Steve

System Informer | Process Hacker | Windows Internals | Wrangler of Dingoes

[Raffaele Rialdi @raffaeler]

#TaskManager and #ProcessExplorer are dead (because they lie). Long live to @SystemInformer (and shame to #Powerpoint)

[Steve @processhacker]

@daaximus A function named "RunTimeSettings::IsJolt" was added to Windows Task Manager recently with a significant amount of warbird encryption/obfuscation for no reason?

[Steve @processhacker]

Yeah, @Google my primary email created in 2004 and used daily for 22 years is a bot? I'm now locked out of +450 other websites including my bank, work and github which use it for MFA and have to wait several days before a human reviews the appeal?🤔🤢

[diversenok @diversenok_zero]

My new blog post 🥳

Improving AFD Socket Visibility for Windows Forensics & Troubleshooting

It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥
https://t.co/UDw18wKDdc

[diversenok @diversenok_zero]

Better socket handle visibility coming soon to @SystemInformer 🔥

When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩

[Johnny Shaw @jxy__s]

As promised, I've updated the blog post with details and System Informer has received a patch to account for these changes in 24H2:

https://t.co/bDf4DDtDYJ

[Johnny Shaw @jxy__s]

Changes to cycle accounting in 24H2 ARM64: PMCCNTR_EL0 removed, multiple new branches in the accounting path, and feature flags gating idle thread changes. Working on updates to System Informer cycle-based usage on ARM64 and the blog post.

https://t.co/bDf4DDtDYJ

[Steve @processhacker]

@Aiden9_ @Aiden_9 Your screenshots show Process Hacker failed with ACCESS_DENIED for MW2? How did a 15 year old game from 2009 stop PH? You can't use Process Hacker for cheating. It alerted anti-cheat via ObRegisterCallbacks and the AC blocked access by design - btw I'm the dev of PH :)

[Jiří Vinopal @vinopaljiri]

So I made a thing ☺️
Converted #phnt (Native API header files from the System Informer project) to #IDA TIL, IDC.

To import "phnt" types and function definitions to IDA and help with Reverse Engineering.
@HexRaysSA @mrexodia

Introducing #IDA_PHNT_TYPES:
https://t.co/EOC909MIH1

[Steve @processhacker]

Microsoft finally updates documentation after 20 years @MSFTCopilot

[diversenok @diversenok_zero]

The new Token Universe v0.5 can view and edit security descriptors on 30 types of securable objects. 🔥

It also knows how to handle complex ACLs with compound and callback ACEs, mandatory and trust labels, and more. Enjoy experimenting!

https://t.co/Rmd1MenqHI

[Steve @processhacker]

@namazso @mrexodia @timmisiak @SystemInformer InternalGetWindowIcon doesn't return the icon for packaged processes - another issue is that function always returns a icon handle (even when the window doesn't have an icon - exceeding shared desktop heap limits and preventing applications from running)

[Steve @processhacker]

@mrexodia @timmisiak @namazso @SystemInformer Querying the icon for packaged processes requires getting the PKEY_Tile_SmallLogoPath from FOLDERID_AppsFolder (this is documented) then using an undocumented interface called IMrtResourceManager and passing the SmallLogoPath to IResourceMap_GetFilePath (returns actual filename)

[Steve @processhacker]

@masterchaerge The Windows Shell maps shared caches into each process for MRU (most recently used) and auto-complete (FileSystem etc...) and entire clipboard history (Winkey+V)... If the process is using shell functions then it'll have a copy of that cache in memory and find strings

[Steve @processhacker]

@embee_research The System Informer/ProcessHacker nightly build uses debugger instrumentation for showing .NET assemblies instead of ETW events like other tools. It's able to show CLR modules otherwise hidden by exploits targeting ETW.

[Matthew @embee_research]

Malware Analysis Tip - Use Process Hacker to watch for suspicious .NET assemblies in newly spawned processes.

Combined with DnSpy - it's possible to locate and extract malicious payloads without needing to manually de-obfuscate.

1/

#Malware #dnspy #analysis #RE

[Steve @processhacker]

@elfchief @SystemInformer Disabling the driver limits viewing everything for system processes, limits thread stacks, limits handle info (ALPC, ETW and others), disables protection features (VSM/KDP) and higher cpu/memory use because no driver notifications and having to poll for changes to objects etc..

[Steve @processhacker]

@elfchief @SystemInformer You can also follow this thread for updates: https://t.co/J2KOUVmPzC

[Steve @processhacker]

@elfchief @SystemInformer It's a Windows kernel bug from multiple drivers queuing APCs are fired more than once. It needs changes from third parties and OS. We've fixed ours but can't update the driver until Microsoft fix other issues so for now you'll need to disable the driver in the options window.