Overview

Process Explorer

Copyright © 1996-2003 Mark Russinovich

Sysinternals - www.sysinternals.com

Process Explorer is an advanced process management utility that picks up where Task Manager leaves off. It will show you detailed information about a process including its icon, command-line, full image path, memory statistics, user account, security attributes, and more. When you zoom in on a particular process you can list the DLLs it has loaded or the operating system resource handles it has open. A search capability enables you to track down a process that has a resource opened, such as a file, directory or Registry key, or to view the list of processes that have a DLL loaded.

The Process Explorer display consists of two sub-windows. The top always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you will see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you will see the DLLs and memory-mapped files that the process has loaded.

Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded. The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.

You can obtain equivalent command-line tools, Handle and ListDLLs, at the Sysinternals Web site.

Process Explorer works on Windows 9x/Me, Windows NT 4.0, Windows 2000, Windows XP, and Server 2003.

License

Process Explorer may not be redistributed in any way, or by any means, without the prior written permission of Sysinternals LLC. If you wish to redistribute Process Explorer, for example for use within an organization, please contact licensing@sysinternals.com.


The Main Window

Views

The Process Explorer window shows by default two panes: the upper pane is always a process list and the bottom either shows the list of DLLs loaded into the process selected in the upper pane, or the list of operating system resource handles (files, Registry keys, synchronization objects) the process has open; the view mode determines which information is shown in the bottom pane. To switch the view, use the View|Lower Pane View menu item, the corresponding toolbar button (which toggles), or the Ctrl+D (DLL view) and Ctrl-H (handle view) accelerator keys.

If you are interested only in seeing the processes running on your system You can hide the lower pane by selecting View|Hide Lower Pane, the corresponding toolbar button, the Ctrl+L accelerator, or by dragging the pane divider to the bottom of the Process Explorer window. You can bring back the lower pane by selecting View|Show Lower Pane, typing Ctrl+L or selecting the toolbar button again.

Column Selection

The information Process Explorer displays in its main window is fully configurable. You can reorder columns by dragging them to their new position. To select which columns of data you want visible, choose View|Select Columns or right-click on a column header and use Select Columns from the resulting context menu. A column selection editor opens that let's you pick the columns you want to enable for the Process, DLL and handle panes.

Refresh Rate and Difference Highlighting

Configure the rate at which Process Explorer refreshes its window by using the View|Update Speed menu item. You can refresh the view manually at any time with View|Refresh, the refresh toolbar button, or by pressing F5.

Process Explorer uses difference highlighting to help you see what items change between refreshes. Items, including processes, DLLs, and handles, that exit or are closed show in red and new items show in green. If the refresh rate is not paused the highlighting remains in effect for approximately 4 seconds. If you pause the display the difference highlighting is in effect only until the next time you manually refresh.

Saving

When you choose File|Save Process Explorer saves the contents of the Process and lower pane, if it is showing, as a tab-delimited text file.


The Process View

Sorting and the Process Tree

By default Process Explorer sorts processes into the system process tree. The process tree reflects the parent-child relationship between processes where child processes are shown directly beneath their parent and right-indented. Processes that are left-justified are orphans; their parent has exited. To change the sort order simply click on a the column by which you wish to sort. To return the sort to the process tree select View|Show Process Tree or click the process tree toolbar button.


Options

Several items in the Options menu affect the way processes display:

Show Fractional CPU: when this option is selected Process Explorer shows CPU usage to two decimal places. This can be useful to identify processes that would otherwise appear idle, but that are performing background processing.

Highlight Services: on Windows NT and higher this option has Process Explorer show processes that are running Win32 services in a rose color. The Services tab of the process properties dialog shows the list of services running within a process.

Highlight Jobs: on Windows 2000 and higher choose this option to have Process Explorer show processes that are part of a Win32 Job in orange. Jobs group processes together so that they can be managed as a single item and are used by the Runas command, for example. Use the Job tab of the process properties dialog to see the list of processes running in the same job as the selected process and to see job limits that have been applied to the job.

Highlight Own Processes: on Windows NT and higher checking this option results in Process Explorer showing in blue the processes that are running in the same user account as Process Explorer.


The Process Context Menu

When you have a process selected the items in the Process menu become active. You can access the same menu items by right-clicking on a process. The items enable you to do the following:

Set Priority: you can change the base priority of a process with this submenu. When you change the base priority of a process the system adjusts the priorities of threads within the process so that they remain at the same relative priority with respect to the new base priority.

Suspend: if you want a process to become temporarily inactive, so that a system resource such as network, CPU or disk, becomes available for other processes, you can suspend the process. Suspended processes show in a dark grey color. To resume a suspended process chose the Resume item from the process context menu.

Debug: choosing this menu item launches the debugger registered in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug with the selected process as the command-line argument.

Launch Depends: if Process Explorer finds the Dependency Walker tool (see http://www.dependencywalker.com) with the selected process as the argument. The Dependency Walker tool shows static DLL dependencies.

