DOCSEARCHbyAlgolia
Submit Docs

WinObjEx64 Documentation

repository·master·Indexed 24 days ago

https://github.com/hfiref0x/winobjex64

An advanced 64-bit Windows utility for exploring and inspecting the Windows Object Manager namespace. It provides visibility into kernel objects, drivers, processes, and system callbacks, featuring symbolic link resolution, security information editing, and detailed structured dumps of OBJECT_TYPE. The tool supports a plugin subsystem for extending functionality and requires administrative privileges for advanced namespace access and kernel memory operations via helper drivers like KLDBGDRV.

Tokens
8.2K
Snippets
11
Records
65
Agent score
84%

What's inside WinObjEx64

  1. Overview of WinObjEx64

    master
    WinObjEx64 is an advanced utility for exploring the Windows Object Manager namespace. It provides a hierarchical view of objects, allows for symbolic link resolution, and offers deep inspection of object details (such as descriptions, flags, and memory pool types). It also supports viewing and editing object-related security information, provided the user has the necessary access rights.

  9. Use the new ImageScope context plugin for section objects

    master

    WinObjEx64 version 1.8.7 introduced the ImageScope context plugin. When you select a section object that is backed by an image file, you can use this plugin to view detailed information about that file, including:

    • Version information fields
    • Printable strings extracted from the image

  10. View the W32pServiceTable

    master

    The W32pServiceTable viewer allows you to inspect the service table of Win32k (the Windows User and GDI subsystem driver). This is a secondary system service table, distinct from the KiServiceTable managed by ntoskrnl.

    Requirements:

    • OS Version: Windows 10 1607 (RS1 14393) or newer.
    • Privileges: Must run WinObjEx64 as an Administrator.
    • Debug Mode: If using the kldbgdrv version, Windows must be booted in Debug mode.

    Usage:

    • You can save the contents of this table to a text file via the popup menu.

  11. Inspect Process, Thread, and Token properties

    master

    WinObjEx64 allows for detailed inspection of various Windows objects:

    • Process properties: Displays basic information about a selected process object, including security descriptors and applied mitigation policies. To view all available process information, the program must be running with elevated privileges.
    • Thread properties: Displays basic information about a selected thread object, including object security. Full information visibility requires elevated privileges.
    • Token properties: Displays basic information about an access token. This can be accessed for a Process object or for a Thread object if it is currently impersonating a client.

  12. Build WinObjEx64 from source

    master

    To build WinObjEx64, you need Microsoft Visual Studio 2015 or later and a minimum Windows SDK version of 8.1 (version 10.0.19041 or higher is recommended).

    Build Instructions

    1. Open the solution in Visual Studio.
    2. Select the Platform Toolset for the project (Project -> Properties -> General):
      • Use v140 for Visual Studio 2015
      • Use v141 for Visual Studio 2017
      • Use v142 for Visual Studio 2019
      • Use v143 for Visual Studio 2022
    3. Set the Target Platform Version (Project -> Properties -> General):
      • If using v140, select 8.1
      • If using v141 or higher, select 10