@processhacker

System Informer | Process Hacker | Windows Internals | Wrangler of Dingoes

 Australia
processhacker.sourceforge.io/
Joined March 2011
  • Tweets49
  • Following19
  • Followers425
5Media
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
#TaskManager and #ProcessExplorer are dead (because they lie). Long live to @SystemInformer (and shame to #Powerpoint)
1
1
5
274
Replying to @daaximus
A function named "RunTimeSettings::IsJolt" was added to Windows Task Manager recently with a significant amount of warbird encryption/obfuscation for no reason?
1
4
357
Yeah, @Google my primary email created in 2004 and used daily for 22 years is a bot? I'm now locked out of +450 other websites including my bank, work and github which use it for MFA and have to wait several days before a human reviews the appeal?🤔🤢
3
16
1,859
My new blog post 🥳 Improving AFD Socket Visibility for Windows Forensics & Troubleshooting It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥 huntandhackett.com/blog/impr…

Improving AFD Socket Visibility for Windows Forensics & Troubleshooting

This blog post explains the basics of Ancillary Function Driver API and how it can help explore networking activity on Windows systems.

huntandhackett.com
2
40
2
91
10,092
Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩
2
21
1
115
12,496
As promised, I've updated the blog post with details and System Informer has received a patch to account for these changes in 24H2: winsiderss.github.io/si-blog…

Porting Cycle-Based CPU Usage to ARM64

In this post I will share my story porting System Informer’s cycle-based CPU usage to ARM64. I’ll explain the difference in CPU cycle tracking on Windows ARM64, compare time-based vs cycle-based...

winsiderss.github.io
1
3
7
828
Changes to cycle accounting in 24H2 ARM64: PMCCNTR_EL0 removed, multiple new branches in the accounting path, and feature flags gating idle thread changes. Working on updates to System Informer cycle-based usage on ARM64 and the blog post. winsiderss.github.io/si-blog…
1
2
23
2,276
So I made a thing ☺️ Converted #phnt (Native API header files from the System Informer project) to #IDA TIL, IDC. To import "phnt" types and function definitions to IDA and help with Reverse Engineering. @HexRaysSA @mrexodia Introducing #IDA_PHNT_TYPES: github.com/Dump-GUY/IDA_PHNT…
4
61
2
181
17,240
Microsoft finally updates documentation after 20 years @MSFTCopilot
10
326
The new Token Universe v0.5 can view and edit security descriptors on 30 types of securable objects. 🔥 It also knows how to handle complex ACLs with compound and callback ACEs, mandatory and trust labels, and more. Enjoy experimenting! github.com/diversenok/TokenU…
2
31
73
12,012
Replying to @namazso @mrexodia @timmisiak @SystemInformer
InternalGetWindowIcon doesn't return the icon for packaged processes - another issue is that function always returns a icon handle (even when the window doesn't have an icon - exceeding shared desktop heap limits and preventing applications from running)
198
Load more