YaolingZhang

ProcessMonitorisanadvancedmonitoringtoolforWindowsthatshowsreal-timefilesystem,Registryandprocess/threadactivity.ItcombinesthefeaturesoftwolegacySysin

winobj内核对象查看工具，查看驱动对象和设备对象，了解对象间的层次关系

Dependency Walker查看Exe文件和dll文件的导出函数和依赖库