System Informer

System Informer is a free, portable, multi-purpose tool for monitoring system resources, debugging software, and detecting malware. Key capabilities include:

• System Activity Monitoring: Detailed overview of system activity with highlighting and real-time disk access information.
• Resource Tracking: Graphs and statistics to identify resource-heavy or runaway processes.
• File & Network Analysis: Identify which processes are locking files and view/manage active network connections.
• Advanced Debugging: View detailed stack traces with support for kernel-mode, WOW64, and .NET.
• Service Management: Create, edit, and control Windows services beyond the capabilities of services.msc.
• Portability: Small footprint with no installation required.

The System Informer Kernel driver provides broad system access and enforces strict security policies to prevent unauthorized exploitation. Access is granted only to verified callers based on the state of the calling process (including signing, privileges, and integrity checks).

To interact with the driver, binaries must meet one of the following criteria:

1. Possess a .sig file generated from the key pair integrated into the build process and driver.
2. Be signed by Microsoft or an anti-malware vendor.

Important Notes:

• Third-party plugins: While supported, loading unsigned third-party plugins will result in restricted access to the driver.
• Tamper Protection: The driver tracks verified clients and denies access if it detects process tampering or exploitation attempts.

SymCrypt follows Semantic Versioning 2.0.0.

• Major version: Introduces ABI and/or API breaking changes (including behavior changes).
• Minor version: Introduces backwards compatible functionality, improvements, or bug fixes.
• Patch version: Introduces backwards compatible bug fixes.

Servicing Recommendation: Distro vendors and application developers should regularly update to the latest version of SymCrypt and the SymCrypt engine to receive security fixes and performance improvements. Staying on the current version avoids the risks associated with complex backports.

The recommended way to build SymCrypt is using the provided Python build script located at scripts/build.py. You can inspect available arguments and requirements by running the script with the --help flag. For alternative build methods, refer to BUILD.md.

python scripts/build.py --help

The phnt headers provide up-to-date Native API definitions for user-mode programs. To use them, ensure your project uses the latest Windows SDK.

Instead of including the standard <windows.h>, you must include phnt_windows.h followed by phnt.h at the top of your source file.

• #include <phnt_windows.h>: Provides access to the Win32 API and NTSTATUS values.
• #include <phnt.h>: Provides access to the entire Native API.

To develop for the System Informer Kernel, you can suppress security protections and state requirements by enabling debug and test signing mode. This allows the client process to be debugged and permits the use of test signing keys. This requires disabling Secure Boot if applicable.

bcdedit /debug on
bcdedit /set testsigning on

Once your plugin DLL is built, follow these steps to load it into System Informer:

1. Directory Creation: Create a directory named plugins in the same folder where SystemInformer.exe is located.
2. Deployment: Copy your plugin DLL file into the plugins directory.
3. Activation: Open System Informer, go to Options, enable plugins, and restart the application.

Note: Plugins will only load if the System Informer executable is named exactly SystemInformer.exe.

Plugins can be managed and configured via the menu path: Hacker > Plugins.

Plugin Troubleshooting & Usage:

• Stability: If crashes occur related to plugins, ensure all installed plugins are up to date.
• ExtendedTools Plugin:
  • Requires Windows Vista or higher.
  • To access Disk and Network information via this plugin, you must run System Informer with administrative rights.

To develop plugins for System Informer, you must configure your C++ compiler with the provided SDK directories and ensure you have the latest Windows SDK installed.

1. Include Paths: Add the include directory to your compiler's include paths.
2. Library Paths: Add the lib/<platform> directory (e.g., lib/x64) to your compiler's library paths.
3. Linker Requirements: Your plugin must be compiled as a DLL. At a minimum, you must link against SystemInformer.lib and ntdll.lib.
4. Core Header: Include <phdk.h> to access phlib functions, System Informer application functions, and the Native API.

// Minimum requirements for a plugin
#include <phdk.h>
// Link against SystemInformer.lib and ntdll.lib

After a successful build, use the scripts/test.py helper script to execute the unit test suite. On Windows, these tests perform functional verification, compare results against Windows APIs (CNG and CAPI) or other implementations (rsa32, msbignum) if available, and provide performance metrics.

python scripts/test.py

To start System Informer, execute SystemInformer.exe.

Version Selection: There are two distinct versions available: 32-bit (x86) and 64-bit (x64).

• You must select the version that matches your system architecture.
• Note: Unlike many other programs, the 32-bit version of System Informer will not function correctly if run on a 64-bit system.
• To check your system type, navigate to Control Panel > System in Windows.

Testing is performed using the RunTest script (for the library) and RunGrepTest (for the pcre2grep command). On Unix-like systems, running make check executes all appropriate tests.

Running Tests with RunTest

• Basic usage: ./RunTest runs the standard test suite.
• Specific bit-widths: Use -8, -16, or -32 to run tests for a specific library version.
• Selecting specific tests:
  • Pass test numbers as arguments: ./RunTest 2 7 11
  • Use ranges: ./RunTest 3-6
  • Use ranges to the end: `./RunTest 3-"
  • Exclude tests using ~: ./RunTest 3-15 ~10 (runs 3 to 15, excluding 10).
• Special modes:
  • list: Outputs a list of all available tests.
  • valgrind: Prefix the command with valgrind to run tests under memory debugging.
  • nojit: Add nojit to the command line to suppress JIT-specific testing.