mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
8b545e8e0b
further attempts at fixing ZwQueryObject hang git-svn-id: svn://svn.code.sf.net/p/processhacker/code@227 21ef857c-d57f-4fe0-8362-d861dc6d29cd
556 lines
25 KiB
HTML
556 lines
25 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
|
|
<html>
|
|
<head>
|
|
<title>Process Hacker Help</title>
|
|
<style type="text/css">
|
|
body {
|
|
font-family: "Cambria", "Times New Roman", Serif;
|
|
font-size: 10pt;
|
|
}
|
|
|
|
dt {
|
|
font-weight: bold;
|
|
}
|
|
|
|
pre {
|
|
font-size: 8pt;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<p><em><strong>Process Hacker</strong>, by wj32.</em></p>
|
|
|
|
<h1>Contents</h1>
|
|
<ul style="font-size: 8pt">
|
|
<li><a href="#intro">Introduction</a></li>
|
|
<li><a href="#options">Options</a></li>
|
|
<li><a href="#numberinput">Number Input</a></li>
|
|
<li><a href="#proclist">Process List</a></li>
|
|
<li><a href="#threadlist">Thread List</a></li>
|
|
<li><a href="#modlist">Module List</a></li>
|
|
<li><a href="#memlist">Memory List</a></li>
|
|
<li><a href="#hlist">Handle List</a></li>
|
|
<li><a href="#memsearch">Searching Memory</a></li>
|
|
<li><a href="#results">Results Window</a></li>
|
|
<li><a href="#tips">Tips</a></li>
|
|
<li><a href="#copyright">Copyright</a></li>
|
|
</ul>
|
|
|
|
<h1 id="intro">Introduction</h1>
|
|
<p>Process Hacker is a tool to view and manipulate processes. It can display a process' threads,
|
|
modules, memory regions and handles. It can also search through a process' memory and read/write
|
|
process memory.</p>
|
|
|
|
<h2>System Requirements</h2>
|
|
<ul>
|
|
<li>Microsoft Windows XP or Vista, <strong>32-bit</strong></li>
|
|
<li>.NET Framework 2.0</li>
|
|
</ul>
|
|
|
|
<h2>Configuration Files</h2>
|
|
<p>On Windows Vista, the configuration files for Process Hacker are stored in
|
|
<code>AppData\Local\wj32</code>.</p>
|
|
|
|
<h2>Credits</h2>
|
|
<p>Thanks to:</p>
|
|
<ul>
|
|
<li>Bernhard Elbl - HexBox control - http://sourceforge.net/projects/hexbox</li>
|
|
<li>Wyatt O'Day - VistaMenu - http://wyday.com/blog/2008/vista-menu-with-icons-in-c-sharp/</li>
|
|
<li>famfamfam.com - Silk Icons - http://www.famfamfam.com/lab/icons/silk/</li>
|
|
<li>Oleh Yuschuk - Disassembler/assembler - http://www.ollydbg.de</li>
|
|
</ul>
|
|
|
|
<h2>Other Process Viewers</h2>
|
|
<ul>
|
|
<li>
|
|
Process Viewer from CTi - http://www.teamcti.com/pview/prcview.htm
|
|
</li>
|
|
<li>
|
|
Process Viewer from NirSoft - http://www.nirsoft.net/utils/cprocess.html
|
|
</li>
|
|
<li>
|
|
Process Explorer - http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
|
|
</li>
|
|
</ul>
|
|
|
|
<h1 id="options">Options</h1>
|
|
<p>Process Hacker's options are accessible from the <strong>Options</strong> menu item
|
|
in the <strong>Hacker</strong> menu.</p>
|
|
|
|
<h2>General</h2>
|
|
<dl>
|
|
<dt>Update Interval</dt>
|
|
<dd>Determines the amount of time in milliseconds between each <em>update</em>; i.e, when
|
|
Process Hacker looks for new, modified or removed processes and services.</dd>
|
|
|
|
<dt>Search Engine</dt>
|
|
<dd>This is used by the <strong>Search Online...</strong> menu item in the process and module
|
|
context menus. <code>%s</code> is replaced by the name of the selected process or module.</dd>
|
|
|
|
<dt>Warn about potentially dangerous actions</dt>
|
|
<dd>When this option is enabled, Process Hacker will warn about certain actions to system processes.</dd>
|
|
|
|
<dt>Show user/group domains</dt>
|
|
<dd>When this option is enabled, Process Hacker will show the domain of users and groups: <code>user</code>
|
|
would be shown as <code>machine-name\user</code>.</dd>
|
|
|
|
<dt>Use Toolhelp-based module listings</dt>
|
|
<dd>When this option is enabled, Process Hacker will try to use the Toolhelp functions to display
|
|
module listings. Do not use this option unless module listings are not working.</dd>
|
|
</dl>
|
|
|
|
<h2>Highlighting</h2>
|
|
<dl>
|
|
<dt>Highlighting Duration</dt>
|
|
<dd>This specifies the amount of time for which new and removed objects (processes, threads and services)
|
|
are highlighted in a different color.</dd>
|
|
</dl>
|
|
|
|
<h1 id="numberinput">Number Input</h1>
|
|
