Process Hacker, by wj32.

Contents

Introduction

Process Hacker is a tool to view and manipulate processes. It can display a process' threads, modules, memory regions and heaps. It can also search through a process' memory and read/write process memory.

System Requirements

Configuration Files

On Windows Vista, the configuration files for Process Hacker are stored in AppData\Local\wj32.

Credits

Thanks to:

Other Process Viewers

Number Input

Process Hacker supports the input of numbers in various bases (including some non-standard extensions). This is allowed in: Get Function Address, Change Memory Protection, the Go To box in Read/Write Memory, and the insertion of numbers through the Utilities button.

A number is assumed to be in base 10 unless:

Process List

The process list displays processes running on the system. Note that if Process Hacker was unable to acquire the debug privilege, it will not be able to display and manipulate processes not owned by the current user. To manipulate a process, right-click on an item. The same can be done to multiple processes. To view process modules, threads, memory and heaps you must click on a process in the list.

Columns

Name
This column displays the process names (as reported by the Tool Help API functions). If the process' name could not be retrieved, it will be displayed as (unknown).
PID
The process ID.
Pvt. Memory
The memory usage of the process, excluding shared memory regions.

Context Menu

Warning: Manipulating csrss.exe, dwm.exe, lsass.exe, lsm.exe, smss.exe, winlogon.exe or any other system processes is not recommended and may lead to system instability or a crash.

Terminate Process(es)
Uses the standard .NET method process.Kill() to terminate a process.
Suspend Process(es)
Windows does not have a built-in method of suspending processes, so this will suspend each of the process's threads using the Windows API function SuspendThread().
Resume Process(es)
Resumes the process by resuming each of its threads using ResumeThread().
Close Active Window(s)
Closes the active window of the process.
Privileges...
Opens a window allowing you to view, enable, disable or remove any of the process' privileges.
Groups...
Opens a window allowing you to view the process' groups (including integrity levels).
Priority
Sets the process's priority - Real Time, High, Above Normal, Normal, Below Normal, Idle. This option is not available when multiple processes are selected.
Select All
Selects all items in the list.

Thread List

Columns

TID
The thread ID.
State
The state of the thread - Initialized, Ready, Running, Standby, Terminated, Transition, Unknown, Wait.
CPU Time
The total CPU Time measured in Minutes:Seconds:Milliseconds.
Priority
The priority of the thread - Time Critical, Highest, Above Normal, Normal, Below Normal, Lowest, Idle.

Context Menu

Terminate Thread(s)
Terminates the selected thread(s) using the TerminateThread() API function.
Suspend Thread(s)
Suspends the selected thread(s) using the SuspendThread() API function.
Resume Thread(s)
Resumes the selected thread(s) using the ResumeThread() API function.
Priority
Sets the priority of the thread. This option is not available when multiple threads are selected.
Select All
Select all items in the list.

Module List

This list displays all modules loaded by the selected process. Unlike the process list or the thread list, this list does not refresh automatically. To refresh the list, click the name of the process in the process list again. To view the full file name of a module, hover the mouse over the module name or use the Copy File Name context menu item. Double-clicking an item in the list will switch to the Memory tab and select the associated memory region.

Note that if the System process is selected, the module list will display a list of drivers loaded by the kernel, as reported by EnumDeviceDrivers(). In this case, only the Copy File Name and Properties... context menu items will be available.

Columns

Name
The short file name of the module. The main module is displayed at the top in bold font.
Base Address
The address at which the module was loaded in memory.
Size
The size, in bytes, of the module in memory.
Description
The file description, taken from the version information of the file.

Context Menu

Copy File Name
Copies the full file name of the module to the clipboard.
Open Containing Folder
Opens Windows Explorer with the selected module's file highlighted.
Properties...
Displays a properties window similar to Windows Explorer's with the module's file.
Get Function Address.
Opens a small box in which you can type a function name to get its address in memory. Note that if the module has not been loaded by Process Hacker, it will be loaded. After calling GetProcAddress(), Process Hacker will unload the module.
Change Memory Protection...
Allows you to change the page protection of the module's memory region using the API function VirtualProtectEx(). Note that if Data Execution Prevention (DEP) is enabled on the machine, certain actions may trigger DEP to close the target process.
Read Memory...
Allows you to read the memory of the module using ReadProcessMemory().
Go To In Memory View
Switches to the Memory tab and selects the memory region associated with the module.

