Task Explorer - An Advanced Task Manager for hackers

[DavidXanatos]

I have a small inquiry for you guys...

What features would you like to see in the next builds?


I was thinking about the ability to set priorities and CPU affinities persistently, i.e. the tool would remember it on an file name basis and whenever a process is seen with one of the preset paths (or only exe name, in the end probably a wildcard path really) its priorities and stuff will get adjusted accordingly.

I was also thinking about adding an option to perpetually kill processes on the same basis, when one gets seen it will get killed.
thinking here about typical telemetry processes like vctip.exe (VS2017/2019), software_reporter_tool.exe (Chrome), NvTelemetryContainer (NVidia) etc....


With regard to not allowing processes to start I could enforce that using the driver so that the process never goes past created suspended. But is that overkill?
Is that the right thing for a task manager or should that go into some separate HIPS tool? I don't want to cram thematically unrelated features together, but well not allowing processes to start is still in the scope of a process manager.

What do you think?

[wild]

Is there (I couldn't find it) a way to "dump" on file all of the information relative to a specific process?
Just as an example, the list of all opened files?

BTW, great program!

[deepzero]

Yes, I think the kill feature would be better to have in a separate program.
The program is great, but maybe you can find a way to either switch to git altogether or find a way to make your workflow work with github. This would allow others to contribute to the project smoothly.

[CRC32]

Originally Posted by wild

Is there (I couldn't find it) a way to "dump" on file all of the information relative to a specific process?
Just as an example, the list of all opened files?

BTW, great program!

Yes, my favorite tool at the moment lol!
Very good work!

[Stingered]

Originally Posted by DavidXanatos

I have a small inquiry for you guys...

What features would you like to see in the next builds?


I was thinking about the ability to set priorities and CPU affinities persistently, i.e. the tool would remember it on an file name basis and whenever a process is seen with one of the preset paths (or only exe name, in the end probably a wildcard path really) its priorities and stuff will get adjusted accordingly.

I was also thinking about adding an option to perpetually kill processes on the same basis, when one gets seen it will get killed.
thinking here about typical telemetry processes like vctip.exe (VS2017/2019), software_reporter_tool.exe (Chrome), NvTelemetryContainer (NVidia) etc....


With regard to not allowing processes to start I could enforce that using the driver so that the process never goes past created suspended. But is that overkill?
Is that the right thing for a task manager or should that go into some separate HIPS tool? I don't want to cram thematically unrelated features together, but well not allowing processes to start is still in the scope of a process manager.

What do you think?

Is useful to have option for suspend process?

[DavidXanatos]

Is useful to have option for suspend process?

You mean something that would suspend all started processes that have a certain path name?

hmm... for an every day use I don't think that is a good idea you would accumulate possibly hundreds of such processes.

but for some particular debug operations when you want to trace something that spawns many child processes really thoroughly, may be...

[Stingered]

Originally Posted by DavidXanatos

You mean something that would suspend all started processes that have a certain path name?

hmm... for an every day use I don't think that is a good idea you would accumulate possibly hundreds of such processes.

but for some particular debug operations when you want to trace something that spawns many child processes really thoroughly, may be...

"but for some particular debug operations when you want to trace something that spawns many child processes really thoroughly, may be..."

this (an option, not automatic) - thx

[tgd]

Shell David

This Seema an awesome piece of software.

That being salid. Andy france of having a precompiled versión
@ github?

Cheers
TGD

[Abaddon]

Originally Posted by tgd

Andy france of having a precompiled versión

After performing syntax fuzzing...

https://github.com/DavidXanatos/TaskExplorer/releases

[tgd]

Originally Posted by Abaddon

After performing syntax fuzzing...

Oh boy! Spell checker did something weird and funny!

Originally Posted by Abaddon

https://github.com/DavidXanatos/TaskExplorer/releases

Thanks!

Jeep safe!

Cheers
TGD

[DavidXanatos]

This build focuses on many large and small usability improvements as well as a few small new features.

Download: https://github.com/taskexplorer/TaskExplorer/releases/tag/v1.2

ChangeLog:
[1.2.0] - 2020-04-20
Added

Option to configure process name display
Pressing the refresh toolbar button now also clears the persistence when in hold mode
Persistent Process Presets
-- CPU, IO, Memory Priorities and CPU Affinity can be set persitence actoss process starts
-- Processes are identifyed by path wildcard paths can be used
-- The mechanism can also kill undesired processes swiftly
add pe file viewer
Sandboxie support, sandboxed prosesses are marked in yellow and the box thay belong to is provided in the tooltip

Changed

more options on main window close
-- Exit confirmation dialog can now be disabled
by default symbols are not auto downloaded, upon selecting a thread the user will be prompted whether to download them of the internet
updated PHlib to version 3.0.3014
updated some default collors
switched to Inno Setup as instller

Fixed

fixed when opening from tray window sometimes being empty

[DavidXanatos]

This build comes with many big fixes and minor usability improvements.

Download: https://github.com/taskexplorer/TaskExplorer/releases/tag/v1.2.1

[1.2.1] - 2020-04-27

Added

the TCP/IP traffic graph now show additional plots with LAN traffic based on ETW data
services can now be stoped from the process tree contect menu

Changed

statis column now sorts not alphabetically but by list color
reorganized the tool bar a bit and added a few shortcuts
switched back to the custom installer due to "compatybility" issues

Fixed

cpu affinity was not properly loaded from file
fixed more tray opening issues
fixed issue displaying .NET assembly informations
fixed issues with list coloring when not allcolors were enabled

[DavidXanatos]

This build updates the driver with the ability to log kernel debug messages, when Debug Output Logging is enabled every process gets a Debug tab with its debug output and accordingly the system process is showing the Kernel Debug Output.

Other changes reorganized the UI to be more comprehensive, I would recommend to disable all System info tabs that contain graphs and use then only from the standalone System Info window. This uncluttered the UI quite a bit further more the Kernel View tab has been incorporated into the system tab and some process info tabs now are sub tabs of the general process tab.

Download: https://github.com/taskexplorer/TaskExplorer/releases/tag/v1.2.1

[1.2.5] - 2020-06-01

Added
Added debug view tab to see the debug output of individual process, when debug monitor is enabled
Added kernel debug log option to xprocesshacker3 driver

Changed
Sandboxie support needs to be enabled in the settings, as having it always on interfears with updating sandboxie
moved services tab to the general tab as a sub tab
moved environment tab to the general tab as a sub tab
merged system info tab kernel objects and main system tab
moved a lot of usefull generic code to MiscHelpers.dll

Fixed
fixed tab menu checks
fixed issue with system and task info window tabs
fixed issue process name label forcing panel size
fixed soem more minor ui glitches

Have Fun!

[DavidXanatos]

PS: ups the download link is not right that's the latest one: https://github.com/taskexplorer/TaskExplorer/releases/tag/v1.2.5

[DavidXanatos]

New Update with various usability improvements.

Download: https://github.com/taskexplorer/TaskExplorer/releases/tag/v1.2.7

Changelog:
[1.2.7] - 2020-06-13

Added
Custom run dialog with the ability to inject a DLL when starting process
Added process filter to proces tree to improve usability

Changed
description in the process column now shows for svchost.exe instances a list of hosted services
esc key now clsoes the finder bar in lists
app id column now displays teh container id if its an app

Fixed

run dialogs now execute on return press
error with comctl32
user connect/login window now hides teh password
fixed pid in process info window
modern apps are now properly atributed to the their users