XNTSV

When you access a file, a lot of things are going on in the background. In fact, every time you run a file, Windows creates special system structures that dictate the actions to be taken. XNTSV is a lightweight utility designed to help you view the detailed structures of all the data in this type of situation. The app provides complete information about any running process, so you can figure out how they are handled and what other processes they open or load.

The tool does not require installation or configuration, so simply download and decompress in the desired location. On launch, the app quickly scans your system and displays a list of all the processes. The developer claims that the app can detect the special system structures, including here PEB and its variations.

The app is quite impressive when it comes to the details it can provide. To learn more about a given process, simply click on it and then select one of the options located right under the menu. Regardless of whether you want to check out the structure, HEX or string, the app opens a new window and provides plenty of information.

The Viewer option provides even more insight about any particular process, including here the running OS, linker, compiler, language it was written, tool, sign tool, overlay, certificate, registry connections, so on and so forth. All the data can be easily reloaded and rechecked or compared, as the app supports save.

According to the developer, XNTSV could come in handy for researchers of Windows Internals who enjoy tinkering with background processes as well as creators of software protection, as they can easily figure out how protection features impact on the overall OS.