Skip to content

feat: show related processes, essentially deduplicating processes like witr but being more helpful #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
supervoidcoder wants to merge 15 commits into
base: main
Choose a base branch
from
Open

feat: show related processes, essentially deduplicating processes like witr but being more helpful #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
0ef5a4b
feat: show related processes, essentially deduplicating processes lik…
supervoidcoder Feb 10, 2026
4dbc96a
Merge branch 'main' into name-check-improvements
supervoidcoder Feb 10, 2026
5b3e47b
Update process.ps1
supervoidcoder Feb 10, 2026
147bb68
Update process.ps1
supervoidcoder Feb 10, 2026
6e7728e
Update process.ps1
supervoidcoder Feb 10, 2026
1894fed
perf: make related procnames use stored vector of names rather than c…
supervoidcoder Feb 11, 2026
b9e6b64
fix: syntax error and terrible syntax
supervoidcoder Feb 11, 2026
cea6b6b
fix: missing semicolon
supervoidcoder Feb 11, 2026
a435b95
fix: another missing semicolon
supervoidcoder Feb 11, 2026
cbafa76
fix: add missing initializing argument
supervoidcoder Feb 11, 2026
1242a6d
fix: fix type error and fix semicolon accidentally typed as colon
supervoidcoder Feb 11, 2026
10f4359
fix: type error
supervoidcoder Feb 11, 2026
c37dd60
fix: Fix process name storage conversion issue
supervoidcoder Feb 11, 2026
17cc779
Merge branch 'main' into name-check-improvements
supervoidcoder Feb 11, 2026
aa03023
refactor: names is passed by value — prefer const std::vector<std::st…
supervoidcoder Feb 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 48 additions & 13 deletions main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1727,7 +1727,8 @@ void FindProcessPorts(DWORD targetPid) {



void PIDinspect(DWORD pid) { // ooh guys look i'm in the void
void PIDinspect(const std::vector<DWORD>& pids, const std::vector<std::string>& names) { // ooh guys look i'm in the void
DWORD pid = pids[0];
std::string procName = GetProcessNameFromPid(pid);
if (IsVirtualTerminalModeEnabled()) {
if (procName == ""){
Expand Down Expand Up @@ -1937,6 +1938,24 @@ std::string FRAM = ""; // fram means formatted ram, i'm so creative at var namin
} else {
std::cout << "\nStarted: " << GetReadableFileTime(pid) << std::endl;
}

if (pids.size() > 1) {
if (IsVirtualTerminalModeEnabled()) {
std::cout << "\033[1;35mRelated Processes:\033[0m\n";
} else {
std::cout << "Related Processes:\n";
}

for (size_t i = 1; i < pids.size(); i++) {
std::string relatedProcName = names[i];
if (IsVirtualTerminalModeEnabled()) {
std::cout << "\t\033[36m" << relatedProcName << "\033[90m (PID " << pids[i] << ")\033[0m\n";
} else {
std::cout << "\t" << relatedProcName << " (PID " << pids[i] << ")\n";
}

}
}
/*
TODO:
This definitely needs a lot more details to be complete like witr. Unfortunately, windows needs even more shenanigans and a whole
Expand All @@ -1962,18 +1981,25 @@ std::string FRAM = ""; // fram means formatted ram, i'm so creative at var namin
*/

CloseHandle(hProcess);

}

int findMyProc(const char *procname) {
struct ProcInfos {
std::vector<std::string> names;
std::vector<int> pids;
};

ProcInfos findMyProc(const char *procname) {

HANDLE hSnapshot;
PROCESSENTRY32 pe;
int pid = 0;
ProcInfos result;
BOOL hResult;


// snapshot of all processes in the system
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (INVALID_HANDLE_VALUE == hSnapshot) return 0;
if (INVALID_HANDLE_VALUE == hSnapshot) return {};

// initializing size: needed for using Process32First
pe.dwSize = sizeof(PROCESSENTRY32);
Expand All @@ -1986,15 +2012,20 @@ int findMyProc(const char *procname) {
while (hResult) {
// if we find the process: return process ID
if (strcmp(procname, WideToString(pe.szExeFile).c_str()) == 0) {
pid = pe.th32ProcessID;
break;
result.names.push_back(WideToString(pe.szExeFile)); // let me cook
// while you might think its less performant to waste all this
// on storing related names for no reason
// its crucial for the related processes since
// otherwise we'd have to call the get process name for every related process
// and slow us down significantly so storing it on the fly is better
result.pids.push_back(pe.th32ProcessID);
}
hResult = Process32Next(hSnapshot, &pe);
}

// closes an open handle (CreateToolhelp32Snapshot)
CloseHandle(hSnapshot);
return pid;
return result;
}
// The above function is taken from https://cocomelonc.github.io/pentest/2021/09/29/findmyprocess.html , modified simply to use WideToString for the process name comparison among other things.
// Thanks!
Expand Down Expand Up @@ -2092,8 +2123,12 @@ int main(int argc, char* argv[]) {
}



