mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
cbc0b5b2cd
* finished CSRProcesses git-svn-id: svn://svn.code.sf.net/p/processhacker/code@599 21ef857c-d57f-4fe0-8362-d861dc6d29cd
467 lines
22 KiB
HTML
467 lines
22 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
|
|
<html>
|
|
<head>
|
|
<title>Process Hacker Help</title>
|
|
<style type="text/css">
|
|
body {
|
|
font-family: "Cambria", "Times New Roman", Serif;
|
|
font-size: 10pt;
|
|
}
|
|
|
|
dt {
|
|
font-weight: bold;
|
|
}
|
|
|
|
pre {
|
|
font-size: 8pt;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<p><em><strong>Process Hacker</strong>, by wj32 and Dean.</em></p>
|
|
|
|
<h1 id="intro">Introduction</h1>
|
|
<p>Process Hacker is a tool to view and manipulate processes and services. It can display process' threads,
|
|
modules, memory regions and handles, search through process memory, and read/write memory using
|
|
a built-in hex editor.</p>
|
|
|
|
<h2>System Requirements</h2>
|
|
<ul>
|
|
<li>Microsoft Windows XP SP2 or Vista, <strong>32-bit</strong> (Windows XP SP3 and
|
|
Windows Vista SP1 required for certain features)</li>
|
|
<li>.NET Framework 2.0</li>
|
|
</ul>
|
|
|
|
<h2>Configuration Files</h2>
|
|
<p>On Windows Vista, the configuration files for Process Hacker are stored in
|
|
<code>AppData\Local\wj32</code>.</p>
|
|
|
|
<h2>Other Process Viewers</h2>
|
|
<ul>
|
|
<li>
|
|
Process Viewer from CTi - http://www.teamcti.com/pview/prcview.htm
|
|
</li>
|
|
<li>
|
|
Process Viewer from NirSoft - http://www.nirsoft.net/utils/cprocess.html
|
|
</li>
|
|
<li>
|
|
Process Explorer - http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
|
|
</li>
|
|
</ul>
|
|
|
|
<h1 id="options">Options</h1>
|
|
<p>Process Hacker's options are accessible from the <strong>Options</strong> menu item
|
|
in the <strong>Hacker</strong> menu.</p>
|
|
|
|
<h2>General</h2>
|
|
<dl>
|
|
<dt>Update Interval</dt>
|
|
<dd>The amount of time in milliseconds between each <em>update</em>; i.e, when
|
|
Process Hacker looks for new, modified or removed processes and services.</dd>
|
|
|
|
<dt>Search Engine</dt>
|
|
<dd>This is used by the <strong>Search Online...</strong> menu item in the process and module
|
|
context menus. <code>%s</code> is replaced by the name of the selected process or module.</dd>
|
|
|
|
<dt>Require Signatures</dt>
|
|
<dd>If <strong>Verify signatures and perform additional checks</strong> is enabled, this
|
|
specifies the processes that must have a valid signature. Processes with a <em>name</em>
|
|
that is specified in this field and do not have a valid signature will be highlighted
|
|
as a <em>Packed/Dangerous Process</em> (see Higlighting options).</dd>
|
|
|
|
<dt>Max. Size Unit</dt>
|
|
<dd>Specifies the maximum unit of size; sizes which can be displayed as 1024 or less in a
|
|
smaller unit will be displayed in that smaller unit, while sizes requiring a larger unit will
|
|
use units up to the maximum unit specified here.</dd>
|
|
|
|
<dt>Show tray icon</dt>
|
|
<dd>When this option is enabled, Process Hacker will display an icon in the system tray area.
