|
| Copyright © 1998 Mark Russinovich |
| Last
Updated March 26, 1998 Version 1.2 |
| Introduction | Ever wondered which program has a particular
file or directory open? Now you can find out. HandleEx
is a GUI/device driver combination that together show you
information about which handles and DLLs processes have
opened or loaded. Its display consists of two
sub-windows. The top always shows a list of the currently
active processes, including the names of their owning
accounts, whereas the information displayed in the bottom
window depends on the mode that HandleEx is in: if
it is in handle mode you’ll see the handles that the
process selected in the top window has opened; if it is
in DLL mode you’ll see the DLLs that the process has
loaded. HandleEx also has a powerful search
capability that will quickly show you which processes
have particular handles opened or DLLs loaded. The unique capabilities of HandleEx make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way NT and applications work. You can also obtain equivalent command-line tools, Handle for Windows NT and ListDLLs. Version 1.2 has an improved user-interface, displays DLL file time-stamps, and has a save-to-file capability. HandleEx has been tested on NT 3.51 and NT 4.0. |
|
| Screen shot | Here is a screenshot of HandleEx displaying open handles. | |
| Installation | Simply run the HandleEx GUI
(NTHandleEx.exe). Note that it must be located on a
non-network drive and that you must have administrative
privilege to run HandleEx. When HandleEx is
started for the first time it will be in handle-mode.
Menus, hot-keys, or toolbar buttons can be used to
refresh the display or switch to DLL-mode. HandleEx will remember its window positions and the mode that it was in each time you exit it, and initialize with these settings when started again. |
|
| Handle Mode | When HandleEx
is in handle mode you’ll see the names of all the
named objects that a selected process has open. To see
all the process’ handles, both named and un-named,
select the “Show Unnamed Handles” menu item or
toolbar button. You can toggle this mode on and off
according to what you want to see. |
|
| DLL Mode | Select the “View DLLs” menu item or the equivalent toolbar button to switch to DLL mode. In this mode loaded DLLs are listed in the bottom window. To switch back to handle mode press the “ View DLLs” toolbar button or select the menu item again. | |
| Refresh | The F5 key or the “Refresh” menu item will cause HandleEx to rescan process, DLL and handle information. | |
| Searching | You can search for processes that have particular DLLs loaded or handles opened. The search dialog is activated with the search toolbar button or its menu item. Enter a substring in the edit box of the search dialog and select the “Search” button. If HandleEx is in handle mode it will search for opened handles that contain the substring, but if it is in DLL mode it will search for loaded DLLs that have the substring in their path name. In either case, all handles or DLLs are scanned, not just those of the currently selected process. | |
 |
||