss.github.io/si-blog…
1
2
23
2,276
So I made a thing ☺️ Converted #phnt (Native API header files from the System Informer project) to #IDA TIL, IDC. To import "phnt" types and function definitions to IDA and help with Reverse Engineering. @HexRaysSA @mrexodia Introducing #IDA_PHNT_TYPES: github.com/Dump-GUY/IDA_PHNT…
4
61
2
181
17,240
The new Token Universe v0.5 can view and edit security descriptors on 30 types of securable objects. 🔥 It also knows how to handle complex ACLs with compound and callback ACEs, mandatory and trust labels, and more. Enjoy experimenting! github.com/diversenok/TokenU…
2
31
73
12,012
Malware Analysis Tip - Use Process Hacker to watch for suspicious .NET assemblies in newly spawned processes. Combined with DnSpy - it's possible to locate and extract malicious payloads without needing to manually de-obfuscate. 1/ #Malware #dnspy #analysis #RE
8
213
3
641
81,041
In more @SystemInformer news, @jxy__s and @aionescu did amazing work mapping process connections over ALPC ports
1
14
1
75
And the driver finally runs together with HVCI 😍
Yarden Shafir@yarden_shafir15 Nov 2022
🥳
4
13
4
79
I am ecstatic to announce that Winsider Seminars & Solutions, Inc. (the training company that @yarden_shafir and I co-own) has finalized the transfer of the venerable Process Hacker project into a new System Informer project (github.com/winsiderss/system…). We are still migrating.. 1/2

GitHub - winsiderss/systeminformer: A free, powerful, multi-purpose tool that helps you monitor...

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-inte...

github.com
10
151
4
401
This. Or if you want to skip the RE: go read the @processhacker source code and learn all the cool things that happen behind the scenes. It’s one of the best sources of public Windows Internals documentation!
This quoted post is unavailable.
Try viewing anyway · View on X
26
89
New features for @processhacker - many others I can't cover here. Some highlights: Fiber, Stack usage, CPU breakdown, Priority boost for process thread columns. Bound connections for network tab. Check out the latest nightly!
20
137
Replying to @aionescu
And then we have @processhacker that's trying its best to be complaint and MS bans them without any reason or help to solve the issues :(
1
1
2
How to use @TrendMicro's Rootkit Remover to Install a Rootkit, including a fun bonus discovery that @TrendMicro is cheating WHQL certification. cc @msftsecurity d4stiny.github.io/How-to-use…
11
223
23
521
Microsoft no longer signs Windows drivers for Process Hacker : borncity.com/win/2021/10/23/…

Microsoft no longer signs Windows drivers for Process Hacker

[German]Brief information, which is already here with me since August 2021, but which I have not yet addressed in the blog. David Xanatos has pointed out to me that Microsoft is refusing to sign…

borncity.com
11
107
15
276
Replying to @yarden_shafir
The driver doesn't have "arbitrary kernel RW" functionality, you can verify our source code... The bigger issue here is @msftsecurity and @dwizzzleMSFT secretly banning a competitors product using a false pretext which is a federal crime.
4
13
1
59
I'm excited to share this project, C++ STL in the Windows Kernel with C++ Exception Support: github.com/jxy-s/stlkrn The project uses MSVC C++ STL in a Windows Kernel Driver - jxystl implements MSVC functionality and STL wrappers to make it Windows Kernel friendly. Check it out!
3
42
2
143
Process Hacker: Advanced Task Manager Overview varonis.com/blog/process-hac… via @varonis
1
1
5
Really awesome additions to @processhacker's peviewer recently! Searchable imports/exports! And the Relocation symbolic resolution gives some awesome inspection opportunities!
2
1
22
Load more