|
|
#1
09-02-2019, 17:03
|
|||
|
|||
|
Task Explorer - An Advanced Task Manager for hackers
Since Task explorer went a long way from a first preview build till now, I thought it would better fit into this section of the forum, so lets continue here.
Task Explorer is an advanced Task Manager tool with emphasis on, not just monitoring what applications are running, but on finding out what applications are doing. Screenshot: https://i.ibb.co/q5406rC/1.png The UI focuses on expedience and getting real time data of what the processes are doing at any given moment. Relevant data are provided in easy to access (as less clicks as possible) panels, with no need to open windows or windows of sub windows, instead additional information’s for selected entries are shown in the lower half of the panel. Allowing to browse the detailed information’s using arrow keys. And most data are refreshed continuously, as seeing the dynamic of values often grants additional insight. The Thread Panel contains a stack trace for the selected thread giving even more insight in wat the selected application is doing right now. This is also very useful to debug deadlocks or performance issues. The processes memory can be viewed and edited from the Memory Panel, which provides an advanced memory editor and string search capability. In the Handles Panel all open handles are shown, with useful information’s like file name the current file position and size, these allow to see what a program is actually working on right now disk wise. The Socket Panel shows all open connections/sockets per process providing also data rate information, in the settings one can enable the display of pseudo UDP connections created from ETW data. That is every destination endpoint for UDP packets will be shown as an own entry in the sockets panel allowing to monitor with whom a program is communicating. The Modules Panel shows all loaded dll’s and memory mapped files, allowing to unload them as well as to inject a dll. And many more panels like Token, Environment, Windows, GDI, .NET, etc…. By double clicking on a process, the Task Info panels can be opened in a separate window enabling the viewing of properties of multiple processes simultaneously. The system monitor aspect of the application is also well developed. The toolbar provides decently sized graphs providing not just CPU usage but also usage of Objects, handles, network and IO/disk access. The system info panels show All Open Files in the system, All Open Sockets by programs, and the services Panel allows viewing and controlling all system services including drives. The performance panels for CPU, Memory, Disk I/O, Network and GPU provide large graphs showing the usage of system resources in a detailed manner. The System info panel can be collapsed completely providing more space for the Task info panels. So Instead being a panel of the main window, or additionally, the system info panels can be opened in an own window using the appropriate toolbar button. Task Explorer can be found on my GitHub page: https://github.com/DavidXanatos/TaskExplorer its fully Open Source under the GPLv3.0 and is created using the Qt Framework, making its UI platform independent. As at a later point I intent to port the tool to Linux, creating the first advanced GUI based task manager for Linux ever. The tool is build using the process hacker library and it uses a self-compiled version of the kprocesshacker.sys driver called xprocesshacker.sys, the driver is signed using a “found” code signing certificate. However if preferred by the user the tool can also use the original kprocesshacker.sys driver however then with some limitations as the driver locks some functionality out if the accessing tool is not digitally signed by the process hacker team. I would appreciate feedback and improvement suggestions / feature requests... 
