hfiref0x/WinObjEx64

Free

Windows Object Explorer 64-bit

FreeFree tier

Type

Open Source

Visit Website GitHub (38 stars)

About hfiref0x/WinObjEx64

WinObjEx64 is an advanced utility that lets you explore the Windows Object Manager namespace in 64-bit Windows environments. It provides detailed information about objects, including descriptions, attributes, resource usage, and security settings. Users can view hierarchical object trees, resolve symbolic links, edit object-related security information, and detect driver IRP modifications or kernel object hooking via structure dumps. Additional features include a system information viewer, loaded drivers list, mailslots/named pipes viewer, process tree viewer with token details, Software Licensing Cache viewer, User Shared Data viewer, and system callbacks viewer. It is designed for security researchers, system administrators, and developers working with Windows internals. WinObjEx64 is free, open-source software hosted on GitHub.

Key Features

View and browse the entire Windows Object Manager namespace with a hierarchical tree

Resolve symbolic links and view object details (descriptions, flags, attributes, memory pool type)

Edit object-related security information (requires administrative privileges)

Detect driver object IRP modifications and kernel object hooking via structure dumps

Search for objects by name and/or type

System information viewer (boot state, code integrity, mitigations, OS version/build)

Loaded drivers list viewer with dump and CSV export options

Mailslots and named pipes viewer with security edit capability for pipes

Hierarchical process tree viewer (PID, user name, EPROCESS addresses, thread list, ETHREAD addresses)

View process/thread token information (user SID, integrity level, privileges, groups) and security attributes

Pros & Cons

Pros

Comprehensive exploration of Windows Object Manager namespace
Detailed object information including security attributes and handles
Advanced security editing capabilities for objects
Detects driver IRP modifications and kernel hooking
Includes process tree viewer with full token details
Free and open-source software
Works on multiple x64 Windows versions from 7 to 11

Cons

Only supports 64-bit Windows (x64) systems
Administrative privileges required for full namespace view and security editing
Steep learning curve for users unfamiliar with Windows internals
Not updated frequently on GitHub (last commit may be old)

Best For

Windows kernel and object manager researchSecurity auditing and vulnerability analysisReverse engineering of system internalsDriver development and debuggingForensic analysis of Windows systemsSystem administration and troubleshooting

FAQ

Does WinObjEx64 require administrative privileges?

No, WinObjEx64 does not require administrative privileges. However, administrative privileges are required to view much of the namespace and to edit object-related security information.

Which Windows versions are supported?

WinObjEx64 works only on x64 Windows: Windows 7, Windows 8, Windows 8.1, and Windows 10/11, including Server variants.

What kind of object information can I view?

You can view descriptions, flags, invalid attributes, memory pool type, object type-specific information, object-related structure memory dumps for many object types (e.g., ALPC_PORT, DEVICE_OBJECT, DRIVER_OBJECT, KEVENT, etc.), and display sub-structures like DEVICE_MAP, LDR_DATA_TABLE_ENTRY, and more.