Skip to content

Build v1.0
Compare
Choose a tag to compare
@DavidXanatos DavidXanatos released this 18 Oct 10:19
· 110 commits to master since this release
v1.0
b8009d1

Finally we arrived at the build v1.0, this build features a extended xprocesshacker.sys that can unprotect (PPL) protected processes.
An other great new feature is a much better remote host name resolution for sockets, instead of just relying on reverse dns (which in the age of CDN's is not very reliable), we monitor ETW events emitted when a process issues a dns query. This way we know what domains every process requested and what IP's it got as answer, hence when observing a new socket we first check in this list for matching entries, when found it is almost certain the socket was opened with the intention to reach the captured domain.

Added

  • xprocesshacker.sys can now unprotect and re protect protected processes (light)
  • using ETW Events to monitor what domains individual processes querry
    -- enabled more accurate remote hostname column display

Changed

  • cleaned up PH directory
  • improved process display for the case when multiple processes are sellected
  • now using https://github.com/microsoft/krabsetw to monitor ETW events
  • reworked socket process association
  • when opening finder the search term ist selected such it can be replaced quickly

Fixed

  • no longer trying to do reverse dns on adresses that returned no results
Assets 4
Loading