Posts by tag
sysinternal
หลายๆคนคงเคยใช้หนึ่งในชุดเครื่องมือ Sysinternal Tool เป็นแน่ โดย Sysinternal Tool เป็นชุดเครื่องมือที่ Microsoft สร้างขึ้นมาในจุดประสงค์ต่างๆมากมาย โดยตัวที่ได้รับความนิยมเช่น psexec, process Monitor เป็นต้น ทีนี้ผมไปเจอ post list เครื่องมือทั้งหมดว่าแต่ละตัวทำอะไรบ้างมา เลยเอามาโพสต์ไว้เผื่อใครสนใจครับ
Source:: Hacker-arise.com
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 |
AccessChk - Lets you see what type of access users and groups have to files, directories, registry keys, etc. AccessEnum - Full view of your file system and registry security settings. AdExplorer - Active Directory viewer and editor. AdInsight - LDAP real-time monitoring tool used to troubleshoot Active Directory applications. AdRestore - Ability to restore deleted Active Directory objects. Autologon - Easily configure autologon mechanism. Autoruns - Displays programs that are configured to run at startup. BgInfo - Displays relevant information about the computer on the desktop, such as computer name, IP address, etc. CacheSet - An applet to manipulate the working-set parameters of the system file cache. ClockRes - Shows the resolution of the system clock. Contig - Defragments a specified file or files. Coreinfo - Shows you the mapping between logical processors and the physical processor. Ctrl2Cap - Kernel-mode device driver that filters the system's keyboard class driver. DebugView - Monitors debug output on your local system. Desktops - Allows you to organize up to four virtual desktops. Disk2vhd - Creates VHD (virtual hard disk) versions of physical disks. DiskExt - Returns information about what disks the partition of a volume is located on. DiskMon - Logs and displays all hard disk activity. DiskView - A graphical map of your hard drive. DiskUsage (DU) - Reports the disk space usage for a specified directory. EFSDump - Allows you to see who has access to encrypted files. FindLinks - Reports the file index and hard links that exist for a specified file. Handle - Displays information about open handles for any process. Hex2dec - Converts hex to decimal and vice versa. Junction - Creates junctions (symbolic links that combine directories from multiple locations). LDMDump - Let's you examine exactly what is stored in a disks copy of the system. ListDLLs - Reports the DLLs that are loaded into processes. LiveKd - Allows you to run the Kd and Windbg kernel debuggers. LoadOrder - Shows the order in which the system loads device drivers. LogonSessions - Lists currently active logon sessions. MoveFile - Dumps the content of the pending rename/delete value. NTFSInfo - Shows you information about NTFS volumes. PageDefrag - Shows you have fragmented your paging files and registry hives are. PendMoves - Dumps the content of the pending rename/delete value. PipeList - Lists the pipes. PortMon - Monitors and displays all serial and parallel port activity. ProcDump - Monitors CPU spikes. Process Explorer - Shows information about which handles and DLL processes are loaded. Process Monitor - Shows real-time file system, registry, and process/thread activity. PsExec - Allows you to execute processes on remote systems. PsGetSid - Allows you to translate SIDs to their display name and vice versa. PsInfo - Gathers key information about the local or remote system including kernel build and the amount of memory. PsPing - Implements ping functionality. PsKill - Can kill processes on local and remote systems. PsList - Displays information about processes, memory, and threads. PsLoggedOn - This shows who is using what resources on a local or remote machine. PsLogList - Allows you to login to remote systems in situations where security credentials do not permit it. PsPasswd - Allows you to change an account password on local or remote systems. PsService - A service viewer and controller for Windows. PsShutdown - Allows you to logoff the console user or lock the console among other things. PsSuspend - Allows you to suspend processes on the local or a remote system. RAMMap - A physical memory usage analysis tool to see how Windows is assigning physical memory. RegDelNull - Allows you to search for and delete registry keys. Registry Usage (RU) - Reports the registry space usage. RegJump - Opens Regedit directly to a specified registry path. RootkitRevealer - Detects rootkits. SDelete - Allows you to delete one or more files/directories or to cleanse the free space on a drive. ShareEnum - Allows you to lock down file shares. ShellRunas - Allows you to launch programs under different accounts. SigCheck - Shows file version number, timestamp, and digital signature details. Streams - Allows you to see which NTFS files have alternate streams associated with them. Strings - Searches files for a specified string. Sync - Allows you to flush all file system data to disk. TCPView - Shows detailed listings of all TCP and UDP endpoints on your system. VMMap - A process virtual and physical memory analysis tool. VolumeID - Allows you to change the IDs of FAT and NTFS disks. WhoIs - Performs a registration record for the specified domain name or IP address. WinObj - Displays information of the NT Object Manager's name space. ZoomIt - A screen zoom and annotation tool for technical presentations. As you can see from this list, there are some very powerful tools in this suite. Let's examine one of the most useful tools in this toolkit, Process Explorer. |
LINE@Techsuii.com
Recent Comments