You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
73 lines
2.7 KiB
73 lines
2.7 KiB
Process Hacker is a powerful free and open source process viewer.
|
|
|
|
== Getting started ==
|
|
|
|
Simply run ProcessHacker.exe to start Process Hacker. There are two
|
|
versions, 32-bit (x86) and 64-bit (x64). If you are not sure which
|
|
version to use, open Control Panel > System and check the "System
|
|
type". You cannot run the 32-bit version of Process Hacker on a
|
|
64-bit system and expect it to work correctly, unlike other programs.
|
|
|
|
== System requirements ==
|
|
|
|
Windows XP SP2 or higher, 32-bit or 64-bit.
|
|
|
|
== Settings ==
|
|
|
|
If you are running Process Hacker from a USB drive, you may want to
|
|
save Process Hacker's settings there as well. To do this, create a
|
|
blank file named "ProcessHacker.exe.settings.xml" in the same
|
|
directory as ProcessHacker.exe. You can do this using Windows Explorer:
|
|
|
|
1. Make sure "Hide extensions for known file types" is unticked in
|
|
Tools > Folder options > View.
|
|
2. Right-click in the folder and choose New > Text Document.
|
|
3. Rename the file to ProcessHacker.exe.settings.xml (delete the ".txt"
|
|
extension).
|
|
|
|
== Plugins ==
|
|
|
|
Plugins can be configured from Hacker > Plugins.
|
|
|
|
If you experience any crashes involving plugins, make sure they
|
|
are up to date.
|
|
|
|
The ExtendedTools plugin is only available for Windows Vista and
|
|
above. Disk and Network information provided by this plugin is
|
|
only available when running Process Hacker with administrative
|
|
rights.
|
|
|
|
== KProcessHacker ==
|
|
|
|
NOTE: The driver has been very generously signed by the
|
|
ReactOS Foundation (http://www.reactos.org).
|
|
|
|
Process Hacker uses a kernel-mode driver, KProcessHacker, to
|
|
assist with certain functionality. This includes:
|
|
|
|
* Bypassing security software and rootkits in limited ways
|
|
* More powerful process and thread termination (*)
|
|
* Setting DEP status of processes
|
|
* Capturing kernel-mode stack traces
|
|
* More efficiently enumerating process handles
|
|
* Retrieving names for file handles
|
|
* Retrieving names for EtwRegistration objects
|
|
* Setting handle attributes
|
|
|
|
The feature(s) marked with an asterisk (*) are NOT available on 64-bit
|
|
versions of Windows.
|
|
|
|
Certain features such as modifying process protection are disabled
|
|
in the released driver binary due to legal reasons. You can enable
|
|
them by building KProcessHacker with the "dirty" configuration.
|
|
|
|
Note that by default, KProcessHacker only allows connections from
|
|
processes with SeDebugPrivilege. To allow Process Hacker to show details
|
|
for all processes when it is not running as administrator:
|
|
|
|
1. In Registry Editor, navigate to:
|
|
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KProcessHacker2
|
|
2. Under this key, create a key named Parameters if it does not exist.
|
|
3. Create a DWORD value named SecurityLevel and set it to 0.
|
|
4. Restart the KProcessHacker2 service (sc stop KProcessHacker2,
|
|
sc start KProcessHacker2).
|