mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
91a85146ed
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@72 21ef857c-d57f-4fe0-8362-d861dc6d29cd
383 lines
16 KiB
HTML
383 lines
16 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
|
|
<html>
|
|
<head>
|
|
<title>Process Hacker Help</title>
|
|
<style type="text/css">
|
|
body {
|
|
font-family: "Cambria", "Times New Roman", Serif;
|
|
font-size: 10pt;
|
|
}
|
|
|
|
dt {
|
|
font-weight: bold;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<p><em><strong>Process Hacker</strong>, by wj32.</em></p>
|
|
|
|
<h1>Contents</h1>
|
|
<ul style="font-size: 8pt">
|
|
<li><a href="#intro">Introduction</a></li>
|
|
<li><a href="#numberinput">Number Input</a></li>
|
|
<li><a href="#proclist">Process List</a></li>
|
|
<li><a href="#threadlist">Thread List</a></li>
|
|
<li><a href="#modlist">Module List</a></li>
|
|
<li><a href="#memlist">Memory List</a></li>
|
|
<li><a href="#memsearch">Searching Memory</a></li>
|
|
<li><a href="#results">Results Window</a></li>
|
|
<li><a href="#miscinfo">Misc. Information</a></li>
|
|
<li><a href="#tips">Tips</a></li>
|
|
</ul>
|
|
|
|
<h1 id="intro">Introduction</h1>
|
|
<p>Process Hacker is a tool to view and manipulate processes. It can display a process' threads,
|
|
modules, memory regions and heaps. It can also search through a process' memory and read/write
|
|
process memory.</p>
|
|
|
|
<h2>System Requirements</h2>
|
|
<ul>
|
|
<li>Microsoft Windows XP or Vista, <strong>32-bit</strong> (doesn't work very well on XP though)</li>
|
|
<li>.NET Framework 2.0</li>
|
|
</ul>
|
|
|
|
<h2>Configuration Files</h2>
|
|
<p>On Windows Vista, the configuration files for Process Hacker are stored in
|
|
<code>AppData\Local\wj32</code>.</p>
|
|
|
|
<h2>Credits</h2>
|
|
<p>Thanks to:</p>
|
|
<ul>
|
|
<li>Bernhard Elbl - HexBox control - http://sourceforge.net/projects/hexbox</li>
|
|
<li>wyDay - VistaMenu - http://wyday.com/blog/2008/vista-menu-with-icons-in-c-sharp/</li>
|
|
<li>famfamfam.com - Silk Icons - http://www.famfamfam.com/lab/icons/silk/</li>
|
|
</ul>
|
|
|
|
<h2>Other Process Viewers</h2>
|
|
<ul>
|
|
<li>
|
|
Process Viewer from CTi - http://www.teamcti.com/pview/prcview.htm
|
|
</li>
|
|
<li>
|
|
Process Viewer from NirSoft - http://www.nirsoft.net/utils/cprocess.html
|
|
</li>
|
|
<li>
|
|
Process Explorer - http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
|
|
</li>
|
|
</ul>
|
|
|
|
<h1 id="numberinput">Number Input</h1>
|
|
<p>Process Hacker supports the input of numbers in various bases (including some non-standard
|
|
extensions). This is allowed in: Get Function Address, Change Memory Protection, the Go To
|
|
box in Read/Write Memory, and the insertion of numbers through the <strong>Utilities</strong>
|
|
button.</p>
|
|
<p>A number is assumed to be in base 10 unless:</p>
|
|
<ul>
|
|
<li>It starts with <code>0</code> (zero) - octal (base 8)</li>
|
|
<li>It starts with <code>0x</code> - hexadecimal (base 16)</li>
|
|
<li>It starts with <code>b</code> - binary (base 2)</li>
|
|
<li>It starts with <code>t</code> - ternary (base 3)</li>
|
|
<li>It starts with <code>q</code> - quaternary (base 4)</li>
|
|
<li>It starts with <code>w</code> - base 12</li>
|
|
<li>It starts with <code>r</code> - base 32</li>
|
|
</ul>
|
|
|
|
<h1 id="proclist">Process List</h1>
|
|
<p>The process list displays processes running on the system. Note that if Process Hacker was unable
|
|
to acquire the debug privilege, it will not be able to display and manipulate processes not owned
|
|
by the current user. To manipulate a process, right-click on an item. The same can be done to
|
|
multiple processes. To view process modules, threads, memory and heaps you must click on a
|
|
process in the list.</p>
|
|
|
|
<h2>Columns</h2>
|
|
<dl>
|
|
<dt>Name</dt>
|
|
<dd>This column displays the process names (as reported by the <em>Tool Help</em> API functions). If
|
|
the process' name could not be retrieved, it will be displayed as <code>(unknown)</code>.</dd>
|
|
|
|
<dt>PID</dt>
|
|
<dd>The process ID.</dd>
|
|
|
|
<dt>Pvt. Memory</dt>
|
|
<dd>The memory usage of the process, excluding shared memory regions.</dd>
|
|
</dl>
|
|
|
|
<h2>Context Menu</h2>
|
|
<p><strong>Warning:</strong> Manipulating csrss.exe, dwm.exe, lsass.exe, lsm.exe, smss.exe,
|