|
| The Following User Gave Reputation+1 to DavidXanatos For This Useful Post: | ||
uranus64 (10-26-2019) | ||
| The Following 13 Users Say Thank You to DavidXanatos For This Useful Post: | ||
|
#2
09-02-2019, 17:06
|
|||
|
|||
|
Most recent build, as of today: https://github.com/DavidXanatos/TaskExplorer/releases/tag/v0.8.5
[0.8.5] - 2019-09-01 This release focuses on bug fixing and usability improvements. An other major change is the use of the own xprocesshacker.sys driver by default, this is required as the original kprocesshacker.sys comes with a DRM that locks some functionality away from tools which are not signed by the process hacker team. With an own driver we can again mess with protected processes and read any memory location. The used leaked signing certificate does not seam to raise to many read flags eider, virus total: xprocesshacker.sys 4 false positivs https://www.virustotal.com/gui/file/ac2ed32418c81cf97dd6a53e258b4066952affbb768e66ebaaf57643d5f145ec/detection vs original kprocesshacker.sys 13 false positivs https://www.virustotal.com/gui/file/220a2dcf4d597f9208c0e7fd7057a91e88e118d420f20aac8e75ae3e39a7ac22/detection In fact we get much less than process hacker does. Added
Changed
Fixed
|
|
#3
09-09-2019, 17:55
|
|||
|
|||
|
New Release: https://github.com/DavidXanatos/TaskExplorer/releases/tag/v0.9.0
This releases added some new useful insights into the operating system and adds firewall event monitoring to be able to show blocked connection attempts. [0.9.0] - 2019-09-09 Added added windows firewall monitor to show blockes connection atempts added network column to processes, showing if a process is or was using network sockets added toolbar button to set persistence to 1h added toolbar menu to quickly change item persistence added kernel object tab to system panel, including the pool table and otehr informations added nt object browser sub tab added atom table view to the kernel objects tab Changed The system info Drivers tab is now moved to a sub tab of the new kernel objects tab the stack trace section of the thread window can now be colapsed Fixed fixed issue disabling network adapter graphs did not work fixed driver view module info was not loaded
|
|
#4
09-16-2019, 00:45
|
|||
|
|||
|
New release: https://github.com/DavidXanatos/TaskExplorer/releases/tag/v0.9.25
This releases added many small convenience features, as well as a few major once. It now has a DNS cache tab, and the date form the DNS cache are used to more reliably resolve the remote host mane to which a socket was opened. Instead of just using a reverse dns which in the age of CDN's, likecloud flare and blazing fast, is quite useless, the tool correlates new sockets with the system DNS cache this way resolving which host name the process actually requested. Task explorer can now use the Wait Chain Traversal feature of windows to debug deadlocks of processes. And as the version approaches 1.0 we have many bug fixed. [0.9.25] - 2019-09-15 Added added remote host names resolution for the socket's tabs added dns cache viever with 60 min persistence -- the dns cache feature correlates the cached data with open sockets and provides a remote host name more reliable than reverse dns lookups better formating when copying panels added column reset option to all lists added f5 full refresh options added security explorer all sub windows now save their geometry addes Working Set Watch fature to count page faults added a few more pool informations added running object table view to kernel objects added Wait Chain Traversal feature to detect deadlocks added option to open thread tokens Changed when a new process is seen in an ETW or FW event it is now created and some masic infos are loaded copy cell now can copy multiple cels when enabling/disablign columns a refresh is triggered right away to fill in the data (in caseuse has set a ver slow refresh rate) improved menu layout Fixed fixed on copy cell did not work properly with multiple items selected fixed on cppy panel and row copying empty(hiden) columns fixed process tree horizontal scroll bar position reset on selection in tree fixed NtQueryInformationFile deadlock in windows 7 when querying \Device\VolMgrControl fixed issue where some deltas caused a overflow when the counter reset
|
|
#5
09-24-2019, 23:17
|
|||
|
|||
|
New release: https://github.com/DavidXanatos/TaskExplorer/releases/tag/v0.9.50
This new build features many usability improvements and some bug fixes. [0.9.50] - 2019-09-24 Added critical status added to processes state string critical processes / threads have an own list color trying to terminate a critical process or thread wil now display an additional confirmation mesage ctrl+c now copys the selected rows formating for copying panels can be set in settings added additional mitigation informations added additional informations to geneal process info -- details sub tab -- security sub tab -- app subtab added job id to job tab added app infos to process general tab Changed resolving symbols for pool limits is only triggered once the kernel objects tab gets opened all priority settings have now an own groupe in the process tree no longer keeping a handle open to all threads when thay were not used recently mitigation informtions are not more verbose Fixed all unselected tabs are no longer unnececerly updated at startup issue with private bytes displaying the wrong value fixed crash bug in task menu action handling fixed a minor issue with sid resolving
|
|
#6
09-30-2019, 03:32
|
|||
|
|||
|
New release: https://github.com/DavidXanatos/TaskExplorer/releases/tag/v0.9.75 This release focuses on bugfixes many many bug fixes, and some usability improvements. [0.9.75] - 2019-09-29 Added priority columns now show text instead of numbers (except base |
