87 karma · joined October 11, 2019
It's similar with Windhawk mods. The GitHub and X profiles are verified to be the profiles of the author, so you can decide whether you trust them. The source code is available, so you can inspect it as well. Mods are single-file and usually short, which makes it easier to review than an average program.
You might say that many users don't care about mod development and don't need it. I agree, and I have it on my list to create a lite Windhawk version which doesn't depend on VSCodium.
Note that VSCodium is only used for the UI. When Windhawk is running in the background, its memory consumption is a couple of MB.
This is just one Windhawk mod, submitted by a community member. There are hundreds others. Windhawk was created to simplify Windows customization and to make it more accessible, both for developers and users. For a more detailed introduction, check out the Windhawk release blog post:
A truly fast and documented solution is using PssCaptureSnapshot, it can enumerate only threads of the target process. It uses NtGetNextThread under the hood. The downside: it's only available from Windows 8.1.
Using NtGetNextThread is not only fast and available from Windows Vista, it also allows avoiding race conditions - what happens if a new thread is created after the snapshot is created? A snapshot returns thread ids, what happens if one of the threads is destroyed? What happens if the thread id is reused (unlikely but possible)? I believe all the benefits I'm getting by using NtGetNextThread are worth using an undocumented function.
See also the research that I linked in the blog post: https://github.com/diversenok/Suspending-Techniques#snapshot...