<p>Process Hacker supports the input of numbers in various bases (including some non-standard
|
|
extensions). This is allowed in: Get Function Address, Change Memory Protection, the Go To
|
|
box in Read/Write Memory, and the insertion of numbers through the <strong>Utilities</strong>
|
|
button.</p>
|
|
<p>A number is assumed to be in base 10 unless:</p>
|
|
<ul>
|
|
<li>It starts with <code>0</code> (zero) - octal (base 8)</li>
|
|
<li>It starts with <code>0x</code> - hexadecimal (base 16)</li>
|
|
<li>It starts with <code>b</code> - binary (base 2)</li>
|
|
<li>It starts with <code>t</code> - ternary (base 3)</li>
|
|
<li>It starts with <code>q</code> - quaternary (base 4)</li>
|
|
<li>It starts with <code>w</code> - base 12</li>
|
|
<li>It starts with <code>r</code> - base 32</li>
|
|
</ul>
|
|
|
|
<h1 id="proclist">Process List</h1>
|
|
<p>The process list displays processes running on the system. Note that if Process Hacker was unable
|
|
to acquire the debug privilege, it will not be able to display and manipulate processes not owned
|
|
by the current user. To manipulate a process, right-click on an item. The same can be done to
|
|
multiple processes. To view process modules, threads, memory and heaps you must click on a
|
|
process in the list.</p>
|
|
|
|
<h2>Columns</h2>
|
|
<dl>
|
|
<dt>Name</dt>
|
|
<dd>This column displays the process names (as reported by the <em>Tool Help</em> API functions). If
|
|
the process' name could not be retrieved, it will be displayed as <code>(unknown)</code>.</dd>
|
|
|
|
<dt>PID</dt>
|
|
<dd>The process ID.</dd>
|
|
|
|
<dt>Pvt. Memory</dt>
|
|
<dd>The memory usage of the process, excluding shared memory regions.</dd>
|
|
</dl>
|
|
|
|
<h2>Context Menu</h2>
|
|
<p><strong>Warning:</strong> Manipulating csrss.exe, dwm.exe, lsass.exe, lsm.exe, smss.exe,
|
|
winlogon.exe or any other system processes is not recommended and may lead to system instability or
|
|
a crash.</p>
|
|
|
|
<dl>
|
|
<dt>Terminate Process(es)</dt>
|
|
<dd>Uses the standard .NET method <code>process.Kill()</code> to terminate a process.</dd>
|
|
|
|
<dt>Suspend Process(es)</dt>
|
|
<dd>Windows does not have a built-in method of suspending processes, so this will suspend each
|
|
of the process's threads using the Windows API function <code>SuspendThread()</code>.</dd>
|
|
|
|
<dt>Resume Process(es)</dt>
|
|
<dd>Resumes the process by resuming each of its threads using <code>ResumeThread()</code>.</dd>
|
|
|
|
<dt>Go to Parent</dt>
|
|
<dd>Selects the process' parent (the process which started the selected process).</dd>
|
|
|
|
<dt>Inspect...</dt>
|
|
<dd>Inspects the process as a PE file, showing image data, sections, imports and exports.</dd>
|
|
|
|
<dt>Privileges...</dt>
|
|
<dd>Opens a window allowing you to view, enable, disable or remove any of the process'
|
|
privileges.</dd>
|
|
|
|
<dt>Groups...</dt>
|
|
<dd>Opens a window allowing you to view the process' groups (including integrity levels).</dd>
|
|
|
|
<dt>Services...</dt>
|
|
<dd>Opens a window showing the selected process' services.</dd>
|
|
|
|
<dt>Injector</dt>
|
|
<dd>This menu item contains several functions for manipulating the selected process using the Injector tool
|
|
(supplied with Process Hacker as <code>Injector.exe</code>). If <code>Injector.exe</code> is not present in
|
|
the same directory as Process Hacker, this menu item will not be visible. Due to restrictions with
|
|
the <code>CreateRemoteThread</code> API function, this menu item is disabled for processes with a different
|
|
session ID than Process Hacker (usually processes running under the SYSTEM account).<br /><br />
|
|
<strong>Start Process...</strong> - forces the target process to start a command you specify. This can be used
|
|
to start a process under the SYSTEM account - try targeting <code>winlogon.exe</code>. Note that because of
|
|
incompatibilities, this menu item is not available when running Windows XP.<br />
|
|
<strong>Get Command Line...</strong> - shows the target process' command line.<br />
|
|
<strong>Exit Process</strong> - forces the target process to terminate itself.</dd>
|
|
|
|
<dt>Priority</dt>
|
|
<dd>Sets the process's priority - Real Time, High, Above Normal, Normal, Below Normal, Idle.
