@processhacker

System Informer | Process Hacker | Windows Internals | Wrangler of Dingoes

 Australia
processhacker.sourceforge.io/
Joined March 2011
  • Tweets49
  • Following19
  • Followers424
5Media
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
#TaskManager and #ProcessExplorer are dead (because they lie). Long live to @SystemInformer (and shame to #Powerpoint)
1
1
5
274
Replying to @daaximus
A function named "RunTimeSettings::IsJolt" was added to Windows Task Manager recently with a significant amount of warbird encryption/obfuscation for no reason?
1
4
357
Yeah, @Google my primary email created in 2004 and used daily for 22 years is a bot? I'm now locked out of +450 other websites including my bank, work and github which use it for MFA and have to wait several days before a human reviews the appeal?🤔🤢
3
16
1,859
My new blog post 🥳 Improving AFD Socket Visibility for Windows Forensics & Troubleshooting It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥 huntandhackett.com/blog/impr…

Improving AFD Socket Visibility for Windows Forensics & Troubleshooting

This blog post explains the basics of Ancillary Function Driver API and how it can help explore networking activity on Windows systems.

huntandhackett.com
2
40
2
91
10,092
Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩
2
21
1
115
12,496
As promised, I've updated the blog post with details and System Informer has received a patch to account for these changes in 24H2: winsiderss.github.io/si-blog…

Porting Cycle-Based CPU Usage to ARM64

In this post I will share my story porting System Informer’s cycle-based CPU usage to ARM64. I’ll explain the difference in CPU cycle tracking on Windows ARM64, compare time-based vs cycle-based...

winsiderss.github.io
1
3
7
827
Changes to cycle accounting in 24H2 ARM64: PMCCNTR_EL0 removed, multiple new branches in the accounting path, and feature flags gating idle thread changes. Working on updates to System Informer cycle-based usage on ARM64 and the blog post. winsiderss.github.io/si-blog…
1
2
23
2,275
So I made a thing ☺️ Converted #phnt (Native API header files from the System Informer project) to #IDA TIL, IDC. To import "phnt" types and function definitions to IDA and help with Reverse Engineering. @HexRaysSA @mrexodia Introducing #IDA_PHNT_TYPES: github.com/Dump-GUY/IDA_PHNT…
4
61
2
181
17,240
Microsoft finally updates documentation after 20 years @MSFTCopilot
10
326
The new Token Universe v0.5 can view and edit security descriptors on 30 types of securable objects. 🔥 It also knows how to handle complex ACLs with compound and callback ACEs, mandatory and trust labels, and more. Enjoy experimenting! github.com/diversenok/TokenU…
2
31
73
12,011
Replying to @namazso @mrexodia @timmisiak @SystemInformer
InternalGetWindowIcon doesn't return the icon for packaged processes - another issue is that function always returns a icon handle (even when the window doesn't have an icon - exceeding shared desktop heap limits and preventing applications from running)
198
The Windows Shell maps shared caches into each process for MRU (most recently used) and auto-complete (FileSystem etc...) and entire clipboard history (Winkey+V)... If the process is using shell functions then it'll have a copy of that cache in memory and find strings
26
Replying to @embee_research
The System Informer/ProcessHacker nightly build uses debugger instrumentation for showing .NET assemblies instead of ETW events like other tools. It's able to show CLR modules otherwise hidden by exploits targeting ETW.
185
Malware Analysis Tip - Use Process Hacker to watch for suspicious .NET assemblies in newly spawned processes. Combined with DnSpy - it's possible to locate and extract malicious payloads without needing to manually de-obfuscate. 1/ #Malware #dnspy #analysis #RE
8
213
3
641
81,041
Replying to @elfchief @SystemInformer
Disabling the driver limits viewing everything for system processes, limits thread stacks, limits handle info (ALPC, ETW and others), disables protection features (VSM/KDP) and higher cpu/memory use because no driver notifications and having to poll for changes to objects etc..
Replying to @elfchief @SystemInformer
You can also follow this thread for updates: github.com/winsiderss/system…

SystemInformer constantly hangs after 'upgrade' from ProcessHacker · Issue #1515 · winsiderss/sys...

Brief description of your issue I've been using ProcessHacker for many years and never had a problem. The latest 'update' installed SystemInformer. Now, it constantly freezes. Steps to ...

github.com
1
Replying to @elfchief @SystemInformer
It's a Windows kernel bug from multiple drivers queuing APCs are fired more than once. It needs changes from third parties and OS. We've fixed ours but can't update the driver until Microsoft fix other issues so for now you'll need to disable the driver in the options window.
Replying to @elfchief @SystemInformer
Yes there was a regression in the nightly driver. It's been fixed but we're waiting for updated driver signing (temporarily suspended by MS)
1
Replying to @yarden_shafir @aall86 @jxy__s @aionescu
dmex is @processhacker ;P
3
In more @SystemInformer news, @jxy__s and @aionescu did amazing work mapping process connections over ALPC ports
1
14
1
75
Load more