View Single Post
Old 10-24-2019, 23:04
bolo2002 bolo2002 is offline
Join Date: Apr 2002
Posts: 549
Rept. Given: 107
Rept. Rcvd 13 Times in 12 Posts
Thanks Given: 174
Thanks Rcvd at 215 Times in 138 Posts
bolo2002 Reputation: 13
Originally Posted by DavidXanatos View Post
New Release:

Finally we arrived at the build v1.0, this build features a extended xprocesshacker.sys that can unprotect (PPL) protected processes.
An other great new feature is a much better remote host name resolution for sockets, instead of just relying on reverse dns (which in the age of CDN's is not very reliable), we monitor ETW events emitted when a process issues a dns query. This way we know what domains every process requested and what IP's it got as answer, hence when observing a new socket we first check in this list for matching entries, when found it is almost certain the socket was opened with the intention to reach the captured domain.


xprocesshacker.sys can now unprotect and re protect protected processes (light)
using ETW Events to monitor what domains individual processes querry
-- enabled more accurate remote hostname column display


cleaned up PH directory
improved process display for the case when multiple processes are sellected
now using to monitor ETW events
reworked socket process association
when opening finder the search term ist selected such it can be replaced quickly


no longer trying to do reverse dns on adresses that returned no results
Like said Fyyre on (

excellent work!
your task explorer could even be source closed,i hope your work will not be stolen,it's more than a simple github project.
I like this forum!
Reply With Quote