Skip to content

4.0.26241.138

Latest
Latest

Choose a tag to compare

View all tags
@jxy-s jxy-s released this 29 Aug 01:54
Immutable release. Only release title and notes can be modified.
v4.0.26241.138
99a0d28
This commit was signed with the committer’s verified signature.
jxy-s Johnny Shaw
SSH Key Fingerprint: TxSIodELPAadCNIYs6MEByYkOcQgMFnb2usvjXnSQm8
Verified
Learn about vigilant mode.

System Informer 4.0

The first 4.0 release: a new kernel/user transport, a Process Monitor, Hybrid Analysis integration, a JSON settings store, a rewritten installer, and a year of fixes across the app, driver, plugins, and phnt headers.

Highlights

  • Process Monitor (Tools menu): a driver-backed live log of process, thread, image, registry, file, handle and silo events with filtering, access-mask decoding, and configurable look-back.
  • Hybrid Analysis integration (OnlineChecks): System Informer can now automatically check running processes and loaded images against Hybrid Analysis, showing verdicts directly in the process and module lists via a new Hybrid Analysis column. Unknown files can optionally be submitted for analysis. Results are cached locally so repeated lookups are free, and scanning is opt-in with per-service API keys, path exclusions, and rate handling built in.
  • Ring-buffer informer transport in the kernel driver: large shared-memory ring instead of per-message port round-trips, with rate limiting and per-client statistics; informer callbacks run at APC/DPC level where possible.
  • New installer: modern wizard with dark mode, DPI scaling, uninstaller, shortcut page, and atomic staged extraction with rollback — failed updates no longer leave a half-written directory.
  • Updater: toast-notification flow with progress and actions; BITS, Delivery Optimization and Microsoft Store download back-ends.
  • Low-latency mode (experimental, Windows 11): high-resolution provider timers.
  • Per-monitor DPI and dark theme work throughout the app, plugins, and property sheets, including Windows 11 borders and much less resize flicker.

Application

New

  • Users tab (logged-on sessions); process environment editor with multi-entry split editing; WMI tab gains MI support.
  • Columns: Short user name, service Username, thread RPC usage, thread kernel stack, handle reference count/size, extended GDI/handle details, ALPC port state; GPU/NPU committed memory.
  • Process tree: independent root/child sort options, Collapse/Expand All, aggregate-aware sorting; Ctrl-drag parent fix.
  • Threads: Freeze/Thaw, suspended/wait-type highlighting; Modules: native/mapped highlighting and CLR metadata mapping.
  • Memory strings search: parallel/bulk scanning, UTF-8, progress, sortable results.
  • Services: multi-select start/pause with progress and retry; Run As: per-launch privilege selection and AppContainer launch.
  • Handle protect/inherit changes without the driver; COM permission dialogs; desktop heap detection; UDP firewall-exempt port highlighting.
  • System Information: reorderable sections, horizontal scrolling, per-CPU speed; overhauled tray mini-info window; energy statistics.
  • Options: consolidated Highlighting page, per-tab layout persistence, advanced setting editor; settings.schema.json shipped for editors.
  • Hold Shift at startup to launch the original Task Manager when System Informer is the replacement.

Fixed

  • I/O delta columns sorting by cumulative values; page/IO priority in Threads tab; protection column sort; username column not updating.
  • Process affinity regressions (single and multi processor groups); main window stealing foreground at startup; previous-instance restore and handle leak.
  • Hangs opening the security editor and AFD socket properties; crashes on CPUs without rdtscp, in snapshot handling, on "Current Power Scheme", and with WSL info when no distro is installed.
  • Settings not saving on network shares; User Notes not reloaded on restart; Windows 7 import resolution.
  • Numerous memory and handle leaks, out-of-bounds reads (CPU info, syscall list, AVX search), and dark-theme painting bugs.

