A live view of a Windows system, in the spirit of Process Explorer and System Informer: processes as a tree with their threads, modules, handles, memory, token, windows, jobs and services; performance graphs (CPU, memory, I/O, network, disks, GPUs, NPUs); services and drivers; users; network connections; kernel modules; RPC/ALPC traffic; zombie processes; object types and the object manager namespace; kernel pool tags; disk I/O; autoruns; devices; event logs; firmware and TPM; system snapshots to compare; a PE file viewer; alerts; with VirusTotal checks, symbols, wait chains and dumps.
Some information (other users' processes, network traffic, RPC/ALPC, pool tags...) needs the app to run elevated.
See the documentation for every tab, dialog and option.
winget install ScorpioSoftware.WinSysLive
or download the zip from Releases and run WinSysLive.exe
(keep dbghelp.dll and symsrv.dll beside it to download symbols). Windows 10 or later, x64.
Visual Studio 2026 (toolset v145) with the Windows SDK 10.0.26100.0, the submodules, and from vcpkg (user-wide
integration) phnt, WIL, Detours and WTL in both the x64-windows and x64-windows-static triplets:
git clone https://github.com/zodiacon/WinSysLive
cd WinSysLive
git submodule update --init
msbuild WinSysLive.sln /p:Configuration=Release /p:Platform=x64