Kill: this item terminates a process with the Terminate Process API. Note that a process terminated in this way is not warned of its termination and therefore does not write unsaved data it may have.

Kill Process Tree: if the process pane is in the process tree sorting mode this menu item is available and allows you to kill a process and all of its descendants.

Properties: this selection opens a property dialog that shows you more information about a process.


Process Properties

You can view additional details for a process by double-clicking on it, or by selecting it and using the Process|Properties menu item or the properties toolbar button. On Windows 9x systems the dialog shows version information for the process image, the full path of the process image file, and the command-line used to launch the process. On Windows NT and higher there are several tabs in the dialog:

Image: this page shows version information extracted from the process' image file, the full path of the image file and the command-line that launched the process. It also shows the current directory of the process, the user account in which the process is running, the name of the process' parent process, and the time at which the process started execution.

Performance: memory and CPU performance data displays on this page, including physical and virtual memory, and CPU usage. The data refreshes at the same interval that the main display does.

Threads: the list of the threads running in the process shows on this tab. All data on this page refreshes at the same rate as the main display. The thread list shows start address information that's provided by the Windows symbol engine. If you want to see accurate names for start addresses download the Debugging Tools for Windows package from Microsoft's web site and install it in its default directory. Configure your system to use the Microsoft symbol server by defining the environment variable _NT_SYMBOL_PATH as follows:

srv*c:\symbols*http://msdl.microsoft.com/download/symbols

The Module button on the threads page launches Explorer's file properties dialog box for the image file that contains the start address of the currently selected thread. The Stack button shows the current stack of the selected thread. Stack information is unreliable unless symbol files are available for process and DLLs referenced in the stack.

Security: Process Explorer reports the list of groups and privileges listed in the security token of the process on this page. Privileges shown in grey are disabled.

Job: this tab is present only for processes that are part of a Win32 Job. The Job page shows the list of processes that are part of the same job and the limits that are applied to the job.

Services: this tab is present only for processes that are executing Win32 services, and lists the services running within the process. Process Explorer shows a service's name and display name, and on Windows 2000 and higher, if available, the service's description.

Environment: the environment variables associated with the process show on this page.


The DLL View

The DLL Context Menu

The DLL view shows the image file, DLLs, and data files mapped into the address space of the selected process. When you click the properties toolbar button or select Properties from the DLL menu Process Explorer launches the Explorer properties dialog for the selected DLL or mapped file. If you have the Dependency Walker tool (see http://www.dependencywalker.com) the DLL menu has a Launch Depends menu item that starts Depends with the selected DLL as a command-line argument.

Highlight Relocated DLLs

When you select the Highlight Relocated DLLs entry in the Options menu any DLLs that are not loaded at their programmed base address show in yellow. DLLs that cannot load at their base address because other files are already mapped there are relocated by the loader, which consumes CPU and makes parts of the DLL that are modified as part of the relocation un-sharable.


The Handle View

The Handle Context Menu

Two items appear under the Handle menu or when you right-click to show the Handle context menu:

Close Handle: choose this item to force closed a handle. Use this at your own risk: because the process that owns the handle is not aware that its handle has been closed, using this feature can lead to a crash of the application or data corruption; closing a handle in the System process can lead to a system crash.

Properties: when you select this item Process Explorer opens a handle properties dialog that shows you the total number of handles open to the object, as well as kernel references to the object. It also shows information specific to the type of object you are viewing. For example, when you view the properties of a mutant object Process Explorer reports whether or not the mutant is held, and if so, by which thread.

The Security tab on the handle properties dialog shows the security that's applied to the object the handle references.

Show Unnamed Handles

By default, Process Explorer shows only handles to object that have names. Select the Show Unnamed Handles item under the Options menu to have Process Explorer list all the handles opened by a selected process, even those to objects that are nameless. Note that Process Explorer consumes significantly more CPU resource when this option is selected.


Searching

One of the common problems Process Explorer solves with ease is the question: what process has this file or directory open? The search dialog, which you open with the Search toolbar button, by typing Ctrl+F, or by choosing Find under the Search menu, performs a case-insensitive substring search of all of the handles opened or DLLs loaded (depending on the view currently selected for the lower pane) on the system with the text you enter. Thus, to search for the process or processes that have c:\directory\somefile.txt open first make sure Process Explorer's lower pane is in handle mode and then enter enough text to make the search find only the results you are interested in e.g. "somefile".

The search dialog populates with the list of results indexed by process. Select a line in the results to have Process Explorer select the reported process and DLL or handle, and double-click on a line to have it do the same and dismiss the Search dialog.

Note that searching works even when the lower pane is not visible.


Reporting Bugs

If you encounter a bug while using Process Explorer please send e-mail to mark@sysinternals.com with the following information:

  • Operating system version

  • Process Explorer version

  • Description of the behavior you expect versus the behavior you observe

  • Detailed steps for reproducing the problem