Kernel driver (KSystemInformer)

  • Silo (container) informer; file informer now reports copy operations, access masks and image sizes; thread kernel-stack query; hash-result caching; dedicated system process for driver threads.
  • Object protection reworked with broader handle-access stripping and on-demand protection; CID table population optimized; portable mode always unloads the driver on exit.
  • Hardening: OBJ_DONT_REPARSE on all internal opens; message/dynamic-data validation and size math hardened; share-check/paging-file open options require MAXIMUM state; "securely created" state requires WinTcb/WinSystem creator; randomized minifilter altitude when load fails; rundown protection for hash/verify.
  • Many correctness fixes: native-load race, ring-buffer signaling, informer state leak, file-op buffer/MDL handling, EPROCESS/VPB/pool-tag issues, image-mapping leak, registry post-op strings, thread handle guarantees.

Security hardening (user mode)

  • Updater: the downloaded installer is now re-verified from disk and held with a deny-write handle until launched, failing closed otherwise.
  • phsvc: the elevated helper now pins the client image to Systchecks integrity before accepting connections.
  • Overflow-checked size math in ACL/security-descriptor, heap and config parsing; DbgHelpVerifyMicrosoftChain setting to verify the dbghelp/symsrv signing chain; remote environment address validation.

Hybrid Analysis & file reputation (OnlineChecks)

  • Automatic reputation scanning of processes and modules with Hybrid Analysis; verdicts surface in a new Hybrid Analysis column and in the file properties.
  • Optional automatic submission of unknown files to Hybrid Analysis for sandbox analysis.
  • Opt-in setup flow with a Hybrid Analysis partner prompt; perd path exclusions so sensitive directories are never hashed orsubmitted; configurable startup delay.
  • Batched hashing and requests with rate-limit handling, and a portable SQLite scan cache shared safely across multiple System Informer processes.

Plugins

  • ExtendedTools: ACPI tables, TPM boot log (WBCL), Power Grid/ and Startup Tasks dialogs; per-adapter/per-node GPU columns and GPU memory mini-info; disk rate columns; better firewall monitor.
  • WindowExplorer: rewritten on a window-provider model (pause/resume, message-only windows, snapshot finder); UI Automation and child-window property tabs; highlight overlay.
  • ToolStatus: menu-bar mode, Find window, rendering and leak fixes.
  • HardwareDevices: device-tree search and sort options; AMD RAPL fix; crash fix on driver-search page.
  • NetworkTools: continuous-ping traceroute; refreshed GeoLite/IANA port data; WHOIS fixes.
  • DotNetTools: rate-per-second counters; leak/crash fixes; updated CLR headers.
  • All plugins: settings.json, clearer load-error messages, lower memory use.

peview

  • Manifest, LoadLibrary/GetProcAddress, PDB symbol tree, dynamic-relocation tree, Resource Viewer, exception unwind, section slack and CLR metadata views; SymCrypt hashing; sort-crash and DPI fixes.

Build & project

  • Rewritten CMake build (MSVC and clang-cl, x86/x64/ARM64) and build_cmake.cmd; EWDK/ESDK support; new build_msix.cmd, build_header.cmd, build_compile_commands.cmd.
  • Third-party: SymCrypt, Zydis, PCRE2 SIMD added; PCRE, miniz, maxminddb, json-c, PresentMon updated.

Contributors

Thanks to everyone who contributed this cycle: @dmex, @jxy-s, @Zack-src, @diversenok, @henrypp, @mochaaP, @gremlinbeet, @zjgcjy, @RenardDev, @josediazfer, @sc1341, @MozhuCY, @ZX41R, @orbisai0security, @changdingfang, @YeDemirkiran, @rich-ayr, @robionekenobi, @pasharm, @Abrar74774, @JustasMasiulis, @ge0rdi — with first-time contributions from 18 of them.

Merged pull requests

And many other changes... +2,493 commits, 1,501 changed files 5011.2103...v4.0.26241.138(v3.2.25011.2103...v4.0.26241.138)

Contributors

dmex, ge0rdi, and 23 other contributors
Assets 5
Loading