|
|
That icon will show the CPU usage history and any enabled notifications such as new/terminated
|
|
processes and new/started/stopped/deleted services. You can configure notifications by
|
|
right-clicking on the icon.</dd>
|
|
|
|
<dt>Hide when minimized</dt>
|
|
<dd>When this option is enabled, Process Hacker will automatically hide when it is minimized. You
|
|
can double-click on the tray icon to show Process Hacker again.</dd>
|
|
|
|
<dt>Warn about potentially dangerous actions</dt>
|
|
<dd>When this option is enabled, Process Hacker will warn about certain actions to system processes.</dd>
|
|
|
|
<dt>Show user/group domains</dt>
|
|
<dd>When this option is enabled, Process Hacker will show the domain of users and groups: <code>user</code>
|
|
would be shown as <code>machine-name\user</code>.</dd>
|
|
|
|
<dt>Verify signatures and perform additional checks</dt>
|
|
<dd>This option affects newly created processes, and controls whether Process Hacker will
|
|
attempt to verify the digital signatures of processes.</dd>
|
|
|
|
<dt>Enable experimental kernel-mode driver</dt>
|
|
<dd>Some handles cannot be displayed by a user-mode program like Process Hacker; this
|
|
option enables the experimental driver <em>KProcessHacker</em> which allows Process Hacker
|
|
to display all handles and bypass rootkits/security software. If enabled, it will be
|
|
loaded the next time Process Hacker is started.<br />
|
|
Specifically, it provides Process Hacker
|
|
with the following features:<br />
|
|
The ability to display all file handles,<br />
|
|
The ability to open any process or thread without being intercepted by rootkits/security
|
|
software,<br />
|
|
The ability to protect and unprotect processes.</dd>
|
|
</dl>
|
|
|
|
<h2>Highlighting</h2>
|
|
<dl>
|
|
<dt>Highlighting Duration</dt>
|
|
<dd>This specifies the amount of time for which new and removed objects (processes, threads and services)
|
|
are highlighted in a different color.</dd>
|
|
|
|
<dt>New Objects</dt>
|
|
<dd>Highlighting for new processes, services, threads, modules, memory regions, and handles.</dd>
|
|
|
|
<dt>Removed Objects</dt>
|
|
<dd>Highlighting for terminated/deleted processes, services, threads, modules, memory regions and
|
|
handles.</dd>
|
|
|
|
<dt>Own Processes</dt>
|
|
<dd>Highlighting for processes running under the same user account as Process Hacker.</dd>
|
|
|
|
<dt>System Processes</dt>
|
|
<dd>Highlighting for processes running under the SYSTEM user account.</dd>
|
|
|
|
<dt>Service Processes</dt>
|
|
<dd>Highlighting for processes hosting one or more services.</dd>
|
|
|
|
<dt>Debugged Processes</dt>
|
|
<dd>Highlighting for processes currently being debugged.</dd>
|
|
|
|
<dt>Elevated Processes</dt>
|
|
<dd>Highlighting for processes running with full privileges on a computer with
|
|
User Account Control (UAC) enabled.</dd>
|
|
|
|
<dt>Job Processes</dt>
|
|
<dd>Highlighting for processes associated with a job object.</dd>
|
|
|
|
<dt>.NET Processes</dt>
|
|
<dd>Highlighting for managed processes. Note that this currently only
|
|
highlights pure CLR executables - mixed code executables and processes hosting
|
|
.NET code will not be highlighted.</dd>
|
|
|
|
<dt>Packed/Dangerous Processes</dt>
|
|
<dd>Highlighting for packed images and images with invalid signatures. These processes
|
|
are often, but not always malicious - normal executables are often packed to reduce their
|
|
size.</dd>
|
|
</dl>
|
|
|
|
<h2>Plotting</h2>
|
|
<dl>
|
|
<dt>Use Anti-aliasing</dt>
|
|
<dd>If selected, Process Hacker will draw graphs with anti-aliasing. This will
|
|
usually consume much more system resources than normal.</dd>
|
|
</dl>
|
|
|
|
<h1 id="numberinput">Number Input</h1>
|
|
<p>Process Hacker supports the input of numbers in various bases (including some non-standard
|
|
extensions). This is allowed in: Get Function Address, Change Memory Protection, the Go To
|
|
box in Read/Write Memory, and the insertion of numbers through the <strong>Utilities</strong>
|
|
button.</p>
|
|
<p>A number is assumed to be in base 10 unless:</p>
|
|
<ul>
|
|
<li>It starts with <code>0</code> (zero) - octal (base 8)</li>
|
|
<li>It starts with <code>0x</code> - hexadecimal (base 16)</li>
|
|
<li>It starts with <code>b</code> - binary (base 2)</li>
|
|
<li>It starts with <code>t</code> - ternary (base 3)</li>
|
|
<li>It starts with <code>q</code> - quaternary (base 4)</li>
|
|
