Process Hacker is a free and open source process viewer and memory editor with unique features such as powerful process termination. It can show services, processes and their threads, modules, handles and memory regions.
Key features of Process Hacker:
- A simple, customizable tree view with highlighting showing you the processes running on your computer.
- Detailed system statistics with graphs.
- Advanced features not found in other programs, such as detaching from debuggers, viewing GDI handles, viewing heaps, injecting and unloading DLLs, and more.
- Powerful process termination that bypasses security software and rootkits.
- View, edit and control services, including those not shown by the Services console.
- View and close network connections.
- Starts up almost instantly, unlike other programs.
- Many more features...
Compared with Process Explorer, Process Hacker:
- Implements almost all of the functionality offered by Process Explorer, plus more advanced features.
- Performs stack traces correctly for .NET programs on x64.
- Allows you to see what a thread is waiting on.
- Has advanced string scanning capabilities, as well as regular expression filtering.
- Highlights both relocated and .NET DLLs.
- Shows symbolic access masks (e.g. Read, Write), rather than just numbers (e.g. 0x12019f).
- Shows names for transaction manager objects and ETW registration objects.
- Shows detailed token information, as well as allowing privileges to be enabled and disabled.
Process Hacker 2.36 changes:
Highlights
- New rich pop-up UI when hovering the cursor over a tray icon, showing the most active processes
- Completely new Memory tab for processes, with heap, stack and working set usage
- Process Hacker now takes 32-bit dumps of 32-bit processes on 64-bit Windows
- NOTE: When using the portable (.zip) release, the entire archive must be extracted
- Updated DotNetTools plugin:
- Process Hacker now displays managed stack traces for 32-bit .NET processes on 64-bit Windows
- Fixed inaccurate stack traces when clicking Refresh
- Added AppDomain column for threads in .NET programs
Other changes
- Added customizable bytes per row setting for memory editor
- Dramatically faster handle listing and search when running without administrative privileges
- Improved accuracy and speed of symbol resolution, especially when new modules are loaded
- Added trigger and delayed start information to service list
- Added file information to service list tooltips
- Balloon tips for process/service notifications are now clickable
- Added handle names for unnamed File objects
- Added I/O Priority to tray icon process menu
- Added warning for users who attempt to start the 32-bit version on 64-bit Windows
- Updated ExtendedServices plugin:
- Added service protection and SID information
- Added auto-elevation when saving recovery information, triggers and other service settings
- Updated ExtendedTools plugin:
- Added tray icon mini info window support
- Improved automatic GPU node selection
- Updated UserNotes plugin:
- Added tray icon mini info window support
- Fixed a bug in phsvc that caused hangs when automatically elevating actions
- Fixed hang when viewing handle security for certain File objects
- Fixed lack of information on startup when using slower refresh intervals
- Fixed Read/Write Address crash
- Fixed service non-polling mode on Windows 8 and above
- Fixed file dialog crash in Windows PE environments
- Fixed string scanning false positive case
- Fixed process window detection for Modern UI apps
- Fixed handle list selection bug when disabling "Hide unnamed handles"
Note: This release has significant internal code changes. Please make sure all plugins are up-to-date.
Download: Process Hacker 2.36 | 1.9 MB (Open Source)
Download: Portable Process Hacker 2.36 | 2.8 MB
Links: Process Hacker Home Page | Support