Windows Exploratory Surgery With Process Hacker

Aerosol · January 14, 2015

What Is Process Hacker?

Process Hacker is a free, open source, graphical tool for managing 32-bit and 64-bit Microsoft

Windows processes, services, threads, memory, handles, modules, Security Access Tokens

(SATs) and network connections. It is a wonderful tool for analyzing and combating malware,

understanding low-level details of the Windows operating system, troubleshooting, and

experimenting with Windows in ways which Microsoft never intended.

Process Hacker is similar to the famous Sysinternals Process Explorer tool from Microsoft, but

open source and a bit more fun (http://www.microsoft.com/sysinternals). Now that Process

Explorer is the property of Microsoft Corporation, Process Explorer cannot be enhanced with

features which might be used to circumvent security restrictions or otherwise embarrass

Microsoft. There are also no legal hassles when redistributing Process Hacker or its source code

(no Microsoft lawyers = good thing). Examining the source code of Process Hacker is an

interesting way to learn more about Windows internals, and Process Hacker itself is an actively

maintained project.

Fortunately, if you prefer Process Explorer, almost all of this presentation applies to it as well.

So please feel free to use Process Hacker or Process Explorer as you wish. Both tools are great.

And if you have questions, don't forget about the discussion forums for Process Hacker

(Process Hacker Forums - Index page) and Sysinternals Process Explorer

Recommended Posts