Skip to content
Switch branches/tags
Go to file
Cannot retrieve contributors at this time
added ExCreateCallback list to the callbacks list (PR #26)
internal rearrange
view security for alpc ports (most of them)
security descriptor view dialog (object sid, dacl & sacl)
fix scm services list query
fix "jump to file may fail under certain conditions" bug
various minor UI changes
21h1 compatibility improvements
20h1/20h2/21h1 compatibility improvements
added recognizing of shimmed drivers for drivers list (win10+)
show process trust label for sections if it present
plugins system extended and upgraded to support context plugins
added imagescope plugin for section object types backed by imagefile
added plugins viewer
various minor changes
treelist: fix tooltips flickering on Windows 7
turn off Spectre nonsense
rtls update
reimplemented directory object dump to output more data
added callbacks registered with ExRegisterExtension
fix for pipes (PR #17)
internal rearrange
fix high cpu usage for splitter drag (report/fix by RamMerlabs)
fix security dialog regression (reported by RamMerlabs)
fix object cookie
add error log
20h1/20h2 compatibility improvements
support of additional helper driver
fix Windows 7 regressions
internal rearrange
ported to msvc 2019 (with backward compatibility to 2017)
fix current directory value for elevated/system re-launch (reported by RamMerlabs)
added Token object properties
added PsAltSystemCallHandlers to callbacks dialog
fix High DPI issues
fix Pipe security dialog not shown where available
fix multiple Wine/Wine Staging misbehavior
corrected typo in DebugObject description
more 20H1 support changes
various minor changes
19H2 support
Preliminary 20H1 support
improved run as localsystem feature
added plugin subsystem
added example plugin
added Sonar plugin - NDIS protocols viewer
added ApiSetView plugin - ApiSetSchema viewer (supported v2, v4, v6)
added software licensing cache view (extras)
resolve apisets while viewing shadow table in Windows 10 20H1 >= 18890 builds
fix displaying sid user/domain information for private namespaces
added refresh (f5) for private namespace dialog
threads list in processes dialog
view file properties for KisServiceTable/W32pServiceTable dialogs
process/thread/token object properties dialogs
symbolic link object dump
internal fixes after profiling
support for 19H1 SeCiCallbacks scan
added and updated more object type descriptions
SeCiCallbacks/g_CiCallbacks, DbgkLmdCallbacks added to the callbacks viewer
Session object view and access rights, merge pull request #8 #9
fixed regression added in 1.7.0
treelist updated
code can now be compiled as C++
added W32pServiceTable view
added process list dialog (extras)
added Callback object type callbacks list (Properties->Object)
added callbacks viewer for certain callback types (registry, ps, ob, kebugcheck, se, dbg, po, io etc)
reimplemented "type" object type view (added missing fields from w10+)
reimplemented service tables extraction code
ported to msvc 2017 (with backward compatibility to 2015)
reimplemented private namespaces lookup
object directory dump reflect Win10 changes
added alpc port dump and additional dialog
treelist control updated
private namespaces dialog updated
usershareddata dialog updated
internal rearrange
merge pull request #7, fix Job object process list display
multiple Wine Staging fixes
rtls updated
tweaked PTL display
added display of Process Trust Label for Directory object type
OpenWindowStation fix
internal rearrange
added Partition, DxgkCurrentDxgProcessObject objects description
added mailslots viewer dialog
added file properties for drivers (menu -> extras -> Drivers)
added FltConnectionPort object dump
switched to hde instead of ldasm
fixed Wine behavior along with some bugs
rtls updated, switched to VS2015 U3
note: Windows 10 RS2 (15063), RS1 (14393) supported as well as TH1(10240)/TH2(10586), RS3 supported (16288+ build)
v 1.4.0
drivers list and dump (menu -> extras)
kiservicetable dump for all supported Windows versions
some code revision and corrections
v 1.3.0
official support for Windows 10
private namespaces (menu -> extras)
v 1.2.0
added KUSER_SHARED_DATA dump (menu -> extras)
code revision and corrections
ported to msvc 2015
v 1.1.0
added popup menu for Process page
added file properties dialog for Process page
added descriptions for more object types
added named pipes dialog (menu -> extras)
added information for IoCompletion object type, including structured object body dump2
some code revision and corrections
v 1.0.0 (Feb 23, 2015)
initial release