<li>It starts with <code>w</code> - base 12</li>
|
|
<li>It starts with <code>r</code> - base 32</li>
|
|
</ul>
|
|
|
|
<h1 id="proctree">Process Tree</h1>
|
|
<p>The process tree displays processes running on the system as a tree; processes started by a
|
|
particular parent process are shown indented below it. Processes with a non-existent parent
|
|
(where its parent has terminated) are shown on the far left. You can manipulate processes by
|
|
right-clicking on them, and you can show detailed properties for a process by double-clicking
|
|
it or selecting the "Properties..." menu item.</p>
|
|
|
|
<p>You can sort by the various columns by clicking on them - the tree view will temporarily
|
|
become a flat list. You can click the same column again to sort in the opposite order, and
|
|
once more to return to the tree view.</p>
|
|
|
|
<p>Like Process Explorer, Process Hacker shows Deferred Procedure Calls (DPCs) and Interrupts
|
|
in the process tree. The only information these "processes" show is their CPU usage.</p>
|
|
|
|
<h2>Context Menu</h2>
|
|
<p><strong>Warning:</strong> Manipulating csrss.exe, dwm.exe, lsass.exe, lsm.exe, smss.exe,
|
|
winlogon.exe or any other system processes is not recommended and may lead to system instability or
|
|
a crash.</p>
|
|
|
|
<dl>
|
|
<dt>Terminate Process(es)</dt>
|
|
<dd>Uses the <code>TerminateProcess()</code> API function to terminate the selected
|
|
process(es).</dd>
|
|
|
|
<dt>Suspend Process(es)</dt>
|
|
<dd>Uses the <code>NtSuspendProcess()</code> API function to suspend the selected
|
|
process(es).</dd>
|
|
|
|
<dt>Resume Process(es)</dt>
|
|
<dd>Uses the <code>NtResumeProcess()</code> API function to resume the selected
|
|
process(es).</dd>
|
|
|
|
<dt>Affinity...</dt>
|
|
<dd>Allows you to view and modify the process' CPU affinity (the CPUs on which it is allowed
|
|
to run).</dd>
|
|
|
|
<dt>Terminator...</dt>
|
|
<dd>A tool which tries to terminate the selected process using many different techniques.</dd>
|
|
|
|
<dt>Priority</dt>
|
|
<dd>Sets the process's priority - Real Time, High, Above Normal, Normal, Below Normal, Idle.
|
|
This option is not available when multiple processes are selected.</dd>
|
|
|
|
<dt>Run As</dt>
|
|
<dd>These tools require <code>Assistant.exe</code> (distributed with Process Hacker) to be in the same directory
|
|
as <code>ProcessHacker.exe</code>.<br />
|
|
<strong>Launch As User...</strong> - This allows you to run the selected process as another user.<br />
|
|
<strong>Launch As This User...</strong> - This allows you to run a program under the selected process' user. This
|
|
is useful when you want to start a program as another user but you do not have that user's password.</dd>
|
|
|
|
<dt>Search Online...</dt>
|
|
<dd>Opens the default web browser with the search engine specified in Process Hacker's options.</dd>
|
|
|
|
<dt>Select All</dt>
|
|
<dd>Selects all items in the list.</dd>
|
|
</dl>
|
|
|
|
<h1 id="procprops">Process Properties</h1>
|
|
<dl>
|
|
<dt>General</dt>
|
|
<dd>Displays basic information about the process and its image file. You can also view the
|
|
process' PEB contents, view/change its DEP status (requires Windows XP SP3 or higher, and
|
|
changing DEP status uses remote thread injection), and protect/unprotect it (requires
|
|
Windows Vista).</dd>
|
|
|
|
<dt>Statistics</dt>
|
|
<dd>Displays statistics and performance information.</dd>
|
|
|
|
<dt>Performance</dt>
|
|
<dd>Displays three graphs relating to the process' performance - CPU Usage,
|
|
Memory Usage, and I/O activity.</dd>
|
|
|
|
<dt>Threads</dt>
|
|
<dd>Displays the process' threads, including their symbolic start addresses. You can click on
|
|
a thread to view more information, or double-click a thread to view its call stack.</dd>
|
|
|
|
<dt>Token</dt>
|
|
<dd>Displays the process' primary token. On Windows Vista with UAC enabled, you can also
|
|
click on the <strong>Linked Token...</strong> button to view the token associated with
|
|
the process' token. You can also enable and disable privileges.</dd>
|
|
|
|
<dt>Modules</dt>
|
|
<dd>Displays the modules loaded by the process. Right-click a module for more options.</dd>
|
|
|
|
<dt>Memory</dt>
|
|
<dd>Displays the process' virtual memory regions. Double-click a memory region to
|
|
read/write its contents, and right-click a memory region to perform other actions. You can
|
|
also search memory using the search button (see below).</dd>