|
winlogon.exe or any other system processes is not recommended and may lead to system instability or
|
|
a crash.</p>
|
|
|
|
<dl>
|
|
<dt>Terminate Process(es)</dt>
|
|
<dd>Uses the standard .NET method <code>process.Kill()</code> to terminate a process.</dd>
|
|
|
|
<dt>Suspend Process(es)</dt>
|
|
<dd>Windows does not have a built-in method of suspending processes, so this will suspend each
|
|
of the process's threads using the Windows API function <code>SuspendThread()</code>.</dd>
|
|
|
|
<dt>Resume Process(es)</dt>
|
|
<dd>Resumes the process by resuming each of its threads using <code>ResumeThread()</code>.</dd>
|
|
|
|
<dt>Close Active Window(s)</dt>
|
|
<dd>Closes the active window of the process.</dd>
|
|
|
|
<dt>Privileges...</dt>
|
|
<dd>Opens a window allowing you to view, enable, disable or remove any of the process'
|
|
privileges.</dd>
|
|
|
|
<dt>Groups...</dt>
|
|
<dd>Opens a window allowing you to view the process' groups (including integrity levels).</dd>
|
|
|
|
<dt>Priority</dt>
|
|
<dd>Sets the process's priority - Real Time, High, Above Normal, Normal, Below Normal, Idle.
|
|
This option is not available when multiple processes are selected.</dd>
|
|
|
|
<dt>Select All</dt>
|
|
<dd>Selects all items in the list.</dd>
|
|
</dl>
|
|
|
|
<h1 id="threadlist">Thread List</h1>
|
|
<h2>Columns</h2>
|
|
<dl>
|
|
<dt>TID</dt>
|
|
<dd>The thread ID.</dd>
|
|
|
|
<dt>State</dt>
|
|
<dd>The state of the thread - Initialized, Ready, Running, Standby, Terminated, Transition, Unknown,
|
|
Wait.</dd>
|
|
|
|
<dt>CPU Time</dt>
|
|
<dd>The total CPU Time measured in Minutes:Seconds:Milliseconds.</dd>
|
|
|
|
<dt>Priority</dt>
|
|
<dd>The priority of the thread - Time Critical, Highest, Above Normal, Normal, Below Normal, Lowest,
|
|
Idle.</dd>
|
|
</dl>
|
|
|
|
<h2>Context Menu</h2>
|
|
<dl>
|
|
<dt>Terminate Thread(s)</dt>
|
|
<dd>Terminates the selected thread(s) using the <code>TerminateThread()</code> API function.</dd>
|
|
|
|
<dt>Suspend Thread(s)</dt>
|
|
<dd>Suspends the selected thread(s) using the <code>SuspendThread()</code> API function.</dd>
|
|
|
|
<dt>Resume Thread(s)</dt>
|
|
<dd>Resumes the selected thread(s) using the <code>ResumeThread()</code> API function.</dd>
|
|
|
|
<dt>Priority</dt>
|
|
<dd>Sets the priority of the thread. This option is not available when multiple threads are
|
|
selected.</dd>
|
|
|
|
<dt>Select All</dt>
|
|
<dd>Select all items in the list.</dd>
|
|
</dl>
|
|
|
|
<h1 id="modlist">Module List</h1>
|
|
<p>This list displays all modules loaded by the selected process. Unlike the process list or the
|
|
thread list, this list does not refresh automatically. To refresh the list, click the name of the
|
|
process in the process list again. To view the full file name of a module, hover the mouse over the
|
|
module name or use the <strong>Copy File Name</strong> context menu item. Double-clicking an item
|
|
in the list will switch to the <strong>Memory</strong> tab and select the associated memory
|
|
region.</p>
|
|
|
|
<p>Note that if the <em>System</em> process is selected, the module list will display a list
|
|
of drivers loaded by the kernel, as reported by <code>EnumDeviceDrivers()</code>. In this case,
|
|
only the <strong>Copy File Name</strong> and <strong>Properties...</strong> context menu items
|
|
will be available.</p>
|
|
|
|
<h2>Columns</h2>
|
|
<dl>
|
|
<dt>Name</dt>
|
|
<dd>The short file name of the module. The main module is displayed at the top in bold font.</dd>
|
|
|
|
<dt>Base Address</dt>
|
|
<dd>The address at which the module was loaded in memory.</dd>
|
|
|
|
<dt>Size</dt>
|
|
<dd>The size, in bytes, of the module in memory.</dd>
|
|
|
|
<dt>Description</dt>
|
|
<dd>The file description, taken from the version information of the file.</dd>
|
|
</dl>
|
|
|
|
<h2>Context Menu</h2>
|
|
<dl>
|
|
<dt>Copy File Name</dt>
|
|
<dd>Copies the full file name of the module to the clipboard.</dd>
|
|
|
|
<dt>Open Containing Folder</dt>
|
|
<dd>Opens Windows Explorer with the selected module's file highlighted.</dd>
|
|
|
|
<dt>Properties...</dt>
|
|
<dd>Displays a properties window similar to Windows Explorer's with the module's file.</dd>
|
|
|
|
<dt>Get Function Address.</dt>
|
|
<dd>Opens a small box in which you can type a function name to get its address in memory.