|
|
This option is not available when multiple processes are selected.</dd>
|
|
|
|
<dt>Search Online...</dt>
|
|
<dd>Opens the default web browser with the search engine specified in Process Hacker's options.</dd>
|
|
|
|
<dt>Select All</dt>
|
|
<dd>Selects all items in the list.</dd>
|
|
</dl>
|
|
|
|
<h1 id="threadlist">Thread List</h1>
|
|
<p>The thread list displays the selected process' threads. Double-clicking a thread will display its call
|
|
stack.</p>
|
|
|
|
<h2>Columns</h2>
|
|
<dl>
|
|
<dt>TID</dt>
|
|
<dd>The thread ID.</dd>
|
|
|
|
<dt>State</dt>
|
|
<dd>The state of the thread - Initialized, Ready, Running, Standby, Terminated, Transition, Unknown,
|
|
Wait.</dd>
|
|
|
|
<dt>CPU Time</dt>
|
|
<dd>The total CPU Time measured in Minutes:Seconds:Milliseconds.</dd>
|
|
|
|
<dt>Priority</dt>
|
|
<dd>The priority of the thread - Time Critical, Highest, Above Normal, Normal, Below Normal, Lowest,
|
|
Idle.</dd>
|
|
</dl>
|
|
|
|
<h2>Context Menu</h2>
|
|
<dl>
|
|
<dt>Inspect</dt>
|
|
<dd>Opens a window showing the thread's call stack.</dt>
|
|
|
|
<dt>Terminate Thread(s)</dt>
|
|
<dd>Terminates the selected thread(s) using the <code>TerminateThread()</code> API function.</dd>
|
|
|
|
<dt>Suspend Thread(s)</dt>
|
|
<dd>Suspends the selected thread(s) using the <code>SuspendThread()</code> API function.</dd>
|
|
|
|
<dt>Resume Thread(s)</dt>
|
|
<dd>Resumes the selected thread(s) using the <code>ResumeThread()</code> API function.</dd>
|
|
|
|
<dt>Priority</dt>
|
|
<dd>Sets the priority of the thread. This option is not available when multiple threads are
|
|
selected.</dd>
|
|
|
|
<dt>Select All</dt>
|
|
<dd>Select all items in the list.</dd>
|
|
</dl>
|
|
|
|
<h1 id="modlist">Module List</h1>
|
|
<p>This list displays all modules loaded by the selected process. Unlike the process list or the
|
|
thread list, this list does not refresh automatically. To refresh the list, click the name of the
|
|
process in the process list again. To view the full file name of a module, hover the mouse over the
|
|
module name or use the <strong>Copy File Name</strong> menu item. Double-clicking an item
|
|
in the list will switch to the <strong>Memory</strong> tab and select the associated memory
|
|
region.</p>
|
|
|
|
<p>Note that if the <em>System</em> process is selected, the module list will display a list
|
|
of drivers loaded by the kernel, as reported by <code>EnumDeviceDrivers()</code>.</p>
|
|
|
|
<h2>Columns</h2>
|
|
<dl>
|
|
<dt>Name</dt>
|
|
<dd>The short file name of the module. The main module is displayed at the top in bold font.</dd>
|
|
|
|
<dt>Base Address</dt>
|
|
<dd>The address at which the module was loaded in memory.</dd>
|
|
|
|
<dt>Size</dt>
|
|
<dd>The size, in bytes, of the module in memory.</dd>
|
|
|
|
<dt>Description</dt>
|
|
<dd>The file description, taken from the version information of the file.</dd>
|
|
</dl>
|
|
|
|
<h2>Context Menu</h2>
|
|
<dl>
|
|
<dt>Copy File Name</dt>
|
|
<dd>Copies the full file name of the module to the clipboard.</dd>
|
|
|
|
<dt>Open Containing Folder</dt>
|
|
<dd>Opens Windows Explorer with the selected module's file highlighted.</dd>
|
|
|
|
<dt>Properties...</dt>
|
|
<dd>Displays a properties window similar to Windows Explorer's with the module's file.</dd>
|
|
|
|
<dt>Get Function Address.</dt>
|
|
<dd>Opens a small box in which you can type a function name to get its address in memory.
