WinObjEx64 is an advanced utility that lets you explore the Windows Object Manager namespace. For certain object types, you can double-click on it or use the "Properties..." toolbar button to get more information, such as description, attributes, resource usage etc. WinObjEx64 let you view and edit object-related security information if you have required access rights.
# System Requirements
WinObjEx64 does not require administrative privileges. However administrative privilege is required to view much of the namespace and to edit object-related security information.
- Most of list/trees allows to copy object address and/or name to the clipboard
- Running on Wine/Wine-Staging is supported<sup>3</sup>
- Plugins subsystem for extending basic features
- Available plugins that shipped with WinObjEx64 release:
- ApiSetView - viewer for Windows ApiSetSchema internals, support loading ApiSet schema from file
- Example plugin - example plugin for developers
- Sonar - NDIS protocols viewer, display registered NDIS protocols and dumps some information about them
- ImageScope - context plugin allowing to view more details in WinObjEx64 for Section type objects that are backed by image file (available through popup menu on object of Section type in WinObjEx64 main list)
- Documentation
- Windows Callbacks
- Plugins subsystem
1. This feature require driver support enabled, see "Driver support" part below.
2. This may require administrator privileges.
3. Most of additional Windows internals-specific features however will be unavailable due to obvious reasons.
4. Some named pipes may require administrator privileges to access.
### Driver support
WinObjEx64 supports two types of driver helpers:
1. Helper for read-only access to the kernel memory. Default version uses Kernel Local Debugging Driver (KLDBGDRV) from WinDbg. In order to use it (and thus enable all the above features) Windows must be booted in the debug mode (bcdedit -debug on) and WinObjEx64 must be run with administrator privileges. If you are using WinObjEx64 version with custom helper driver - Windows debug mode is not required. There are exist several drivers that can be used as helpers for WinObjEx64, by default it has only WinDbg type built-in.
2. Helper to access object handles. WinObjEx64 (any variant) support Process Explorer driver of version 1.5.2 to open process/threads. To enable this just load Process Explorer with administrator privileges simultaneously with WinObjEx64.
All driver helpers require WinObjEx64 to be run with administrative privileges.
