systeminformer VS bcc

System Informer is a versatile system management tool designed to seamlessly monitor and analyze system resources, troubleshoot software issues, and identify potential malware threats. Offers system activity overviews, intuitive graphs, real-time statistics, active network connection monitoring, detailed disk access information, intricate stack trace analysis, and much more. evily2k describes it "like process explorer on steroids. Allows me to kill process that task manager would say access denied."

(VAC use to prevent you from playing with the below method, however it has since been removed from the support, but you should still use -insecure for the below method) You can also try using process hacker/system informer (github link) it's similar to task manager however right click on csgo.exe click properties and click on the the windows tab. From there you can view which library or process created a window.

This is not a false positive, there are security exploits in Process Hacker that are exploited by some cheats. I would suggest upgrading to the new version which is now called System Informer, where these issues are fixed. https://github.com/winsiderss/systeminformer

I've had it for well over a year and haven't noticed any ill effects. I find it handy for reporting when something has been added to startup or context menu etc, but I've never ran it "full time" as a task manager replacement. (Though for that purpose, I recently came across an app called System Informer that I like - https://systeminformer.sourceforge.io/)

Install system informer: https://systeminformer.sourceforge.io/

System Informer (formerly Process Hacker) might also have what you're looking for

https://systeminformer.sourceforge.io/

But wait, there's more! Enter the BCC toolkit and library, your trusty sidekick in simplifying the arcane art of writing eBPF applications. With BCC by your side, you'll be wielding eBPF like a seasoned pro in no time.

Nice - I normally use [bash-readline](https://github.com/iovisor/bcc/blob/master/tools/bashreadlin...) when coworking/co-inhabiting a server or training someone.

One of the big wins is not so much “build and run your own stuff” but there are very nice low-cost (in terms of compute) performance utilities built on eBPF

https://github.com/iovisor/bcc

There are so many utilities in that list; there’s a diagram midway down the readme which tries to help show their uses. bcc-tools should be available in any distro.

Also, Brendan Gregg does a ton of performance stuff that is worth knowing about if you check out his other work. Not eBPF only. Flame graphs are useful.

Reference: https://github.com/iovisor/bcc/blob/master/libbpf-tools/memleak.c

In this article, we'll build a basic version of an HTTPS sniffer, inspired by bcc-sslsniff.py, but we'll use Rust and Aya. We're going to demonstrate the capabilities of uprobes by employing uprobe and uretprobe along with familiar maps like PerCpuArray, HashMap, and PerEventArray. This will be a straightforward example to help us explore how uprobes function.

As xpd program I am using the BCC example xdp_redirect_map.py in skb mode as my NIC does not support native mode, attaching the program to veth2 and a dummy function to veth3

https://github.com/iovisor/bcc/blob/master/docs/reference_gu...