|
|
Note that if the module has not been loaded by Process Hacker, it will be loaded. After
|
|
calling <code>GetProcAddress()</code>, Process Hacker will unload the module.</dd>
|
|
|
|
<dt>Change Memory Protection...</dt>
|
|
<dd>Allows you to change the page protection of the module's memory region using the API
|
|
function <code>VirtualProtectEx()</code>. Note that if Data Execution Prevention (DEP) is
|
|
enabled on the machine, certain actions may trigger DEP to close the target process.</dd>
|
|
|
|
<dt>Read Memory...</dt>
|
|
<dd>Allows you to read the memory of the module using <code>ReadProcessMemory()</code>.</dd>
|
|
|
|
<dt>Go To In Memory View</dt>
|
|
<dd>Switches to the <strong>Memory</strong> tab and selects the memory region associated
|
|
with the module.</dd>
|
|
</dl>
|
|
|
|
<h1 id="memlist">Memory List</h1>
|
|
<p>This list displays the memory regions of the process using the API function
|
|
<code>VirtualQueryEx()</code>.</p>
|
|
|
|
<h2>Columns</h2>
|
|
<dl>
|
|
<dt>Address</dt>
|
|
<dd>The start of the memory region.</dd>
|
|
|
|
<dt>Size</dt>
|
|
<dd>The size of the memory region.</dd>
|
|
|
|
<dt>State</dt>
|
|
<dd>The state of the memory region - <br>
|
|
COMMIT - Indicates that physical storage has been allocated for the region,
|
|
either in memory or in the paging file.<br>
|
|
FREE - Indicates that the region is available to be allocated.<br>
|
|
RESERVE - Indicates that the region has been reserved but no physical storage
|
|
has been allocated for it.
|
|
</dd>
|
|
|
|
<dt>Type</dt>
|
|
<dd>The type of the memory region - <br>
|
|
IMAGE - Indicates that the region is mapped into an image (i.e. executable) section.<br>
|
|
MAPPED - Indicates that the region is mapped.<br>
|
|
PRIVATE - Indicates that the region is private (i.e. not shared with other processes).
|
|
</dd>
|
|
|
|
<dt>Protection</dt>
|
|
<dd>The protection of the memory region.</dd>
|
|
</dl>
|
|
|
|
<h2>Context Menu</h2>
|
|
<dl>
|
|
<dt>Change Memory Protection...</dt>
|
|
<dd>Uses the API function <code>VirtualProtectEx()</code> to change the page protection
|
|
of the memory region.</dd>
|
|
|
|
<dt>Read/Write Memory...</dt>
|
|
<dd>Uses the API functions <code>ReadProcessMemory()</code> and <code>WriteProcessMemory()</code>
|
|
to read/write data in the memory region. Note that certain actions may trigger DEP to
|
|
close the target process.</dd>
|
|
|
|
<dt>Read/Write Address...</dt>
|
|
<dd>
|
|
Allows you to enter an virtual memory address to edit. Process Hacker will find the appropriate
|
|
memory region and select the correct relative address. For example, if you want to edit memory at
|
|
<code>0x12345678</code> and the process has a memory region starting at <code>0x12345100</code>,
|
|
Process Hacker will open the <strong>Read/Write Memory</strong> box and select the relative address
|
|
<code>0x00000578</code>.
