1.7.0

TaskExplorer 1.7.0 introduces one of the most substantial upgrades the application has received in years, modernizing the UI stack, improving driver robustness, expanding cross-architecture compatibility, and adding many new capabilities.
This version replaces the previous helper-process architecture with the newly introduced TaskHelper.exe, which now acts as the dedicated worker and service component. By offloading these responsibilities from TaskExplorer.exe itself, overall stability and responsiveness during privileged operations are significantly improved.

A major focus of this release is the KernelIsolator (KSI) driver. The process-protection logic has been thoroughly redesigned and no longer depends on DynData. This architectural improvement allows a large portion of the driver’s security features to operate even without up-to-date symbol information, increasing reliability across different Windows builds. Additionally, ARM64 compatibility issues that previously caused crashes in the protection layer have been resolved.

The user interface has undergone a notable modernization. TaskExplorer now uses Qt 6.8.3 together with Windows 7 compatibility patches, and the settings interface has been redesigned with sidebar-based navigation and icons instead of simple tabs. DPI scaling options have been added so the application renders correctly on displays of any density. The QWT graphing library has been upgraded to version 6.3, bringing smoother and more reliable charting.

Many new data columns and inspection tools have been added throughout the application. Memory view now includes an “original pages” column. Thread inspection provides the actual base priority, RPC usage, COM flags, and LXSS thread ID. Processes can now display CPU affinity and LXSS PID. Module view shows enclave information such as base address, size, and enclave type. A new window-finder tool allows users to drag a target onto any window to immediately locate its owning process, and the service view now provides a direct “open process” action.

Several behavioral improvements streamline navigation: the handle, module, and memory search windows now allow you to open the corresponding owning process simply by double-clicking a result. Additional security-related metadata has been added to the handle viewer, which has also been moved into its own dedicated section. The “run as” subsystem has been updated for better reliability.

Multiple bugs have been corrected, including a long-standing crash in the handle view, incorrect coloring of token privileges, ARM64 driver protection failures, and a corruption issue in the internal socket-list structures that was causing a memory leak.

With this release, support for 32-bit Windows has been removed, allowing development to focus on modern 64-bit platforms and ensuring the long-term maintainability of the driver and UI codebase.

TaskExplorer 1.7.0 is a major milestone that improves stability, security, performance, and usability across all supported systems, while laying the groundwork for future enhancements.