shell.observer

A small Windows console program that watches which processes and shells start and stop, and which IPv4 TCP and UDP endpoints open and close, and writes each event to a hash-chained log on your own disk.

Download shell-observer.exe View the source (C)

Windows 10 or 11, x64. Console program, 1127936 bytes. Runs as a normal user. Nothing is sent anywhere: it makes no outgoing network connections and has no update check.

What it reads

Processes

Process ID, parent ID and program name from a Toolhelp32 snapshot, compared between polls. cmd, PowerShell, pwsh, bash, sh and WSL are marked as shells.

Endpoints

IPv4 TCP connections with state, and UDP endpoints, with the owning process ID, from GetExtendedTcpTable and GetExtendedUdpTable.

Log

Every event is printed and appended to a new file per session. Each line carries the SHA-256 of the previous line's hash plus its own text, so verify finds the first edited line.

Limits

It polls (default every 1000 ms). Processes and connections that start and end between two polls are not seen.
IPv4 only in this version. No command lines of other processes, and no keystrokes or typed commands inside a shell.
The hash chain shows that a saved log was edited after the fact. Someone who can rewrite the whole file can also rewrite the chain.

Windows will warn you

The program is not code-signed. After downloading, Windows SmartScreen may show "Windows protected your PC". To run it anyway, choose More info, then Run anyway. Some managed or work PCs do not allow this at all. Only do it if the file's hash matches the one below.

Check the file in a Command Prompt in your Downloads folder:

certutil -hashfile shell-observer.exe SHA256

file	SHA-256
shell-observer.exe	`ecfdbb2c7f1f5ee7bd02e4a5df7a400dc184b8e57a5ea58f6e6dcdf953cac0e9`
shell-observer.c	`2c87aa846a939563217dda6f2ee6dccd01c496e0619d4ae3d8ca2a3b791c596e`

Use

shell-observer.exe                      watch until the window is closed
shell-observer.exe watch -n 60 -i 500   60 polls, 500 ms apart
shell-observer.exe selftest             built-in checks
shell-observer.exe verify FILE          check a saved log

Logs go to shell-observer-logs\session-DATE-TIME-pPID\log.txt next to where you run it. Each session gets a new folder. Nothing is overwritten or deleted.

The selftest computes SHA-256 test vectors, takes a process snapshot, starts a suspended cmd.exe and checks it appears and then disappears, opens a listener on 127.0.0.1 and checks it shows up under its own process ID, and writes a log that must verify while a copy with one changed byte must fail.

Built how

The program is written in plain C and compiled with this project's own compiler, which writes the Windows executable directly. It imports only from Windows system DLLs: KERNEL32, IPHLPAPI and WS2_32.