-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathnotes.txt
102 lines (68 loc) · 3.85 KB
/
notes.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
* Option to disable tray mini window
This has been added as a setting. You'll have to download the latest dev
build and change MiniInfoWindowEnabled to 0 in your settings.xml file
(%AppData%\Process Hacker 2) or processhacker.settings.xml in to $INSTDIR .
Notes:
* Tray mini window is enabled by default.
* New Your can use Perl-style regexp for find handles and dlls window soon.
* Toolbar button "Show Details for All Processes"
this toolbar button is hidden when you're already running with
elevated privileges (user use admin's account than mark as "<username>+"
in to main window title).
* The official repository for Process Hacker Your can find on to GitHub:
https://github.com/processhacker/processhacker
* Kernel mode driver KProcessHacker has four security level parameter store in
to "SecurityLevel" (Reg_Dword) value whats needed for check Process Hacker
binary signature and user privileges:
00000000 - None, all clients are allowed, no security, recomended for non
official build
00000001 - Privilege Check, require SeDebugPrivilege
00000002 - SignatureCheck, require trusted signature
00000003 - Signature and Privilege Check, require trusted signature and
SeDebugPrivilege. This is maximum security level.
By default parameters "SecurityLevel" is set to hight security level - 2.
* For non-signed build please, alwayse set setting name "EnableKphWarnings"
in to settings.xml (ProcessHacker.exe.settings.xml for portable copy) up
to "0":
<setting name="EnableKphWarnings">0</setting>
Also run as user is the member Administrators group "updkph.cmd":
@echo off
@setlocal
@sc stop KProcessHacker3
@if defined PROCESSOR_ARCHITEW6432 (set reg="%systemroot%\sysnative\reg.exe"
) else (
set reg=reg)
@reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\KProcessHacker3\Parameters" /v "SecurityLevel" /t REG_DWORD /d 0 /f
@sc start KProcessHacker3
@exit
* Terminator:
WARNING! Current plug-in code is incompatible in to commit Git 4e7fb3827 or newer! See https://github.com/processhacker/plugins-extra/issues/83 for details.
Plug-in Terminator is already required whats user have "SeDebugPrivilege" and dinamically load driver KPH2. User don't needed installation this driver!
* MainWindowTabRestoreEnabled option:
MainWindowTabRestoreEnabled=[0|1], logically, enable auto save latest main
window tab index and restored is after next Process Hacker startup. Main
window tab index is:
0 - Process tab
1 - Services tab
2 - Network tab
3 - Disk tab
4 - Firewall tab
* Services highlighting color and options for Services tab:
"UseColorServiceStop" - enable/disable highlight service in to "Stop pending" state. By default is "Enabled" ("1").
"ColorServiceStop" - by default this color is 0x6d6d6d
"UseColorUnknown" - enable/disable highlight untrusted service, by default is "Enabled" ("1").
"ColorUnknown" - by default this color is 0x507fff
* Apiset memory features exist only for Windows 8 / Server 2012 or neever Microsoft OS
* DPI Awareness Extras:
Adds a "DPI awareness extended" column to the process tree which
1. Shows additional info about DPI awareness
2. Works for Windows versions before 8.1 (before GetProcessDpiAwareness was introduced)
Flags
Flags are shown in parenthesis after the awareness. They consists of a letter followed by a status which is one of
"+" The flag is on
"-" The flag is off
"?" The status is unknown
Currently the following flags are shown
F The DPI awareness is forced by the system, may be due to compatibility settings or desktop-composition being disabled.
Known limitations
On Windows 8.1+ the DPI awareness of processes on other sessions/window stations (possibly even desktops) arealways shown as Unaware, this is due to a limitation of GetProcessDpiAwareness