Process Hacker, by wj32 and Dean.

Contents

Introduction

Process Hacker is a tool to view and manipulate processes. It can display a process' threads, modules, memory regions and handles. It can also search through a process' memory and read/write process memory.

System Requirements

Configuration Files

On Windows Vista, the configuration files for Process Hacker are stored in AppData\Local\wj32.

Other Process Viewers

Options

Process Hacker's options are accessible from the Options menu item in the Hacker menu.

General

Update Interval
Determines the amount of time in milliseconds between each update; i.e, when Process Hacker looks for new, modified or removed processes and services.
Search Engine
This is used by the Search Online... menu item in the process and module context menus. %s is replaced by the name of the selected process or module.
Warn about potentially dangerous actions
When this option is enabled, Process Hacker will warn about certain actions to system processes.
Show user/group domains
When this option is enabled, Process Hacker will show the domain of users and groups: user would be shown as machine-name\user.
Use Toolhelp-based module listings
When this option is enabled, Process Hacker will try to use the Toolhelp functions to display module listings. Do not use this option unless module listings are not working.

Highlighting

Highlighting Duration
This specifies the amount of time for which new and removed objects (processes, threads and services) are highlighted in a different color.

Number Input

Process Hacker supports the input of numbers in various bases (including some non-standard extensions). This is allowed in: Get Function Address, Change Memory Protection, the Go To box in Read/Write Memory, and the insertion of numbers through the Utilities button.

A number is assumed to be in base 10 unless:

Process List

The process list displays processes running on the system. Note that if Process Hacker was unable to acquire the debug privilege, it will not be able to display and manipulate processes not owned by the current user. To manipulate a process, right-click on an item. The same can be done to multiple processes. To view process modules, threads, memory and heaps you must click on a process in the list.

Columns

Name
This column displays the process names (as reported by the Tool Help API functions). If the process' name could not be retrieved, it will be displayed as (unknown).
PID
The process ID.
Pvt. Memory
The memory usage of the process, excluding shared memory regions.

Context Menu

Warning: Manipulating csrss.exe, dwm.exe, lsass.exe, lsm.exe, smss.exe, winlogon.exe or any other system processes is not recommended and may lead to system instability or a crash.

Terminate Process(es)
Uses the standard .NET method process.Kill() to terminate a process.
Suspend Process(es)
Windows does not have a built-in method of suspending processes, so this will suspend each of the process's threads using the Windows API function SuspendThread().
Resume Process(es)
Resumes the process by resuming each of its threads using ResumeThread().
Go to Parent
Selects the process' parent (the process which started the selected process).
Inspect...
Inspects the process as a PE file, showing image data, sections, imports and exports.
Privileges...
Opens a window allowing you to view, enable, disable or remove any of the process' privileges.
Groups...
Opens a window allowing you to view the process' groups (including integrity levels).
Services...
Opens a window showing the selected process' services.
Run As
These tools require Assistant.exe (distributed with Process Hacker) to be in the same directory as ProcessHacker.exe. Process Hacker installs a system service to run the programs Launch As User... - This allows you to run the selected process as another user.
Launch As This User... - This allows you to run a program under the selected process' user. This is useful when you want to start a program as another user but you do not have that user's password.
Priority
Sets the process's priority - Real Time, High, Above Normal, Normal, Below Normal, Idle. This option is not available when multiple processes are selected.
Search Online...
Opens the default web browser with the search engine specified in Process Hacker's options.
Select All
Selects all items in the list.

Thread List

The thread list displays the selected process' threads. Double-clicking a thread will display its call stack.

Columns

TID
The thread ID.
State
The state of the thread - Initialized, Ready, Running, Standby, Terminated, Transition, Unknown, Wait.
CPU Time
The total CPU Time measured in Minutes:Seconds:Milliseconds.
Priority
The priority of the thread - Time Critical, Highest, Above Normal, Normal, Below Normal, Lowest, Idle.

Context Menu

Inspect
Opens a window showing the thread's call stack.
Terminate Thread(s)
Terminates the selected thread(s) using the TerminateThread() API function.
Suspend Thread(s)
Suspends the selected thread(s) using the SuspendThread() API function.
Resume Thread(s)
Resumes the selected thread(s) using the ResumeThread() API function.
Priority
Sets the priority of the thread. This option is not available when multiple threads are selected.
Select All
Select all items in the list.

