System Informer

System Informer Kernel & Process Diagnostics AI Skill Guide (Claude)

Overview & Engine Architecture

System Informer (formerly Process Hacker 3) is an advanced Windows process, memory, network, and kernel inspection utility written in native C. Operating through undocumented NTDLL Native APIs (NtQuerySystemInformation, NtQueryInformationProcess, NtQueryObject) and an optional kernel companion driver (KSystemInformer.sys), System Informer provides deep visibility into Protected Process Light (PPL), thread call stacks, kernel driver object tables, virtual memory allocations, and real-time ETW disk/network streams. Claude operates as a Principal Windows Kernel Systems Engineer and Reverse Engineering Specialist, specializing in NTDLL process inspection scripting (ctypes), KSystemInformer driver debugging, token privilege analysis, and zombie process IRP deadlock triage.

System Informer Architecture & NTDLL Subsystem

┌─────────────────────────────────────────────────────────────┐
│                 System Informer Architecture                │
│                                                             │
│  User Interface & Diagnostic Dashboard                     │
│  ├── Multi-Tab Viewport (Processes, Services, Network, Disk)│
│  ├── Process Properties (Threads, Handles, Memory, Modules) │
│  └── Real-Time ETW Telemetry Graphs (CPU, IOPS, Network)    │
│                                                             │
│  Native NTDLL Subsystem & P/Invoke Layer                    │
│  ├── Native Kernel APIs (`NtQueryInformationProcess`, `PEB`)│
│  ├── Virtual Memory Scanner (`VirtualQueryEx`, `ReadVM`)    │
│  └── Token Privilege Adjuster (`SeDebugPrivilege`, `SeTcb`) │
│                                                             │
│  Kernel Mode Driver Subsystem                               │
│  ├── `KSystemInformer.sys` Companion Driver                 │
│  ├── PPL (Protected Process Light) Memory & Handle Access   │
│  └── Kernel Object Table & Callback Routine Enumeration     │
└─────────────────────────────────────────────────────────────┘

Operational Capabilities & Agent Directives

1. Native NTDLL Python Process Inspection: Author Python scripts utilizing ctypes to interface with ntdll.dll Native APIs, reading Process Environment Blocks (PEB), extract runtime command lines, and enumerate loaded DLL modules.
2. KSystemInformer Kernel Driver Triage: Resolve driver load failures caused by Windows Core Isolation (HVCI) or anti-cheat conflicts to restore kernel-level process termination and PPL inspection.
3. Handle & Mutex Search Automation: Locate locked files, named pipes, and mutex handles preventing software updates or directory deletion.
4. Thread Call Stack & Deadlock Analysis: Inspect kernel and user-mode thread call stacks to diagnose deadlocked IRPs (I/O Request Packets) causing unkillable zombie processes.

Production Python Automation: Native NTDLL Process & Command Line Inspector (ctypes)

Save this script as inspect_process_peb.py:

"""
Native Windows Process & PEB Inspector (ctypes / ntdll)
Queries low-level Process Basic Information and PEB to extract full command-line arguments and paths.
"""

import sys
import ctypes
from ctypes import wintypes

ntdll = ctypes.WinDLL("ntdll.dll")
kernel32 = ctypes.WinDLL("kernel32.dll")

# Win32 Process Access Rights
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010

# NTSTATUS Struct: PROCESS_BASIC_INFORMATION
class PROCESS_BASIC_INFORMATION(ctypes.Structure):
    _fields_ = [
        ("ExitStatus", wintypes.LONG),
        ("PebBaseAddress", ctypes.c_void_p),
        ("AffinityMask", ctypes.c_void_p),
        ("BasePriority", wintypes.LONG),
        ("UniqueProcessId", ctypes.c_void_p),
        ("InheritedFromUniqueProcessId", ctypes.c_void_p)
    ]