|
|
Note that if the module has not been loaded by Process Hacker, it will be loaded. After
|
|
calling <code>GetProcAddress()</code>, Process Hacker will unload the module.</dd>
|
|
|
|
<dt>Change Memory Protection...</dt>
|
|
<dd>Allows you to change the page protection of the module's memory region using the API
|
|
function <code>VirtualProtectEx()</code>. Note that if Data Execution Prevention (DEP) is
|
|
enabled on the machine, certain actions may trigger DEP to close the target process.</dd>
|
|
|
|
<dt>Read Memory...</dt>
|
|
<dd>Allows you to read the memory of the module using <code>ReadProcessMemory()</code>.</dd>
|
|
|
|
<dt>Go To In Memory View</dt>
|
|
<dd>Switches to the <strong>Memory</strong> tab and selects the memory region associated
|
|
with the module.</dd>
|
|
</dl>
|
|
|
|
<h1 id="memlist">Memory List</h1>
|
|
<p>This list displays the memory regions of the process using the API function
|
|
<code>VirtualQueryEx()</code>.</p>
|
|
|
|
<h2>Columns</h2>
|
|
<dl>
|
|
<dt>Address</dt>
|
|
<dd>The start of the memory region.</dd>
|
|
|
|
<dt>Size</dt>
|
|
<dd>The size of the memory region.</dd>
|
|
|
|
<dt>State</dt>
|
|
<dd>The state of the memory region - <br>
|
|
COMMIT - Indicates that physical storage has been allocated for the region,
|
|
either in memory or in the paging file.<br>
|
|
FREE - Indicates that the region is available to be allocated.<br>
|
|
RESERVE - Indicates that the region has been reserved but no physical storage
|
|
has been allocated for it.
|
|
</dd>
|
|
|
|
<dt>Type</dt>
|
|
<dd>The type of the memory region - <br>
|
|
IMAGE - Indicates that the region is mapped into an image (i.e. executable) section.<br>
|
|
MAPPED - Indicates that the region is mapped.<br>
|
|
PRIVATE - Indicates that the region is private (i.e. not shared with other processes).
|
|
</dd>
|
|
|
|
<dt>Protection</dt>
|
|
<dd>The protection of the memory region.</dd>
|
|
</dl>
|
|
|
|
<h2>Context Menu</h2>
|
|
<dl>
|
|
<dt>Change Memory Protection...</dt>
|
|
<dd>Uses the API function <code>VirtualProtectEx()</code> to change the page protection
|
|
of the memory region.</dd>
|
|
|
|
<dt>Read/Write Memory...</dt>
|
|
<dd>Uses the API functions <code>ReadProcessMemory()</code> and <code>WriteProcessMemory()</code>
|
|
to read/write data in the memory region. Note that certain actions may trigger DEP to
|
|
close the target process.</dd>
|
|
|
|
<dt>Read/Write Address...</dt>
|
|
<dd>
|
|
Allows you to enter an virtual memory address to edit. Process Hacker will find the appropriate
|
|
memory region and select the correct relative address. For example, if you want to edit memory at
|
|
<code>0x12345678</code> and the process has a memory region starting at <code>0x12345100</code>,
|
|
Process Hacker will open the <strong>Read/Write Memory</strong> box and select the relative address
|
|
<code>0x00000578</code>.