Module List

This list displays all modules loaded by the selected process. Unlike the process list or the thread list, this list does not refresh automatically. To refresh the list, click the name of the process in the process list again. To view the full file name of a module, hover the mouse over the module name or use the Copy File Name menu item. Double-clicking an item in the list will switch to the Memory tab and select the associated memory region.

Note that if the System process is selected, the module list will display a list of drivers loaded by the kernel, as reported by EnumDeviceDrivers().

Columns

Name
The short file name of the module. The main module is displayed at the top in bold font.
Base Address
The address at which the module was loaded in memory.
Size
The size, in bytes, of the module in memory.
Description
The file description, taken from the version information of the file.

Context Menu

Copy File Name
Copies the full file name of the module to the clipboard.
Open Containing Folder
Opens Windows Explorer with the selected module's file highlighted.
Properties...
Displays a properties window similar to Windows Explorer's with the module's file.
Get Function Address.
Opens a small box in which you can type a function name to get its address in memory. Note that if the module has not been loaded by Process Hacker, it will be loaded. After calling GetProcAddress(), Process Hacker will unload the module.
Change Memory Protection...
Allows you to change the page protection of the module's memory region using the API function VirtualProtectEx(). Note that if Data Execution Prevention (DEP) is enabled on the machine, certain actions may trigger DEP to close the target process.
Read Memory...
Allows you to read the memory of the module using ReadProcessMemory().
Go To In Memory View
Switches to the Memory tab and selects the memory region associated with the module.

Memory List

This list displays the memory regions of the process using the API function VirtualQueryEx().

Columns

Address
The start of the memory region.
Size
The size of the memory region.
State
The state of the memory region -
COMMIT - Indicates that physical storage has been allocated for the region, either in memory or in the paging file.
FREE - Indicates that the region is available to be allocated.
RESERVE - Indicates that the region has been reserved but no physical storage has been allocated for it.
Type
The type of the memory region -
IMAGE - Indicates that the region is mapped into an image (i.e. executable) section.
MAPPED - Indicates that the region is mapped.
PRIVATE - Indicates that the region is private (i.e. not shared with other processes).
Protection
The protection of the memory region.

Context Menu

Change Memory Protection...
Uses the API function VirtualProtectEx() to change the page protection of the memory region.
Read/Write Memory...
Uses the API functions ReadProcessMemory() and WriteProcessMemory() to read/write data in the memory region. Note that certain actions may trigger DEP to close the target process.
Read/Write Address...
Allows you to enter an virtual memory address to edit. Process Hacker will find the appropriate memory region and select the correct relative address. For example, if you want to edit memory at 0x12345678 and the process has a memory region starting at 0x12345100, Process Hacker will open the Read/Write Memory box and select the relative address 0x00000578.

Handle List

This list displays the handles opened by the process (files, registry keys, various NT objects) and allows you to close them. This is useful for "unlocking" files which you cannot delete because they are in use (although this is useless against rootkits).

Searching Memory

Process Hacker supports searching using a literal string or regular expressions. To perform a search, select the Process tab and select an option in the search button. A window will appear in which you can enter the data to search for. There are also checkboxes which control the memory regions to search in. When OK is clicked, a Results Window will appear with the search results.

Literal Search
Allows you to enter a sequence of bytes to search for.
Regex Search
Allows you to search using regular expressions.
String Scan
Scans for strings inside the process' memory.
Heap Scan
Displays a list of heap items.

In the Literal tab, there is a small button in the bottom-right which allows you to insert data in various formats.

Insert Number
This allows you to insert numbers in various formats - 8 to 64-bit, little or big endian.
Insert String
Similarly, this allows you to insert strings in various encodings - ASCII, UTF-8 to UTF-32. If a multiline item is selected, the prompt box will have a multiline textbox.

In the search results list, double-clicking an item will open the Memory Editor with the search result highlighted.

Sample Regex Searches

All of these samples must have Ignore Case selected.

