$ show hfiref0x/WinObjEx64
WinObjEx64 is a native Windows GUI application that provides deep introspection into the Windows Object Manager namespace and kernel internals. It allows users to browse, view properties, and edit security descriptors for a wide range of NT object types (processes, threads, tokens, sections, ALPC ports, drivers, etc.). The tool also includes 'Extras' dialogs for inspecting system call tables (SSDT), kernel callbacks, unloaded drivers, private namespaces, and more. It relies on a kernel driver (or alternative providers) for reading kernel memory and supports a plugin system for extensibility. Architecturally, the application is a monolith with a plugin subsystem. It uses a custom tree-list control, a lightweight runtime library (minirtl), and a driver provider abstraction layer that supports multiple backends (Microsoft's kldbgdrv, WinIO, custom driver). The codebase is heavily version-aware, with many structures and patterns hardcoded per Windows build (from 7 to 11 25H2). The plugin ABI is well-defined and versioned, allowing third-party plugins to integrate seamlessly. The repository is actively maintained, with recent commits and zero open issues. However, it exhibits medium technical drift due to reliance on undocumented kernel structures, hardcoded byte patterns, and some deprecated Win32 APIs. The code is of high craftsmanship for its niche, with several reusable components that could be extracted for other Windows internals projects.
The LLM identified 4 files worth highlighting for reuse:
A self-contained, portable C library providing string manipulation (strlen, strcpy, strcmp, etc.) and number-to-string/hex conversion functions (ultostr, hextoul, i64tostr). It avoids CRT dependencies and is used throughout the project. This module can be extracted and reused in any C/C++ project that needs minimal runtime support, especially in kernel-mode or embedded contexts.
A custom Win32 tree-list control that combines a tree view with a list view header and subitem support. It handles custom drawing, tooltips, and keyboard navigation. This control is reusable in any Win32 GUI application that needs a hierarchical list with multiple columns, and it demonstrates advanced window subclassing and owner-draw techniques.
Defines the plugin ABI for WinObjEx64, including the WINOBJEX_PLUGIN structure with versioning, capabilities, and lifecycle callbacks (PluginInit, StartPlugin, StopPlugin). This header is a clean example of a versioned plugin interface that can be adopted by other applications requiring a stable, documented plugin system.
Implements an abstract driver provider layer that supports multiple kernel memory access backends (kldbgdrv, WinIO, custom driver). It defines a provider struct with function pointers for start, stop, open, close, and read operations. This pattern allows the application to switch between drivers without changing higher-level code, and can be reused in any tool that needs to read kernel memory on Windows.