Memory List

This list displays the memory regions of the process using the API function VirtualQueryEx().

Columns

Address
The start of the memory region.
Size
The size of the memory region.
State
The state of the memory region -
COMMIT - Indicates that physical storage has been allocated for the region, either in memory or in the paging file.
FREE - Indicates that the region is available to be allocated.
RESERVE - Indicates that the region has been reserved but no physical storage has been allocated for it.
Type
The type of the memory region -
IMAGE - Indicates that the region is mapped into an image (i.e. executable) section.
MAPPED - Indicates that the region is mapped.
PRIVATE - Indicates that the region is private (i.e. not shared with other processes).
Protection
The protection of the memory region.

Context Menu

Change Memory Protection...
Uses the API function VirtualProtectEx() to change the page protection of the memory region.
Read/Write Memory...
Uses the API functions ReadProcessMemory() and WriteProcessMemory() to read/write data in the memory region. Note that certain actions may trigger DEP to close the target process.
Read/Write Address...
Allows you to enter an virtual memory address to edit. Process Hacker will find the appropriate memory region and select the correct relative address. For example, if you want to edit memory at 0x12345678 and the process has a memory region starting at 0x12345100, Process Hacker will open the Read/Write Memory box and select the relative address 0x00000578.

Searching Memory

Process Hacker supports searching using a literal string or regular expressions. To perform a search, select the Process tab and select an option in the combo box. Then click Search.... A window will appear in which you can enter the data to search for. There are also checkboxes which control the memory regions to search in. When OK is clicked, a Results Window will appear with the search results.

Literal Search
Allows you to enter a sequence of bytes to search for.
Regex Search
Allows you to search using regular expressions.
String Scan
Scans for strings inside the process' memory.
Heap Scan
Displays a list of heap items.

In the Literal tab, there is a small button in the bottom-right which allows you to insert data in various formats.

Insert Number
This allows you to insert numbers in various formats - 8 to 64-bit, little or big endian.
Insert String
Similarly, this allows you to insert strings in various encodings - ASCII, UTF-8 to UTF-32. If a multiline item is selected, the prompt box will have a multiline textbox.

In the search results list, double-clicking an item will open the Memory Editor with the search result highlighted.

Sample Regex Searches

All of these samples must have Ignore Case selected.

A valid filesystem character is [ a-z0-9`~';!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]

Email address
[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.(au|biz|ca|com|info|net|org|uk|zh)
Path name
[A-Z]:\\([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*\\)*([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*)(\\)*
Executable file
([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}])+\.(bat|com|dll|exe)
URL
(file|ftp|http):///*[a-z0-9%\/ .\-_:\(\)\[\]]+

Results Window

The Results Window is displayed when searching for data, scanning for strings or scanning for heaps. There are four buttons at the top of the window:

Refresh
This performs the search again.
Edit Search
This allows you to edit the search type and data associated with the Results Window.
Filter
This allows you to filter the search results, creating a new Results Window containing the matching items. To filter using a numerical relation, enter the relation (for example, greater than or equal to >=) followed by the number. If the filter (>=10) is applied to the Length column, all items with a length greater than or equal 10 will be displayed.
Intersect
This allows you to select another Results Window. It then creates a third Results Window in which the search results present in both Results Windows are displayed. This allows you to filter search results.
Save...
This allows you to save the search results to a text file.

Misc. Information

This tab currently displays other information not important enough to be in their own tabs.

Tips

Terminating Processes
Almost all processes (including most Antivirus programs) can be terminated by setting the page protection on their main module to PAGE_NOACCESS. This can be done by right-clicking on the module in bold font and selecting Change Memory Protection.... Type 0x1 and click Change. The process should crash within a few seconds.