{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/winsiderss/systeminformer/blob/999fe5ef6a554f55d8e7df43903eb31ca530377e/KSystemInformer/README.md",
    "https://github.com/winsiderss/systeminformer/blob/999fe5ef6a554f55d8e7df43903eb31ca530377e/CHANGELOG.txt",
    "https://github.com/winsiderss/systeminformer/blob/999fe5ef6a554f55d8e7df43903eb31ca530377e/plugins/AgentTools/main.c#L58-L75",
    "https://github.com/winsiderss/systeminformer/blob/999fe5ef6a554f55d8e7df43903eb31ca530377e/plugins/AgentTools/options.c#L1044-L1060",
    "https://github.com/winsiderss/systeminformer/blob/999fe5ef6a554f55d8e7df43903eb31ca530377e/LICENSE.txt",
    "https://github.com/winsiderss/systeminformer/releases/tag/v4.0.26241.138",
    "https://systeminformer.com/"
  ],
  "category": "dynamic-analysis",
  "description_en": "Windows process viewer and system inspector, formerly Process Hacker, for examining running programs and the system around them. It gives a highlighted overview of system activity, searches the handles and loaded DLLs of processes to find which one is using a file, shows active network connections and real-time disk access, displays stack traces with kernel-mode, WOW64 and .NET support, and creates, edits and controls services. Version 4.0 adds a Process Monitor that logs process, thread, image, registry, file, handle and silo events from its kernel driver, and plugins add .NET assembly and performance tabs, a window explorer and Hybrid Analysis lookups.",
  "description_zh": "Windows 进程查看与系统检查工具，前身为 Process Hacker，用于检查运行中的程序及其所在的系统环境。它以高亮方式概览系统活动，可在各进程的句柄和已加载 DLL 中搜索，找出正在占用某个文件的进程，显示活动网络连接和实时磁盘访问，查看支持内核模式、WOW64 和 .NET 的详细调用栈，并能创建、编辑和控制服务。4.0 版新增 Process Monitor，借助内核驱动实时记录进程、线程、映像、注册表、文件、句柄和 silo 事件；插件还提供 .NET 程序集与性能页、窗口浏览器和 Hybrid Analysis 在线查询。",
  "entry_url": "https://awesomerea.org/resources/system-informer/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/system-informer/",
  "evidence_url": "https://github.com/winsiderss/systeminformer/blob/999fe5ef6a554f55d8e7df43903eb31ca530377e/README.md",
  "group": "tools",
  "id": "system-informer",
  "json_url": "https://awesomerea.org/resources/system-informer/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/system-informer/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/system-informer/index.md",
  "name": "System Informer",
  "name_zh": "System Informer 进程与系统检查工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "limits",
    "scope",
    "license"
  ],
  "requirements": [
    "Windows 10 or later, 32-bit or 64-bit, per the README. Release at review: v4.0.26241.138, published 2026-08-29 as the first 4.0 release; the reviewed master commit is 874 commits ahead of it. Building from source needs Visual Studio 2022 or later and the build_init.cmd and build_release.cmd scripts in build/.",
    "The KSystemInformer kernel driver gives its broader inspection only to verified callers: binaries loaded into System Informer need a .sig from the build's key pair or a Microsoft or anti-malware vendor signature, and loading an unsigned third-party plugin restricts driver access. Builds signed with a developer's own key need debug and test-signing mode, with Secure Boot disabled where applicable.",
    "The Agent Tools plugin is on the master branch only, not in the 4.0 release; its source describes it as exposing System Informer's process data and actions to AI agents over the Model Context Protocol. It is off by default, asks to confirm connections by default and offers stdio setup commands for clients such as Claude Code and Codex CLI. The OnlineChecks plugin's Hybrid Analysis lookups are opt-in with per-service API keys and can optionally submit unknown files.",
    "MIT per LICENSE.txt and the README."
  ],
  "requirements_zh": [
    "据 README，需要 Windows 10 或更高版本（32 位或 64 位）。审阅时的版本为 v4.0.26241.138，于 2026-08-29 发布，是 4.0 系列的首个版本；所审阅的 master 分支提交比它多 874 个提交。从源码构建需要 Visual Studio 2022 或更高版本，并使用 build 目录中的 build_init.cmd 和 build_release.cmd 脚本。",
    "KSystemInformer 内核驱动只向经过验证的调用方开放更深入的检查能力：加载到 System Informer 中的二进制文件须带有由构建密钥对生成的 .sig 文件，或具备 Microsoft 或反恶意软件厂商的签名；加载未签名的第三方插件会限制对驱动的访问。使用开发者自有密钥签名的构建需要开启调试和测试签名模式，必要时还须关闭安全启动。",
    "Agent Tools 插件只存在于 master 分支，不在 4.0 版本中；其源码说明它通过 Model Context Protocol 向 AI 智能体提供 System Informer 的进程数据和操作。该插件默认关闭，默认需要确认连接，并为 Claude Code、Codex CLI 等客户端提供 stdio 配置命令。OnlineChecks 插件的 Hybrid Analysis 查询须手动开启并按服务配置 API 密钥，还可选择提交未知文件。",
    "依 LICENSE.txt 与 README 采用 MIT 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/winsiderss/systeminformer",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}