|
|
|
|
<dt>Handles</dt>
|
|
<dd>Displays the process' handles - resources it has opened. You can right-click a handle and
|
|
close it.</dd>
|
|
|
|
<dt>Services</dt>
|
|
<dd>Displays services that are registered in the process.</dd>
|
|
</dl>
|
|
|
|
<h1 id="memsearch">Searching Memory</h1>
|
|
<p>Process Hacker supports searching using a literal string or regular expressions. To
|
|
perform a search, open a Properties window for a process, select the <strong>Memory</strong>
|
|
tab and select an option in the search button. A window will appear in which you can
|
|
enter the data to search for. You can also control the types of memory regions to search.</p>
|
|
|
|
<dl>
|
|
<dt>Literal Search</dt>
|
|
<dd>Allows you to enter a sequence of bytes to search for.</dd>
|
|
|
|
<dt>Regex Search</dt>
|
|
<dd>Allows you to search using regular expressions.</dd>
|
|
|
|
<dt>String Scan</dt>
|
|
<dd>Scans for strings inside the process' memory.</dd>
|
|
|
|
<dt>Heap Scan</dt>
|
|
<dd>Displays a list of heap blocks.</dd>
|
|
|
|
<dt>Struct Search</dt>
|
|
<dd>Allows you to search for addresses which match the selected struct.</dd>
|
|
</dl>
|
|
|
|
<p>In the <strong>Literal</strong> tab, there is a small button in the bottom-right
|
|
which allows you to insert data in various formats.</p>
|
|
|
|
<dl>
|
|
<dt>Insert Number</dt>
|
|
<dd>This allows you to insert numbers in various formats - 8 to 64-bit, little or big endian.</dd>
|
|
|
|
<dt>Insert String</dt>
|
|
<dd>Similarly, this allows you to insert strings in various encodings - ASCII, UTF-8 to UTF-32.
|
|
If a multiline item is selected, the prompt box will have a multiline textbox.</dd>
|
|
</dl>
|
|
|
|
<p>In the search results list, double-clicking an item will open the Memory Editor with
|
|
the search result highlighted.</p>
|
|
|
|
<h2>Sample Regex Searches</h2>
|
|
<p>All of these samples must have <strong>Ignore Case</strong> selected.</p>
|
|
|
|
<p>A valid filesystem character is <code>[ a-z0-9`~';!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]</code>
|
|
|
|
<dl>
|
|
<dt>Email address</dt>
|
|
<dd><code>[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.(au|biz|ca|com|info|net|org|uk|zh)</code></dd>
|
|
|
|
<dt>Path name</dt>
|
|
<dd><code>[A-Z]:\\([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*\\)*([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*)(\\)*</code></dd>
|
|
|
|
<dt>Executable file</dt>
|
|
<dd><code>([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}])+\.(bat|com|dll|exe)</code></dd>
|
|
|
|
<dt>URL</dt>
|
|
<dd>(file|ftp|http):///*[a-z0-9%\/ .\-_:\(\)\[\]]+</dd>
|
|
</dl>
|
|
|
|
<h1 id="results">Results Window</h1>
|
|
<p>The Results Window is displayed when searching for data, scanning for strings or
|
|
scanning for heaps. There are five buttons at the top of the window:</p>
|
|
|
|
<dl>
|
|
<dt>Refresh</dt>
|
|
<dd>This performs the search again.</dd>
|
|
|
|
<dt>Edit Search</dt>
|
|
<dd>This allows you to edit the search type and data associated with the Results Window.</dd>
|
|
|
|
<dt>Filter</dt>
|
|
<dd>This allows you to filter the search results, creating a new Results Window containing
|
|
the matching items. To filter using a numerical relation, enter the relation (for example,
|
|
greater than or equal to <code>>=</code>) followed by the number. If the filter
|
|
(<code>>=10</code>) is applied to the <strong>Length</strong> column, all items with a
|
|
length greater than or equal 10 will be displayed.</dd>
|
|
|
|
<dt>Intersect</dt>
|
|
<dd>This allows you to select another Results Window. It then creates a third Results Window
|
|
in which the search results present in both Results Windows are displayed. This allows you
|
|
to filter search results.</dd>
|
|
|
|
<dt>Save...</dt>
|
|
<dd>This allows you to save the search results to a text file.</dd>
|
|
</dl>
|
|
|
|
<h1 id="copyright">Copyright Information</h1>
|
|
<h2>Process Hacker</h2>
|
|
<pre>Process Hacker
|
|
|
|
Copyright (C) 2008-2009 wj32
|
|
Copyright (C) 2008-2009 Dean
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.</pre>
|
|
|
|
<h2>HexBox</h2>
|
|
<p>Process Hacker uses the HexBox component by Bernhard Elbl, licensed under the
|
|
Microsoft Public License:</p>
|
|
<pre>This license governs use of the accompanying software. If you use the software, you
|
|
accept this license. If you do not accept the license, do not use the software.