A valid filesystem character is [ a-z0-9`~';!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]

Email address
[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.(au|biz|ca|com|info|net|org|uk|zh)
Path name
[A-Z]:\\([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*\\)*([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*)(\\)*
Executable file
([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}])+\.(bat|com|dll|exe)
URL
(file|ftp|http):///*[a-z0-9%\/ .\-_:\(\)\[\]]+

Results Window

The Results Window is displayed when searching for data, scanning for strings or scanning for heaps. There are five buttons at the top of the window:

Refresh
This performs the search again.
Edit Search
This allows you to edit the search type and data associated with the Results Window.
Filter
This allows you to filter the search results, creating a new Results Window containing the matching items. To filter using a numerical relation, enter the relation (for example, greater than or equal to >=) followed by the number. If the filter (>=10) is applied to the Length column, all items with a length greater than or equal 10 will be displayed.
Intersect
This allows you to select another Results Window. It then creates a third Results Window in which the search results present in both Results Windows are displayed. This allows you to filter search results.
Save...
This allows you to save the search results to a text file.

Tips

Terminating Processes
Almost all processes (including most Anti-virus programs) can be terminated by setting the page protection on their main module to PAGE_NOACCESS. This can be done by right-clicking on the module in bold font and selecting Change Memory Protection.... Type 0x1 and click Change. The process should crash within a few seconds.

Copyright Information

Process Hacker

Process Hacker

Copyright (C) 2008 wj32

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.

HexBox

Process Hacker uses the HexBox component by Bernhard Elbl, licensed under the Microsoft Public License:

This license governs use of the accompanying software. If you use the software, you
accept this license. If you do not accept the license, do not use the software.

1. Definitions
The terms "reproduce," "reproduction," "derivative works," and "distribution" have the
same meaning here as under U.S. copyright law.
A "contribution" is the original software, or any additions or changes to the software.
A "contributor" is any person that distributes its contribution under this license.
"Licensed patents" are a contributor's patent claims that read directly on its contribution.

2. Grant of Rights
(A) Copyright Grant- Subject to the terms of this license, including the license conditions 
    and limitations in section 3, each contributor grants you a non-exclusive, worldwide, 
    royalty-free copyright license to reproduce its contribution, prepare derivative works 
    of its contribution, and distribute its contribution or any derivative works that you 
    create.
(B) Patent Grant- Subject to the terms of this license, including the license conditions 
    and limitations in section 3, each contributor grants you a non-exclusive, worldwide, 
    royalty-free license under its licensed patents to make, have made, use, sell, offer 
    for sale, import, and/or otherwise dispose of its contribution in the software or 
    derivative works of the contribution in the software.

3. Conditions and Limitations
(A) No Trademark License- This license does not grant you rights to use any contributors' 
    name, logo, or trademarks.
(B) If you bring a patent claim against any contributor over patents that you claim are 
    infringed by the software, your patent license from such contributor to the software 
    ends automatically.
(C) If you distribute any portion of the software, you must retain all copyright, patent, 
    trademark, and attribution notices that are present in the software.
(D) If you distribute any portion of the software in source code form, you may do so only 
    under this license by including a complete copy of this license with your distribution. 
    If you distribute any portion of the software in compiled or object code form, you may 
    only do so under a license that complies with this license.
(E) The software is licensed "as-is." You bear the risk of using it. The contributors give 
    no express warranties, guarantees or conditions. You may have additional consumer rights 
    under your local laws which this license cannot change. To the extent permitted under your 
    local laws, the contributors exclude the implied warranties of merchantability, fitness for 
    a particular purpose and non-infringement.

VistaMenu and SplitButton

Process Hacker uses the VistaMenu and SplitButton components by Wyatt O'Day, licensed under the following terms:

Copyright (c) 2008, wyDay
All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted 
provided that the following conditions are met:

    * Redistributions of source code must retain the above copyright notice, this list of 
    conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above copyright notice, this list of 
    conditions and the following disclaimer in the documentation and/or other materials provided 
    with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND 
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER 
IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Free Disassembler and Assembler

Process Hacker uses a modified version of the Free Disassembler and Assembler by Oleh Yuschuk, licensed under the following terms:

Free Disassembler and Assembler

Copyright (C) 2001 Oleh Yuschuk

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA