v1.0.0 - hightower

The first stable release of hightower.

hightower scans the processes running on your Windows PC and explains, in
plain language, what each one is -- flagging the unknown or out-of-place ones.
It is built for people who have no technical idea what is running on their
computer. New to this? Start with the beginner's guide (docs/GUIDE.md,
pt-BR: docs/GUIDE.pt-BR.md).

What it does

• hightower scan --all -- every process with a risk verdict
  (trusted / review / suspicious), category, and path, worst-first.
• hightower explain <name|pid> -- a plain-language write-up of a single
  process: what it is, whether many copies is normal, expected vs. actual path,
  and cautious advice.
• hightower scan --json -- the whole scan as JSON for scripts.
• Three risk heuristics (path masquerading, unsigned binary, unknown process),
  Authenticode signature checks, and an embedded known-process database.
• Offline-first: no network, no telemetry, ever. Read-only: it never touches a
  process.

Please read

hightower is an educational aid, not an antivirus. Verdicts are prompts to
investigate, not proof. Known limitations (signatures are embedded-only, no
publisher-name extraction yet, a small curated database) are documented in the
wiki.

Download

hightower-v1.0.0-x86_64-pc-windows-msvc.exe (Windows x64) is attached below,
built automatically from this tag. It is unsigned, so SmartScreen may warn on
first run; you can also build from source with
cargo build -p hightower-cli --release.

Thank you for trying hightower.

v0.5.0 - Explain & export

Two new ways to use hightower: dig into a single process, and export a scan for
scripts.

What's new

• hightower explain <name|pid> -- a plain-language write-up of one process:
  its risk, category, publisher, signature, path (and expected path), what it is,
  what (if anything) hightower noticed, and cautious guidance on what to do.
  Pass a PID or a process name; multiple instances of a name are summarised with
  a per-instance risk/path list.
• hightower scan --json -- the full classified scan as machine-readable
  JSON, for scripting and automation.

Example

> hightower explain explorer.exe
explorer.exe — PID 9088
  Risk:      trusted
  Category:  core-windows
  Publisher: Microsoft Windows
  Signature: signed
  Path:      C:\Windows\explorer.exe
  ...

Download

hightower-v0.5.0-x86_64-pc-windows-msvc.exe (Windows x64, unsigned -- SmartScreen
may warn). Or build from source: cargo build -p hightower-cli --release.

Reminder

hightower is an educational helper, not an antivirus. A verdict is a prompt to
look, not proof.

Next

Toward v1.0.0: finalising the docs and a first stable release.

v0.4.0 - Risk heuristics

hightower stops just listing processes and starts judging them. scan --all
now assigns each process a risk verdict and sorts the flagged ones to the top.

What's new

• Risk verdicts on every process: trusted / review / suspicious, in a
  new RISK / PID / NAME / CATEGORY / PATH table, worst-first, with a summary
  line (N suspicious, M to review).
• Three heuristics (Strategy pattern, in core):
  • Path masquerading -- a known Windows name running from the wrong folder ->
    suspicious.
  • Unsigned / untrusted binary -- via Authenticode WinVerifyTrust.
  • Unknown process -- not in the database and not validly signed -> review.
• Authenticode signature checks (adapters), run in parallel across
  processes with std::thread::scope.

Limitations (by design)

• Educational aid, not an antivirus -- verdicts are prompts to investigate,
  not proof. Expect false positives and false negatives.
• Signature checks read embedded signatures only; catalog-signed system
  binaries are handled via the known-process database instead.
• Publisher-name extraction and richer filtering are still to come.

Download

hightower-v0.4.0-x86_64-pc-windows-msvc.exe (Windows x64, unsigned -- SmartScreen
may warn). Or build from source: cargo build -p hightower-cli --release.

Next

v0.5.0 -- hightower explain <name|pid> and scan --json.

v0.3.0 - Known-process database

A foundation release. hightower now ships a curated database of well-known Windows processes, embedded in the binary.

What changed

• Embedded, offline known-process database (svchost, csrss, winlogon, wininit, services, lsass, smss, explorer) with expected directories, publisher, category, and plain-language EN/PT descriptions.
• EmbeddedKnowledgeRepository implements the knowledge-lookup port (case-insensitive).
• hightower --version now correctly reports the release version.

Note: no visible change yet

This release is internal groundwork. hightower scan --all behaves exactly as in v0.2.0 -- the database is not yet used to explain or judge processes. That wiring (the risk classifier) is the next milestone, v0.4.0.

The attached hightower-v0.3.0-x86_64-pc-windows-msvc.exe is therefore functionally the same as v0.2.0 for now; it is published for consistency. Unsigned (SmartScreen may warn); building from source works too.

Next

v0.4.0 -- risk heuristics: path masquerading, unsigned binaries, unknown processes.

v0.2.0 - Process listing MVP

The first working command: hightower scan --all lists every running process as a plain, aligned table.

Highlights

• hightower scan --all -- PID / NAME / PATH for every process.
• Windows ProcessLister via ToolHelp32 (adapters), all unsafe documented with // SAFETY:.
• Pure domain + ports in core (ProcessInfo, ProcessVerdict, RiskRule, ...), risk aggregation ready for the heuristics.
• Protected/SYSTEM processes are shown as (restricted) -- run from an elevated terminal for their full paths -- never dropped, never crashing the scan.

Download

hightower-v0.2.0-x86_64-pc-windows-msvc.exe (Windows x64). It is unsigned, so SmartScreen may warn on first run; you can also build from source with cargo build -p hightower-cli --release.

Not yet

No risk verdicts / known-process database / signature checks yet -- those are v0.3.0 and v0.4.0. This release only lists processes.

Next

v0.3.0 -- embedded known-Windows-process database.

v0.1.0 - Workspace & CI

First tagged milestone: the project skeleton and its safety nets. No user-facing features yet -- hightower only prints a placeholder.

Included

• Hexagonal Cargo workspace: core (pure domain, zero OS deps), adapters (Windows), cli (hightower binary).
• CI: test-core (windows + ubuntu), build-cli, fmt, clippy (-D warnings), cargo-audit.
• CodeQL (Rust), Dependabot, issue/PR templates.
• Bilingual README, Code of Conduct 2.1, CONTRIBUTING, SECURITY, FUNDING.
• main protected by a ruleset (PR + 1 review + green checks; admin bypass for the maintainer).

Next

v0.2.0 -- Process listing MVP: real hightower scan --all.