Steve @processhacker

System Informer | Process Hacker | Windows Internals | Wrangler of Dingoes processhacker.sourceforge.io Australia Joined March 2011

Tweets

46
Followers

422
Following

18
Likes

11

Steve @processhacker

3 weeks ago

Yeah, @Google my primary email created in 2004 and used daily for 22 years is a bot? I'm now locked out of +450 other websites including my bank, work and github which use it for MFA and have to wait several days before a human reviews the appeal?🤔🤢

0 3 14 1K 0

Download Image

diversenok @diversenok_zero

5 months ago

My new blog post 🥳 Improving AFD Socket Visibility for Windows Forensics & Troubleshooting It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥 huntandhackett.com/blog/improving…

2 41 81 7K 47

diversenok @diversenok_zero

6 months ago

Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩

2 21 112 11K 27

Download Image

Johnny Shaw @jxy__s

a year ago

As promised, I've updated the blog post with details and System Informer has received a patch to account for these changes in 24H2: winsiderss.github.io/si-blog/2023/0…

1 3 6 752 1

Johnny Shaw @jxy__s

a year ago

Changes to cycle accounting in 24H2 ARM64: PMCCNTR_EL0 removed, multiple new branches in the accounting path, and feature flags gating idle thread changes. Working on updates to System Informer cycle-based usage on ARM64 and the blog post. winsiderss.github.io/si-blog/2023/0…

1 2 22 2K 10

Download Image

Jiří Vinopal @vinopaljiri

a year ago

So I made a thing ☺️ Converted #phnt (Native API header files from the System Informer project) to #IDA TIL, IDC. To import "phnt" types and function definitions to IDA and help with Reverse Engineering. @HexRaysSA @mrexodia Introducing #IDA_PHNT_TYPES: github.com/Dump-GUY/IDA_P…

4 63 182 17K 71

Download Image

Steve @processhacker

a year ago

Microsoft finally updates documentation after 20 years @MSFTCopilot

0 0 10 304 0

Download Image

diversenok @diversenok_zero

2 years ago

The new Token Universe v0.5 can view and edit security descriptors on 30 types of securable objects. 🔥 It also knows how to handle complex ACLs with compound and callback ACEs, mandatory and trust labels, and more. Enjoy experimenting! github.com/diversenok/Tok…

1 31 70 11K 26

Download Image

Matthew @embee_research

3 years ago

Malware Analysis Tip - Use Process Hacker to watch for suspicious .NET assemblies in newly spawned processes. Combined with DnSpy - it's possible to locate and extract malicious payloads without needing to manually de-obfuscate. 1/ #Malware #dnspy #analysis #RE

8 211 646 80K 259

Download Image

Yarden Shafir @yarden_shafir

3 years ago

In more @SystemInformer news, @jxy__s and @aionescu did amazing work mapping process connections over ALPC ports

1 16 76 0 10

Download Image

Yarden Shafir @yarden_shafir

3 years ago

And the driver finally runs together with HVCI 😍

Yarden Shafir @yarden_shafir

3 years ago

And the driver finally runs together with HVCI 😍 https://t.co/S6zRinvMBU

5 37 167 0 14

Download Image

4 14 81 0 7

Download Image

Alex Ionescu @aionescu

3 years ago

I am ecstatic to announce that Winsider Seminars & Solutions, Inc. (the training company that @yarden_shafir and I co-own) has finalized the transfer of the venerable Process Hacker project into a new System Informer project (github.com/winsiderss/sys…). We are still migrating.. 1/2

10 154 403 0 68

Yarden Shafir @yarden_shafir

4 years ago

This. Or if you want to skip the RE: go read the @processhacker source code and learn all the cool things that happen behind the scenes. It’s one of the best sources of public Windows Internals documentation!

DebugPrivilege @DebugPrivilege

4 years ago

3 17 125 0 15

0 26 92 0 20

Johnny Shaw @jxy__s

4 years ago

New features for @processhacker - many others I can't cover here. Some highlights: Fiber, Stack usage, CPU breakdown, Priority boost for process thread columns. Bound connections for network tab. Check out the latest nightly!

0 20 140 0 14

Download Image

Richard Baranyi @rbaranyi

4 years ago

@aionescu @dwizzzleMSFT And then we have @processhacker that's trying its best to be complaint and MS bans them without any reason or help to solve the issues :(

1 1 2 0 0

impostor @impost0r_

4 years ago

A targeted attempt on security researchers has been happening. dnspy[dot]net has been registered and is serving a trojanized dnSpy binary (file: dnSpy.dll) Third rate trojan, caught by Microsoft Defender. Download links have been removed. Stay safe out there. Download from GitHub

7 158 367 0 22

Bill Demirkapi @BillDemirkapi

5 years ago

How to use @TrendMicro's Rootkit Remover to Install a Rootkit, including a fun bonus discovery that @TrendMicro is cheating WHQL certification. cc @msftsecurity d4stiny.github.io/How-to-use-Tre…

12 228 531 0 53

Binni Shah @binitamshah

4 years ago

Microsoft no longer signs Windows drivers for Process Hacker : borncity.com/win/2021/10/23…

11 111 281 0 36

Steve @processhacker

4 years ago

@dwizzzleMSFT @yarden_shafir The driver doesn't have "arbitrary kernel RW" functionality, you can verify our source code... The bigger issue here is @msftsecurity and @dwizzzleMSFT secretly banning a competitors product using a false pretext which is a federal crime.

4 13 60 0 0

Johnny Shaw @jxy__s

4 years ago

I'm excited to share this project, C++ STL in the Windows Kernel with C++ Exception Support: github.com/jxy-s/stlkrn The project uses MSVC C++ STL in a Windows Kernel Driver - jxystl implements MSVC functionality and STL wrappers to make it Windows Kernel friendly. Check it out!