@processhacker

System Informer | Process Hacker | Windows Internals | Wrangler of Dingoes

 Australia
processhacker.sourceforge.io/
Joined March 2011
  • Tweets49
  • Following19
  • Followers424
5Media
#TaskManager and #ProcessExplorer are dead (because they lie). Long live to @SystemInformer (and shame to #Powerpoint)
1
1
5
274
Yeah, @Google my primary email created in 2004 and used daily for 22 years is a bot? I'm now locked out of +450 other websites including my bank, work and github which use it for MFA and have to wait several days before a human reviews the appeal?🤔🤢
3
16
1,859
My new blog post 🥳 Improving AFD Socket Visibility for Windows Forensics & Troubleshooting It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥 huntandhackett.com/blog/impr…

Improving AFD Socket Visibility for Windows Forensics & Troubleshooting

This blog post explains the basics of Ancillary Function Driver API and how it can help explore networking activity on Windows systems.

huntandhackett.com
2
40
2
91
10,092
Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩
2
21
1
115
12,496
As promised, I've updated the blog post with details and System Informer has received a patch to account for these changes in 24H2: winsiderss.github.io/si-blog…

Porting Cycle-Based CPU Usage to ARM64

In this post I will share my story porting System Informer’s cycle-based CPU usage to ARM64. I’ll explain the difference in CPU cycle tracking on Windows ARM64, compare time-based vs cycle-based...

winsiderss.github.io
1
3
7
827
Changes to cycle accounting in 24H2 ARM64: PMCCNTR_EL0 removed, multiple new branches in the accounting path, and feature flags gating idle thread changes. Working on updates to System Informer cycle-based usage on ARM64 and the blog post. winsiderss.github.io/si-blog…
1
2
23
2,275
So I made a thing ☺️ Converted #phnt (Native API header files from the System Informer project) to #IDA TIL, IDC. To import "phnt" types and function definitions to IDA and help with Reverse Engineering. @HexRaysSA @mrexodia Introducing #IDA_PHNT_TYPES: github.com/Dump-GUY/IDA_PHNT…
4
61
2
181
17,240
Microsoft finally updates documentation after 20 years @MSFTCopilot
10
326
The new Token Universe v0.5 can view and edit security descriptors on 30 types of securable objects. 🔥 It also knows how to handle complex ACLs with compound and callback ACEs, mandatory and trust labels, and more. Enjoy experimenting! github.com/diversenok/TokenU…
2
31
73
12,011
Malware Analysis Tip - Use Process Hacker to watch for suspicious .NET assemblies in newly spawned processes. Combined with DnSpy - it's possible to locate and extract malicious payloads without needing to manually de-obfuscate. 1/ #Malware #dnspy #analysis #RE
8
213
3
641
81,041
In more @SystemInformer news, @jxy__s and @aionescu did amazing work mapping process connections over ALPC ports
1
14
1
75
And the driver finally runs together with HVCI 😍
Yarden Shafir@yarden_shafir15 Nov 2022
🥳
4
13
4
79
I am ecstatic to announce that Winsider Seminars & Solutions, Inc. (the training company that @yarden_shafir and I co-own) has finalized the transfer of the venerable Process Hacker project into a new System Informer project (github.com/winsiderss/system…). We are still migrating.. 1/2

GitHub - winsiderss/systeminformer: A free, powerful, multi-purpose tool that helps you monitor...

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-inte...

github.com
10
151
4
401
This. Or if you want to skip the RE: go read the @processhacker source code and learn all the cool things that happen behind the scenes. It’s one of the best sources of public Windows Internals documentation!
This quoted post is unavailable.
Try viewing anyway · View on X
26
89
New features for @processhacker - many others I can't cover here. Some highlights: Fiber, Stack usage, CPU breakdown, Priority boost for process thread columns. Bound connections for network tab. Check out the latest nightly!
20
137
Replying to @aionescu
And then we have @processhacker that's trying its best to be complaint and MS bans them without any reason or help to solve the issues :(
1
1
2
How to use @TrendMicro's Rootkit Remover to Install a Rootkit, including a fun bonus discovery that @TrendMicro is cheating WHQL certification. cc @msftsecurity d4stiny.github.io/How-to-use…
11
223
23
521
Microsoft no longer signs Windows drivers for Process Hacker : borncity.com/win/2021/10/23/…

Microsoft no longer signs Windows drivers for Process Hacker

[German]Brief information, which is already here with me since August 2021, but which I have not yet addressed in the blog. David Xanatos has pointed out to me that Microsoft is refusing to sign…

borncity.com
11
107
15
276
Load more