PIDinspect(static_cast<DWORD>(pid));
std::vector<DWORD> pids;
std::vector<std::string> trash;
trash.push_back("");
pids.push_back(static_cast<DWORD>(pid));// function requires it to be a list even if only 1 is passed

PIDinspect(pids, trash);
} else {
if (IsVirtualTerminalModeEnabled()) { // ugh i have to do this EVERY SINGLE TIME
std::cerr << "\033[1;31mError:\033[0m --pid option requires an argument." << std::endl;
Expand All @@ -2111,10 +2146,10 @@ int main(int argc, char* argv[]) {
// check for process name if no recognized flags
else if (arg[0] != '-') { // if it doesn't start with -- or -
std::string procName = arg;
int pid = findMyProc(procName.c_str());
if (pid != 0) {

PIDinspect(static_cast<DWORD>(pid));
ProcInfos r = findMyProc(procName.c_str());
if (!r.pids.empty()) {
std::vector<DWORD> dwPids(r.pids.begin(), r.pids.end());
PIDinspect(dwPids, r.names);
} else {
if (IsVirtualTerminalModeEnabled()) {
std::cerr << "\033[1;31mError:\033[0m Could not find process with name " << procName << "." << std::endl;
Expand Down
114 changes: 69 additions & 45 deletions tests/process/process.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,47 +1,71 @@
REM Test system processes that should always be running
Measure-Command { win-witr winlogon.exe | Out-Default}
Measure-Command { win-witr lsass.exe | Out-Default}
Measure-Command { win-witr win-witr.exe | Out-Default}
Measure-Command { win-witr wininit.exe | Out-Default}
Measure-Command { win-witr explorer.exe | Out-Default}
Measure-Command { win-witr Registry| Out-Default}
Measure-Command { win-witr csrss.exe| Out-Default}
Measure-Command { win-witr fontdrvhost.exe | Out-Default}
Measure-Command { win-witr svchost.exe | Out-Default}
Measure-Command { win-witr smss.exe | Out-Default}
Measure-Command { win-witr services.exe | Out-Default}
Measure-Command { win-witr powershell.exe | Out-Default }
Measure-Command { win-witr Runner.Listener.exe | Out-Default}
Measure-Command { win-witr cmd.exe | Out-Default}
Measure-Command { win-witr pwsh.exe | Out-Default}
Measure-Command { win-witr Runner.Worker.exe | Out-Default}
Measure-Command { win-witr hosted-compute-agent | Out-Default}
Measure-Command { win-witr conhost.exe | Out-Default}
Measure-Command { win-witr dwm.exe | Out-Default}
Measure-Command { win-witr RuntimeBroker.exe | Out-Default}
Measure-Command { win-witr SearchIndexer.exe | Out-Default}
Measure-Command { win-witr spoolsv.exe | Out-Default}
Measure-Command { win-witr taskhostw.exe | Out-Default}
Measure-Command { win-witr dllhost.exe | Out-Default}

start /B notepad.exe
timeout /t 1 /nobreak >nul
Measure-Command { win-witr notepad.exe | Out-Default}
taskkill /F /IM notepad.exe >nul 2>&1

REM Start calc and test it, then close
start /B calc.exe
timeout /t 1 /nobreak >nul
Measure-Command { win-witr calc.exe | Out-Default}
taskkill /F /IM calc.exe >nul 2>&1

REM Start mspaint and test it, then close
start /B mspaint.exe
timeout /t 1 /nobreak >nul
Measure-Command { win-witr mspaint.exe | Out-Default}
taskkill /F /IM mspaint.exe >nul 2>&1


Measure-Command { win-witr powershell.exe | Out-Default}
$time = Measure-Command { win-witr winlogon.exe | Out-Default }
"winlogon.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr lsass.exe | Out-Default }
"lsass.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr win-witr.exe | Out-Default }
"win-witr.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr wininit.exe | Out-Default }
"wininit.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr explorer.exe | Out-Default }
"explorer.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr Registry | Out-Default }
"Registry check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr csrss.exe | Out-Default }
"csrss.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr fontdrvhost.exe | Out-Default }
"fontdrvhost.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr svchost.exe | Out-Default }
"svchost.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr smss.exe | Out-Default }
"smss.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr services.exe | Out-Default }
"services.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr powershell.exe | Out-Default }
"powershell.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr Runner.Listener.exe | Out-Default }
"Runner.Listener.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr cmd.exe | Out-Default }
"cmd.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr pwsh.exe | Out-Default }
"pwsh.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr Runner.Worker.exe | Out-Default }
"Runner.Worker.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr hosted-compute-agent | Out-Default }
"hosted-compute-agent check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr conhost.exe | Out-Default }
"conhost.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr dwm.exe | Out-Default }
"dwm.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr RuntimeBroker.exe | Out-Default }
"RuntimeBroker.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr SearchIndexer.exe | Out-Default }
"SearchIndexer.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr spoolsv.exe | Out-Default }
"spoolsv.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr taskhostw.exe | Out-Default }
"taskhostw.exe check took {0} ms" -f $time.TotalMilliseconds

$time = Measure-Command { win-witr dllhost.exe | Out-Default }
"dllhost.exe check took {0} ms" -f $time.TotalMilliseconds