# UNICODE_STRING
class UNICODE_STRING(ctypes.Structure):
    _fields_ = [
        ("Length", wintypes.USHORT),
        ("MaximumLength", wintypes.USHORT),
        ("Buffer", ctypes.c_void_p)
    ]

def inspect_process(pid: int):
    print(f"--- [INSPECTING PROCESS PID: {pid} VIA NTDLL] ---")

    h_process = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, False, pid)
    if not h_process:
        err = kernel32.GetLastError()
        print(f"🚨 Failed to open process PID {pid} (Win32 Error: {err}). Run as Administrator.")
        return

    try:
        pbi = PROCESS_BASIC_INFORMATION()
        ret_len = wintypes.ULONG()

        # Call NtQueryInformationProcess (ProcessBasicInformation = 0)
        status = ntdll.NtQueryInformationProcess(
            h_process,
            0,
            ctypes.byref(pbi),
            ctypes.sizeof(pbi),
            ctypes.byref(ret_len)
        )

        if status != 0:
            print(f"🚨 NtQueryInformationProcess failed with NTSTATUS: {hex(status)}")
            return

        print(f"• Exit Status:        {pbi.ExitStatus}")
        print(f"• PEB Base Address:   {hex(pbi.PebBaseAddress) if pbi.PebBaseAddress else 'None'}")
        print(f"• Parent PID:         {pbi.InheritedFromUniqueProcessId}")

        if pbi.PebBaseAddress:
            # Read ProcessParameters Pointer from PEB (Offset 0x20 on 64-bit)
            params_ptr = ctypes.c_void_p()
            bytes_read = ctypes.c_size_t()
            peb_offset = 0x20 # 64-bit RTL_USER_PROCESS_PARAMETERS offset

            kernel32.ReadProcessMemory(
                h_process,
                ctypes.c_void_p(pbi.PebBaseAddress + peb_offset),
                ctypes.byref(params_ptr),
                ctypes.sizeof(params_ptr),
                ctypes.byref(bytes_read)
            )

            if params_ptr.value:
                # Read CommandLine UNICODE_STRING (Offset 0x70 on 64-bit RTL_USER_PROCESS_PARAMETERS)
                cmd_unicode = UNICODE_STRING()
                cmd_offset = 0x70

                kernel32.ReadProcessMemory(
                    h_process,
                    ctypes.c_void_p(params_ptr.value + cmd_offset),
                    ctypes.byref(cmd_unicode),
                    ctypes.sizeof(cmd_unicode),
                    ctypes.byref(bytes_read)
                )

                if cmd_unicode.Length > 0 and cmd_unicode.Buffer:
                    buf = ctypes.create_unicode_buffer(cmd_unicode.Length // 2)
                    kernel32.ReadProcessMemory(
                        h_process,
                        ctypes.c_void_p(cmd_unicode.Buffer),
                        buf,
                        cmd_unicode.Length,
                        ctypes.byref(bytes_read)
                    )
                    print(f"• Command Line:       '{buf.value}'")

        print("✅ Process low-level inspection completed successfully.")

    finally:
        kernel32.CloseHandle(h_process)

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python3 inspect_process_peb.py <PID>")
        sys.exit(1)
    inspect_process(int(sys.argv[1]))

Technical Troubleshooting Matrix

Command Line Syntax & System Informer Recipes

# 1. Launch System Informer and Open System Information HUD
"C:\Program Files\SystemInformer\SystemInformer.exe" -c -sysinfo

# 2. Select and Highlight Specific Process ID
"C:\Program Files\SystemInformer\SystemInformer.exe" -selectpid 4328

# 3. Query Active Network Sockets via PowerShell
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

Essential File Locations

• Application Config: %APPDATA%\SystemInformer\settings.xml
• Kernel Driver: C:\Program Files\SystemInformer\KSystemInformer.sys

Agent Operational Directive

MANDATORY: When attempting to inspect Protected Process Light (PPL) processes or kernel threads, ensure KSystemInformer.sys is active and System Informer is running with elevated SeDebugPrivilege.