|
|
|
|
1. Definitions
|
|
The terms "reproduce," "reproduction," "derivative works," and "distribution" have the
|
|
same meaning here as under U.S. copyright law.
|
|
A "contribution" is the original software, or any additions or changes to the software.
|
|
A "contributor" is any person that distributes its contribution under this license.
|
|
"Licensed patents" are a contributor's patent claims that read directly on its contribution.
|
|
|
|
2. Grant of Rights
|
|
(A) Copyright Grant- Subject to the terms of this license, including the license conditions
|
|
and limitations in section 3, each contributor grants you a non-exclusive, worldwide,
|
|
royalty-free copyright license to reproduce its contribution, prepare derivative works
|
|
of its contribution, and distribute its contribution or any derivative works that you
|
|
create.
|
|
(B) Patent Grant- Subject to the terms of this license, including the license conditions
|
|
and limitations in section 3, each contributor grants you a non-exclusive, worldwide,
|
|
royalty-free license under its licensed patents to make, have made, use, sell, offer
|
|
for sale, import, and/or otherwise dispose of its contribution in the software or
|
|
derivative works of the contribution in the software.
|
|
|
|
3. Conditions and Limitations
|
|
(A) No Trademark License- This license does not grant you rights to use any contributors'
|
|
name, logo, or trademarks.
|
|
(B) If you bring a patent claim against any contributor over patents that you claim are
|
|
infringed by the software, your patent license from such contributor to the software
|
|
ends automatically.
|
|
(C) If you distribute any portion of the software, you must retain all copyright, patent,
|
|
trademark, and attribution notices that are present in the software.
|
|
(D) If you distribute any portion of the software in source code form, you may do so only
|
|
under this license by including a complete copy of this license with your distribution.
|
|
If you distribute any portion of the software in compiled or object code form, you may
|
|
only do so under a license that complies with this license.
|
|
(E) The software is licensed "as-is." You bear the risk of using it. The contributors give
|
|
no express warranties, guarantees or conditions. You may have additional consumer rights
|
|
under your local laws which this license cannot change. To the extent permitted under your
|
|
local laws, the contributors exclude the implied warranties of merchantability, fitness for
|
|
a particular purpose and non-infringement.</pre>
|
|
|
|
<h2>VistaMenu and SplitButton</h2>
|
|
<p>Process Hacker uses the VistaMenu and SplitButton components by Wyatt O'Day, licensed under
|
|
the following terms:</p>
|
|
<pre>Copyright (c) 2008, wyDay
|
|
All rights reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
provided that the following conditions are met:
|
|
|
|
* Redistributions of source code must retain the above copyright notice, this list of
|
|
conditions and the following disclaimer.
|
|
* Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
conditions and the following disclaimer in the documentation and/or other materials provided
|
|
with the distribution.
|
|
|
|
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
|
|
IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
|
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</pre>
|
|
|
|
<h2>Free Disassembler and Assembler</h2>
|
|
<p>Process Hacker uses a modified version of the Free Disassembler and Assembler by Oleh Yuschuk,
|
|
licensed under the following terms:</p>
|
|
<pre>Free Disassembler and Assembler
|
|
|
|
Copyright (C) 2001 Oleh Yuschuk
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program; if not, write to the Free Software
|
|
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA</pre>
|
|
</body>
|
|
</html>
|