A bit tangential, but can you recommend any GUI applications for monitoring the system? The KDE's defualt system monitor is a bit heavy and does not provide much insights. I switched to Linux some time ago as my main system, but I miss a tool such as System Informer [1].
Interestingly, the Rust windows crate is generated from an MSIL assembly. And same metadata might be used to generate C# bindings thanks to cswin32 [1] project. The meta-assembly generation (Win32 metadata project) is based on clangsharp and it's fairly straightforward to generate interop code for native Windows libraries. Some time ago I described this process on my blog for the detours library [2]
I understand the burden that too much notes may take on you. I am a software troubleshooter and I used to keep my raw notes of all the interesting cases I encountered. However, with time, this set became hard to navigate. Additionally, when I was rereading my notes, they seemed chaotic and hard to follow. I now prefer to create a succinct summary of a closed case, explaining the taken steps, my thinking, and the solution, so that my future self could understand it :)
I do a lot of Windows troubleshooting and still thinking about incorporating AI in my work. The posted project looks interesting and it's impressive how fast it was created. Since it's using MCP it should be possible to bind it with local models. I wonder how performant and effective it would be. When working in the debugger, you should be careful with what you send to the external servers (for example, Copilot). Process memory may contain unencrypted passwords, usernames, domain configuration, IP addresses, etc. Also, I don’t think that vibe-debugging will work without knowing what eax registry is or how to navigate stack/heap. It will solve some obvious problems, such as most exceptions, but for anything more demanding (bugs in application logic, race conditions, etc.), you will still need to get your hands dirty.
I am actually more interested in improving the debugger interface. For example, AI assistant could help me create breakpoint commands that nicely print function parameters when you only partly know the function signature and do not have symbols. I used Claude/Gemini for such tasks and they were pretty good at it.
As a side note, I recall Kevin Gosse also implemented a WinDbg extension [1][2] which used OpenAI API to interpret the debugger command output.
I've been using bpftrace -lv to examine available trace points. But the bpftrace output won't show you the complex types definitions and this tool can do it. Great work!
There is also Sysmon for Linux [1]. I work often with Windows systems that's how I know it (it's a popular choice on Windows to analyze Sysmon logs for suspicious events), but it's probably niche in Linux world.
Have you tried running it on wine? [1] I use it this way on Linux and, after adjusting my commands for running editors and start menu tools, everything runs smoothly.
I feel that nowadays Rust is the language to go when you are doing system programming, but C# is not a bad choice either. With .NET 9 being released in a few weeks we will get NativeAOT (compilation to a native single binary) for x86 (x64 and ARM64 are already available). At work, I'm writing patches for legacy apps and needed to use C++ for most of my tasks. Nowadays, I'm doing more and more stuff in C# and enjoying it. For WinAPI there is a fantastic cswin32 [1] project that generates FFIs signatures on the fly. And it's fairly simple to extend it for other Windows libraries (I did it for detours [2], for example). And using pointers or working with native memory blocks is straightforward and intuitive for people with C/C++ background.
Apart from search customizations, I also use the bang searches (a few mine and many from https://github.com/kagisearch/bangs). I also recently switched to ultimate and created a few assistants with system prompts for my various needs (coding, learning chemistry, etc.)
Apps developed for the modern (open-source) version of .NET may be compiled to a native code (NativeAOT). Some time ago, I tried AOT on a simple WinForms project and it worked. Unfortunately, functions using COM APIs are not yet supported (as they rely on reflection). There is an ongoing effort to fix this problem: https://github.com/dotnet/winforms/issues/4649
I haven't considered the execution policy such a blocker since you may change it on the powershell.exe command line (for example, run "powershell.exe -ExecutionPolicy RemoteSigned -File script.ps1" from a bat file). Also, the default execution policies changed between PowerShell 5.x, shipped with Windows, and modern PowerShell 7.x, which you need to install separately. In 7.x RemoteSigned is the default in the server environment.
Not to mention that WinUI is not supported on Windows Server. Therefore, if you need to deploy to server and desktop environments, it's better to stay with WinApi (WinForms) or WPF.
Have you tried running it under wine? It works perfectly fine on my Linux system. You may only need to add a few shortcuts to convert paths for your custom commands.
NativeAOT is an excellent way to expose .NET code to native apps. One big feature I am missing is support for x86. If you have a 32-bit app in which you want to inject your .NET library, NativeAOT won't help.
I use it for Total Commander. When I moved to Linux, I tried mc and Double Commander but I missed TC interface. I installed wine and with the help of winepath I could use all my custom tools shortcuts. There is a wiki section on the official TC site with great tips how to use it this way: https://www.ghisler.ch/wiki/index.php/Total_Commander_under_...
Information hoarding was my big problem as well. To fight it, a few years ago, I stopped using any bookmark services, and I started to keep a list of links in a markdown text file with a limited number of tags. I split the links by month and often add a short description and a tag to a saved link. All IT tags are textual, but I use emojis for other link categories, such as music or books. Example content:
And so on. I know it's simplistic, but it helped me a lot to keep the number of links under a reasonable limit, and it is effortless to search through.
If you need to hook methods in a remote process (and also inject payload), you may also consider the Detours library [1]. It has a straightforward API and its repository contains many interesting samples. One thing I was missing in the library was a function to inject code into a running process. So I wrote takedetour [2] which I use as a template for my other projects. Maybe you will find it useful as well.
[1] https://www.systeminformer.com/