Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/pavel-durov/whq
This Project uses various technologies for extracting handles data from a given process context.
https://github.com/pavel-durov/whq
Last synced: about 1 month ago
JSON representation
This Project uses various technologies for extracting handles data from a given process context.
- Host: GitHub
- URL: https://github.com/pavel-durov/whq
- Owner: Pavel-Durov
- License: mit
- Created: 2015-10-28T17:12:56.000Z (about 9 years ago)
- Default Branch: master
- Last Pushed: 2022-10-30T12:13:36.000Z (about 2 years ago)
- Last Synced: 2024-12-06T21:32:53.799Z (about 1 month ago)
- Language: C#
- Homepage:
- Size: 21.8 MB
- Stars: 3
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# WHQ
This Project uses various technologies for extracting Windows process handles data from a given context. Based on ClrMd, WCT, MiniDump and other Windows APIs at its core.
There is two possible sources : live process, dump file
For live process you'll need to pass the PID as the Command-Line parameter by this convention:
-live -p [PID]If you want to use dump file as a source:
-dump -p [FILE]Filtering Options:
-b, --Blocking Objects Get list of blocking objects.
-s, --Stack Trace List threads and their stack frames
-h, --Total handles Summary of handles and their types
-t, --Threads list List of process threads
-a, --All List all available data (-b, -s, -h, -t)The result is printed to the console and to text files. Text files can be found in "./Logs" directory.
Used Technologies:
Live Process:
Managed threads: ClrMd + WinBase.h API (NtQueryObject)
Native Threads: WCT + WinBase.h API (NtQueryObject)Supported OS:
Windows 10 (10.*), Windows 8 (6.3), Windows 8.1 (6.3)Dump File:
Managed threads: ClrMd + WinBase.h API (NtQueryObject)
Native Threads: MiniDump + WinBase.h API (NtQueryObject)Supported OS:
Windows 10 (10.*), Windows 8 (6.3), Windows 8.1 (6.3), Windows 7