|
|
</dd>
|
|
</dl>
|
|
|
|
<h1 id="memsearch">Searching Memory</h1>
|
|
<p>Process Hacker supports searching using a literal string or regular expressions. To
|
|
perform a search, select the <strong>Process</strong> tab and select an option in the
|
|
combo box. Then click <strong>Search...</strong>. A window will appear in which you can
|
|
enter the data to search for. There are also checkboxes which control the memory
|
|
regions to search in. When <strong>OK</strong> is clicked, a Results Window will appear
|
|
with the search results.</p>
|
|
|
|
<dl>
|
|
<dt>Literal Search</dt>
|
|
<dd>Allows you to enter a sequence of bytes to search for.</dd>
|
|
|
|
<dt>Regex Search</dt>
|
|
<dd>Allows you to search using regular expressions.</dd>
|
|
|
|
<dt>String Scan</dt>
|
|
<dd>Scans for strings inside the process' memory.</dd>
|
|
|
|
<dt>Heap Scan</dt>
|
|
<dd>Displays a list of heap items.</dd>
|
|
</dl>
|
|
|
|
<p>In the <strong>Literal</strong> tab, there is a small button in the bottom-right
|
|
which allows you to insert data in various formats.</p>
|
|
|
|
<dl>
|
|
<dt>Insert Number</dt>
|
|
<dd>This allows you to insert numbers in various formats - 8 to 64-bit, little or big endian.</dd>
|
|
|
|
<dt>Insert String</dt>
|
|
<dd>Similarly, this allows you to insert strings in various encodings - ASCII, UTF-8 to UTF-32.
|
|
If a multiline item is selected, the prompt box will have a multiline textbox.</dd>
|
|
</dl>
|
|
|
|
<p>In the search results list, double-clicking an item will open the Memory Editor with
|
|
the search result highlighted.</p>
|
|
|
|
<h2>Sample Regex Searches</h2>
|
|
<p>All of these samples must have <strong>Ignore Case</strong> selected.</p>
|
|
|
|
<p>A valid filesystem character is <code>[ a-z0-9`~';!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]</code>
|
|
|
|
<dl>
|
|
<dt>Email address</dt>
|
|
<dd><code>[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.(au|biz|ca|com|info|net|org|uk|zh)</code></dd>
|
|
|
|
<dt>Path name</dt>
|
|
<dd><code>[A-Z]:\\([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*\\)*([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*)(\\)*</code></dd>
|
|
|
|
<dt>Executable file</dt>
|
|
<dd><code>([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}])+\.(bat|com|dll|exe)</code></dd>
|
|
|
|
<dt>URL</dt>
|
|
<dd>(file|ftp|http):///*[a-z0-9%\/ .\-_:\(\)\[\]]+</dd>
|
|
</dl>
|
|
|
|
<h1 id="results">Results Window</h1>
|
|
<p>The Results Window is displayed when searching for data, scanning for strings or
|
|
scanning for heaps. There are four buttons at the top of the window:</p>
|
|
|
|
<dl>
|
|
<dt>Refresh</dt>
|
|
<dd>This performs the search again.</dd>
|
|
|
|
<dt>Edit Search</dt>
|
|
<dd>This allows you to edit the search type and data associated with the Results Window.</dd>
|
|
|
|
<dt>Filter</dt>
|
|
<dd>This allows you to filter the search results, creating a new Results Window containing
|
|
the matching items. To filter using a numerical relation, enter the relation (for example,
|
|
greater than or equal to <code>>=</code>) followed by the number. If the filter
|
|
(<code>>=10</code>) is applied to the <strong>Length</strong> column, all items with a
|
|
length greater than or equal 10 will be displayed.</dd>
|
|
|
|
<dt>Intersect</dt>
|
|
<dd>This allows you to select another Results Window. It then creates a third Results Window
|
|
in which the search results present in both Results Windows are displayed. This allows you
|
|
to filter search results.</dd>
|
|
|
|
<dt>Save...</dt>
|
|
<dd>This allows you to save the search results to a text file.</dd>
|
|
</dl>
|
|
|
|
<h1 id="miscinfo">Misc. Information</h1>
|
|
<p>This tab currently displays other information not important enough to be in their own tabs.</p>
|
|
|
|
<h1 id="tips">Tips</h1>
|
|
<dl>
|
|
<dt>Terminating Processes</dt>
|
|
<dd>Almost all processes (including most Antivirus programs) can be terminated by setting the
|
|
page protection on their main module to PAGE_NOACCESS. This can be done by right-clicking
|
|
on the module in bold font and selecting <strong>Change Memory Protection...</strong>.
|
|
Type <code>0x1</code> and click <strong>Change</strong>. The process should crash within
|
|
a few seconds.</dd>
|
|
</dl>
|
|
</body>
|
|
</html>
|