[TaskViewer] [NetApi view] [Process view] [RegEdit] [Memory editor] [File editor] [Disk editor] [Run dialog] [Sub-apps]

TaskView - usage manual

Aim

This program is aimed to aid debuging programs and system performance.
It is not intended for ordinary users, since there is few help, if any.
It is rather intended for programmers, who already know, what particular information means...

Please note, that you are responsible for what you do with it, there are no warnings, what your action will cause, just some confirmations, if you really want to do that... It is so easy to spoil things...

Another major aim is to judge running & installed programs and detect virus & malware and to aid in cleaning the infection...

Known problems

Generic usage

Most task-view forms have got a pager.
By selecting a page, you acquire to fill its contents - pages are not filled until they are selected.

All task-view forms have got a command line. Only few commands are in a popup-menu (the non-parametric ones)...
Some commands are handled by the form, some are handled by the specific list...
To see, which commands are supported, type help command.

The commands may be abbreviated - a first command, that matches entered text, is executed. The order, in which the commands are checked, is listed by a help command...


Most task-view forms have got a list-view. You can select columns, which are displayed, by pressing Ctrl+F1. When you start task-view for a first time, only basic columns are shown, since gathering other columns may take more time or require more memory...
Select that set of information, that interests you...

Refresh

Each page has an auto-refresh flag, which is toggled from popup-menu or by autorefresh on command. Only few pages are auto-refreshing by default, as it is not always appropriate...
To refresh page contents manually, hit F5 key.
Some pages maintain list of added/removed items (in green/orange colors). By pressing F5, you clear this flag and free removed items immediatelly, else the removed are auto-freed after 8s, if auto-refreshing...

Keys & mouse

Wheel: Arrows: Searching: Filtering: Popup-menu: Keys: Keys on command-line:

TaskViewer

Main task-view form contains the following pages:

Process list

Process list displays list of processes, as acquired either by CreateToolhelp32Snapshot or NtQuerySystemInformation(5) if available. (If you are suspicious of hidden processes (rootkit etc..), issue command ntqsi 5 ab to see, if the system information is mangled or not...).
Columns:
Keys: Commands: In main-menu/options, there is Expert mode option. By selecting this mode, you can open any process regardless of its protection (requires SeDebugPrivilege).
Be careful what you do with it, since original protection of system processes prevents you from spoiling them...

Modules

List of all DLLs in all processes.
This page is usefull, if you need to terminate all processes, which has got BDE loaded (idapi32.dll), if BDE runs out of semaphores due to terminating a debuggee often,
and to see, if some DLL is mis-located (more entries for 1 DLL mean, that it is re-located in each process onto a different address and consumes more memory (like MSI.dll)...

Windous

List of windows on current desktop, showing class-types, captions and other informations...
By pressing Enter, child-window hierarchy is shown.
Commands and keys:

Services


List of installed services, as shown by EnumServicesStatus, QueryServiceConfig

Columns: Popup-menu:

Startup

Shows commands, executed during computer startup.
From "Source" column you may see, where is the command defined...
Please note, that autoexec.bat is not parsed here - these are windows commands only...

Inspecting this page is a first step of cleaning an infected computer...

Commands:

Extensions

Shows extensions, defined in registry for explorer, iexplore, codecs and context menus...
These places are often infected by mal-ware and can be cleaned here...

Commands are same as in Startup page...

HD parts

List of HD partitions.
Commands in popup-menu:

ObjDir

Shows object-directory hierarchy of Windows NT.
By selecting "Data" column and pressing "Ctrl+Shift+Enter", you may view objects in memory (requires Administrators membership)...
(That C+S+Enter key works in mem-view for every negative value and in handle-list...)
(Kernel addresses are available on builds 2195 (w2k) and 2600 (xp) only. Other platforms would require editing SysMetric.ini file)

Kernel

Shows listing of loaded kernel modules (as shown by PsApi.EnumDeviceDrivers).
Columns Manufacturer and CheckSum help to detect viruses and to compare two "identical" machines...
You may see modules in memory (Ctrl+Shift+Enter), if they are not swapped...

To detect a "hiding" module, issue ntqsi 11 ab command...

ObjTypes

Object-type statistics, as shown by "NtQueryObject" function.
No commands here...

Registry

A regedit...
This page is available as separate form by pressing Ctrl+Shift+R...

FileTypes

File types, as registered in HKEY_CLASSES_ROOT

Threads

List of all threads in processes, that could be opened (see "Expert mode" note above). By pressing "Enter" key, you can open a detail view (stack-view)...

Handles

List of all handles in processes.
Requires "Administrators" membership...

By selecting "Object" column and pressing Ctrl+Shift+Enter, you may view the kernel object for the handle in memory...

"State" column shows some state information (file position, mutant/event state, section size, token contents, socket ports etc...)


Various object-types have got "verbs" in popup-menu:

PNP

Shows PNP tree, as read from kernel memory (requires administrators membership).
Class, Description and ConfigFlags are read from registry...

Event Log

Shows EventLog events.

NetApi view


NetApi configures users, sessions and shares...

This window consists of following pages:

Process view


Process-view is opened as a detail from main process-list...

It constists of following pages:

Memory viewer/editor

This section is being prepared ...

Options

Block analyzer

Block analyzer detects:
   allocation boundaries
   grays out free blocks
   Shows class-names for Delphi objects

Editing

TaskView contains a transaction editor for 64-bit space editing...

If possible, by key F4 you start editing mode. (a block-caret is used instead of thin caret)...
You can edit in hex part of view (by entering 2 hex digits...), or in text part of view by typing text...
(Side is switched by Alt+Right, Alt+Left keys...)

Changes are cached in buffer.
If the space below your change is modified, that place will be shown in bold red...

To write the changes (commit transaction), use F2 key.
  Please note, that writing changes is still NOT atomic! (but still much better than writing each byte separatelly as you type...)

You may suspend/resume the process from ProcessView form (if not already stopped or stepped by your debugger), before writing changes to prevent a partial value being used by the target...

To Cancel changes (rollback transaction), use Esc key.



If MemView caption has (readonly) appended, the source was not opened with rights for writing (for ex. SECTION_MAP_READ).
Some data-sources support command acquirewrite to re-open in write-mode...



Alternativelly, you may select block, save it to disk file by command savemem . "FileName.dat", edit in you favourite hex-editor and load into target place by command loadmem . "FileName.dat". (For loadmem command, the selected block must be preciselly sized same as input file! Selected-Block-Size is shown in right/bottom statusbar...)

The loadmem command by-passes transaction editor and writes directly to target space, same as fill command!

File hex viewer/editor

To open File hex Editor: Otherwise same as memory editor...

By writing changes, LastModified date is NOT updated!
Do so manually in your commander, if desired...
(This is natural of memory-mapped files...)

Disk info viewer

(Opened from HD_Parts page in main task-view form...)

Run dialog


Run dialog is invoked by Ctrl+R key.
It is a wrapper for CreateProcess and CreateProcessAsUser commands...
It allows you to specify:
You may save the params - pressing button Save as prepares you a command to save the parameters - you need to fill the name:
save "MyParams 1"
Saved param-sets are found in combo-box for fast retrieval...

Sub-applications


TaskView consists of more applications, which are invoked by command-line parameters: