Process Hacker Forums

Done

Done in r6320 for the most common columns only.

OK, regex support has been added.

I will try to add regex support to the Find Handles and DLLs window soon.

I suggest making both Physical Memory and Commit Charge graphs and labeling them as such. On an unrelated note, I suggest adding "Show details for all processes" toolbar button. I found myself doing it way too often under win 7, because normal user can't see disk and network rates and gra...

This has been added as a setting. You'll have to download the latest dev build and change MiniInfoWindowEnabled to 0 in your settings.xml file (%AppData%\Process Hacker 2).

The process that caused the event is halted while the umkcf client processes the event. The umkcf client must process the event, decide whether to reject process creation, and return its decision to the driver.

The PS and OB callbacks check driver signing, and this driver would bypass that.

I think the readme tells you how to get portable settings working.

2 years ago I started writing a framework for doing exactly this sort of thing: https://github.com/wj32/umkcf The bad news is: 1. Although I have a signed version of the umkcf driver, it really goes against everything that MS has been doing to secure the kernel, and I won't be releasing it. 2. The c...

I think ntfs (and a bunch of other drivers) are special in that way, so don't change anything. If it ain't broke don't fix it

That's a good point! But creating derived "tree" columns will still be pretty annoying...

I'm definitely not using any Windows source code, which I don't have access to (obviously). It's a combination of things, and it took me quite some time and effort to compile those headers. I'd rather not say how I did it though

Right click on the tray icon.

The GenerateHeader tool (in the tools folder) generates it based on the options in build/sdk/phapppub_options.txt.

It will be fine as long as the license is displayed somewhere.

Right now the best way is to enable the memory tray icon and hover over it. Chrome processes are grouped in the pop up window.

Wow that's a pretty clever idea! Thanks for the post.

Try this version: http://wj32.org/wp/software/process-hacker/

PPH_STRING is in UTF-16. Use PhConvertUtf16ToUtf8Ex(string->Buffer, string->Length) to get a PPH_BYTES that is in UTF-8.