Page 2 of 2

FAR поджирает ресурсы ЦПУ

Posted: Mon 13 Apr, 2026 09:37
by Zeroes

Latest post of the previous page:

reguspregus,
Try
download
https://github.com/hasherezade/hollows_hunter
run under admin priveledges:
hollows_hunter.exe /pname far.exe

how many Total suspicious in report?

FAR поджирает ресурсы ЦПУ

Posted: Mon 13 Apr, 2026 13:47
by reguspregus
Zeroes wrote: Mon 13 Apr, 2026 09:37 hollows_hunter.exe /pname far.exe

how many Total suspicious in report?

Code: Select all

HollowsHunter v.0.4.1.1 (x64)
Built on: Sep 13 2025

using: PE-sieve v.0.4.1.1

Scanning PID:    15720 : Far.exe
--------
SUMMARY:
Scan at: 04/13/26 08:47:00 (1776084420)
Finished scan in: 141 ms.
[*] Total scanned: 1
[*] Total suspicious: 0

FAR поджирает ресурсы ЦПУ

Posted: Mon 13 Apr, 2026 15:35
by Zeroes
reguspregus,

you also need download PDB files (debug info)
image.png
zip+pdb or msi+pdb
PDB files must be original for N version of FAR distr
unpack PDB files to FAR DIR

Check thread in System Informer (need wait for loading symbols by System Informer, for Process Explorer need add path to Far dir in Configure Symbols dialog)
At the end information becomes more understandable than just shifting addresses in FAR.exe :)
image.png

and anyway in FAR press f11 , call Process list
find far.exe
copy info to text file to another panel (press f5)
attach Far.exe.txt here...

FAR поджирает ресурсы ЦПУ

Posted: Wed 20 May, 2026 14:13
by reguspregus
Here is the stack info using PDB when consuming about 3% CPU (FAR version 3.0 build 6666 x64):

Code: Select all

ntoskrnl.exe!KeSynchronizeExecution+0x6fa6
ntoskrnl.exe!KeWaitForSingleObject+0x1460
ntoskrnl.exe!KeWaitForSingleObject+0x98f
ntoskrnl.exe!KeWaitForSingleObject+0x233
ntoskrnl.exe!ExWaitForRundownProtectionRelease+0x7dd
ntoskrnl.exe!KiCheckForKernelApcDelivery+0x401
ntoskrnl.exe!KeSynchronizeExecution+0x3caf
Far.exe!ScreenBuf::Flush+0x53a
Far.exe!GetInputRecordImpl+0x2bd
Far.exe!GetInputRecord+0x29
Far.exe!Manager::ProcessMainLoop+0x2a
Far.exe!Manager::EnterMainLoop+0xc1
Far.exe!MainProcess+0x14f8
Far.exe!`mainImpl'::`2'::<lambda_5>::operator()+0xec
Far.exe!`function_ref<void __cdecl(void)>::function_ref<void __cdecl(void)><`cpp_try<`mainImpl'::`2'::<lambda_5>,`mainImpl'::`2'::<lambda_7>,`mainImpl'::`2'::<lambda_6> >'::`7'::<lambda_2> >'::`1'::<lambda_3_>::<lambda_invoker_cdecl>+0x12
Far.exe!detail::cpp_try+0x36
Far.exe!mainImpl+0xe16
Far.exe!`wmain_seh'::`2'::<lambda_1>::operator()+0x19
Far.exe!`function_ref<void __cdecl(void)>::function_ref<void __cdecl(void)><`cpp_try<`wmain_seh'::`2'::<lambda_1>,`wmain_seh'::`2'::<lambda_3>,`wmain_seh'::`2'::<lambda_2> >'::`7'::<lambda_2> >'::`1'::<lambda_6_>::<lambda_invoker_cdecl>+0x12
Far.exe!detail::cpp_try+0x36
Far.exe!wmain_seh+0x3aa
Far.exe!`function_ref<void __cdecl(void)>::function_ref<void __cdecl(void)><`seh_try<`main'::`2'::<lambda_1>,`seh_try_with_ui<`main'::`2'::<lambda_1>,`main'::`2'::<lambda_2> >'::`2'::<lambda_1>,`main'::`2'::<lambda_2> >'::`3'::<lambda_1> >'::`1'::<lambda_
Far.exe!detail::seh_try+0x18
Far.exe!main+0xc8
Far.exe!__scrt_common_main_seh+0x10c
KERNEL32.DLL!BaseThreadInitThunk+0x14
ntdll.dll!RtlUserThreadStart+0x21
And here is a screenshot for the thread list taken at the same time as the stack:
Untitled.png