|
|
</dd>
|
|
</dl>
|
|
|
|
<h1 id="hlist">Handle List</h1>
|
|
<p>This list displays the handles opened by the process (files, registry keys, various NT objects) and
|
|
allows you to close them. This is useful for "unlocking" files which you cannot delete because they
|
|
are in use (although this is useless against rootkits).</p>
|
|
|
|
<h1 id="memsearch">Searching Memory</h1>
|
|
<p>Process Hacker supports searching using a literal string or regular expressions. To
|
|
perform a search, select the <strong>Process</strong> tab and select an option in the
|
|
search button. A window will appear in which you can enter the data to search for. There
|
|
are also checkboxes which control the memory regions to search in. When <strong>OK</strong>
|
|
is clicked, a Results Window will appear with the search results.</p>
|
|
|
|
<dl>
|
|
<dt>Literal Search</dt>
|
|
<dd>Allows you to enter a sequence of bytes to search for.</dd>
|
|
|
|
<dt>Regex Search</dt>
|
|
<dd>Allows you to search using regular expressions.</dd>
|
|
|
|
<dt>String Scan</dt>
|
|
<dd>Scans for strings inside the process' memory.</dd>
|
|
|
|
<dt>Heap Scan</dt>
|
|
<dd>Displays a list of heap items.</dd>
|
|
</dl>
|
|
|
|
<p>In the <strong>Literal</strong> tab, there is a small button in the bottom-right
|
|
which allows you to insert data in various formats.</p>
|
|
|
|
<dl>
|
|
<dt>Insert Number</dt>
|
|
<dd>This allows you to insert numbers in various formats - 8 to 64-bit, little or big endian.</dd>
|
|
|
|
<dt>Insert String</dt>
|
|
<dd>Similarly, this allows you to insert strings in various encodings - ASCII, UTF-8 to UTF-32.
|
|
If a multiline item is selected, the prompt box will have a multiline textbox.</dd>
|
|
</dl>
|
|
|
|
<p>In the search results list, double-clicking an item will open the Memory Editor with
|
|
the search result highlighted.</p>
|
|
|
|
<h2>Sample Regex Searches</h2>
|
|
<p>All of these samples must have <strong>Ignore Case</strong> selected.</p>
|
|
|
|
<p>A valid filesystem character is <code>[ a-z0-9`~';!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]</code>
|
|
|
|
<dl>
|
|
<dt>Email address</dt>
|
|
<dd><code>[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.(au|biz|ca|com|info|net|org|uk|zh)</code></dd>
|
|
|
|
<dt>Path name</dt>
|
|
<dd><code>[A-Z]:\\([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*\\)*([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*)(\\)*</code></dd>
|
|
|
|
<dt>Executable file</dt>
|
|
<dd><code>([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}])+\.(bat|com|dll|exe)</code></dd>
|
|
|
|
<dt>URL</dt>
|
|
<dd>(file|ftp|http):///*[a-z0-9%\/ .\-_:\(\)\[\]]+</dd>
|
|
</dl>
|
|
|
|
<h1 id="results">Results Window</h1>
|
|
<p>The Results Window is displayed when searching for data, scanning for strings or
|
|
scanning for heaps. There are five buttons at the top of the window:</p>
|
|
|
|
<dl>
|
|
<dt>Refresh</dt>
|
|
<dd>This performs the search again.</dd>
|
|
|
|
<dt>Edit Search</dt>
|
|
<dd>This allows you to edit the search type and data associated with the Results Window.</dd>
|
|
|
|
<dt>Filter</dt>
|
|
<dd>This allows you to filter the search results, creating a new Results Window containing
|
|
the matching items. To filter using a numerical relation, enter the relation (for example,
|
|
greater than or equal to <code>>=</code>) followed by the number. If the filter
|
|
(<code>>=10</code>) is applied to the <strong>Length</strong> column, all items with a
|
|
length greater than or equal 10 will be displayed.</dd>
|
|
|
|
<dt>Intersect</dt>
|
|
<dd>This allows you to select another Results Window. It then creates a third Results Window
|
|
in which the search results present in both Results Windows are displayed. This allows you
|
|
to filter search results.</dd>
|
|
|
|
<dt>Save...</dt>
|
|
<dd>This allows you to save the search results to a text file.</dd>
|
|
</dl>
|
|
|
|
<h1 id="tips">Tips</h1>
|
|
<dl>
|
|
<dt>Terminating Processes</dt>
|
|
<dd>Almost all processes (including most Anti-virus programs) can be terminated by setting the
|
|
page protection on their main module to PAGE_NOACCESS. This can be done by right-clicking
|
|
on the module in bold font and selecting <strong>Change Memory Protection...</strong>.
