-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
18 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,11 +1,29 @@ | ||
# PTEViewer | ||
A lightweight tool for visualising paging tables on Windows 10/11 x64, featuring an intuitive ImGui interface. | ||
<br><br> | ||
This project is not finished, and there are lots of issues in the code. However, I feel people may find it useful, so I am releasing it. This project will be maintained and updated with bug-fixes, new features and more architecture compatibility in the future. | ||
|
||
### Features | ||
1. **Process List:** Find and select a target process, with the ability to sort and search by name, PID and CR3. | ||
2. **Paging Table Viewer:** Inspect PML4E, PDPTE, PDE and PTE entries, displaying hardware and software information such as physical address, write protection, supervisor bit, CoW, etc. | ||
3. **Make Memory Resident:** Move memory pages into physical memory by right clicking on a paging entry. | ||
|
||
### How To Use | ||
To use PTEViewer fully, you need to load it's driver and then run the GUI. To load the driver you will either have to enable test signing, disable DSE (Driver Signature Enforcement) or sign the driver yourself. I have left a test signed version in the compiled binaries. | ||
<br><br> | ||
Now you have a loadable version of the driver, you can load it easily with the SCM command-line. Run these commands in an administrator instance of CMD to load the driver. | ||
<br><br> | ||
To load the driver, you can do the following. (Replace FILEPATH with your file path.) | ||
``` | ||
sc create pteviewer binPath=FILEPATH start=demand type=kernel | ||
sc start pteviewer | ||
``` | ||
To unload the driver, you can do the following. | ||
``` | ||
sc stop pteviewer | ||
sc delete pteviewer | ||
``` | ||
|
||
### Screenshots | ||
![Process List](Images/ProcessList.png) | ||
![Paging Tables](Images/PageTables.png) |