|
|
Type <code>0x1</code> and click <strong>Change</strong>. The process should crash within
|
|
a few seconds.</dd>
|
|
</dl>
|
|
|
|
<h1 id="copyright">Copyright Information</h1>
|
|
<h2>Process Hacker</h2>
|
|
<pre>Process Hacker
|
|
|
|
Copyright (C) 2008 wj32
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.</pre>
|
|
|
|
<h2>HexBox</h2>
|
|
<p>Process Hacker uses the HexBox component by Bernhard Elbl, licensed under the
|
|
Microsoft Public License:</p>
|
|
<pre>This license governs use of the accompanying software. If you use the software, you
|
|
accept this license. If you do not accept the license, do not use the software.
|
|
|
|
1. Definitions
|
|
The terms "reproduce," "reproduction," "derivative works," and "distribution" have the
|
|
same meaning here as under U.S. copyright law.
|
|
A "contribution" is the original software, or any additions or changes to the software.
|
|
A "contributor" is any person that distributes its contribution under this license.
|
|
"Licensed patents" are a contributor's patent claims that read directly on its contribution.
|
|
|
|
2. Grant of Rights
|
|
(A) Copyright Grant- Subject to the terms of this license, including the license conditions
|
|
and limitations in section 3, each contributor grants you a non-exclusive, worldwide,
|
|
royalty-free copyright license to reproduce its contribution, prepare derivative works
|
|
of its contribution, and distribute its contribution or any derivative works that you
|
|
create.
|
|
(B) Patent Grant- Subject to the terms of this license, including the license conditions
|
|
and limitations in section 3, each contributor grants you a non-exclusive, worldwide,
|
|
royalty-free license under its licensed patents to make, have made, use, sell, offer
|
|
for sale, import, and/or otherwise dispose of its contribution in the software or
|
|
derivative works of the contribution in the software.
|
|
|
|
3. Conditions and Limitations
|
|
(A) No Trademark License- This license does not grant you rights to use any contributors'
|
|
name, logo, or trademarks.
|
|
(B) If you bring a patent claim against any contributor over patents that you claim are
|
|
infringed by the software, your patent license from such contributor to the software
|
|
ends automatically.
|
|
(C) If you distribute any portion of the software, you must retain all copyright, patent,
|
|
trademark, and attribution notices that are present in the software.
|
|
(D) If you distribute any portion of the software in source code form, you may do so only
|
|
under this license by including a complete copy of this license with your distribution.
|
|
If you distribute any portion of the software in compiled or object code form, you may
|
|
only do so under a license that complies with this license.
|
|
(E) The software is licensed "as-is." You bear the risk of using it. The contributors give
|
|
no express warranties, guarantees or conditions. You may have additional consumer rights
|
|
under your local laws which this license cannot change. To the extent permitted under your
|
|
local laws, the contributors exclude the implied warranties of merchantability, fitness for
|
|
a particular purpose and non-infringement.</pre>
|
|
|
|
<h2>VistaMenu and SplitButton</h2>
|
|
<p>Process Hacker uses the VistaMenu and SplitButton components by Wyatt O'Day, licensed under
|
|
the following terms:</p>
|
|
<pre>Copyright (c) 2008, wyDay
|
|
All rights reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
provided that the following conditions are met:
|
|
|
|
* Redistributions of source code must retain the above copyright notice, this list of
|
|
conditions and the following disclaimer.
|
|
* Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
conditions and the following disclaimer in the documentation and/or other materials provided
|
|
with the distribution.
|
|
|
|
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
|
|
IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
|
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</pre>
|
|
|
|
<h2>Free Disassembler and Assembler</h2>
|
|
<p>Process Hacker uses a modified version of the Free Disassembler and Assembler by Oleh Yuschuk,
|
|
licensed under the following terms:</p>
|
|
<pre>Free Disassembler and Assembler
|
|
|
|
Copyright (C) 2001 Oleh Yuschuk
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program; if not, write to the Free Software
|
|
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA</pre>
|
|
</body>
|
|
</html>
|