| |
| Copyright © 1998-1999 Mark Russinovich |
| Last Updated February 8,
1999 Version 2.01 |
| Introduction | Ever wondered which
program has a particular file or directory open? Now you can find out.
HandleEx is a GUI/device driver combination that together show you
information about which handles and DLLs processes have opened or loaded. Its
display consists of two sub-windows. The top always shows a list of the
currently active processes, including the names of their owning accounts,
whereas the information displayed in the bottom window depends on the mode that
HandleEx is in: if it is in handle mode you’ll see the handles that
the process selected in the top window has opened; if it is in DLL mode
you’ll see the DLLs that the process has loaded. HandleEx also has
a powerful search capability that will quickly show you which processes have
particular handles opened or DLLs loaded. The unique capabilities of HandleEx make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way NT and applications work. You can also obtain equivalent command-line tools, Handle for Windows NT and ListDLLs. Version 2.0 has the following enhancements over previous versions:
HandleEx works on NT 3.51, NT 4.0 and NT 5 (Win2K) Beta 2. |
|
| Screen shot | Here is a screenshot of HandleEx displaying open handles. | |
| Installation | Simply run the
HandleEx GUI (HandleEx.exe). Note that it must be located on a
non-network drive and that you must have administrative privilege to run
HandleEx. When HandleEx is started for the first time it will be
in handle-mode. Menus, hot-keys, or toolbar buttons can be used to refresh the
display or switch to DLL-mode. HandleEx will remember its window positions and the mode that it was in each time you exit it, and initialize with these settings when started again. |
|
| Processses | If you right-click on a process HandleEx will pop-up a context-menu that will let you view additional CPU and memory-related properties of the process, or immediately terminate the process. Alternately, you can use toolbar buttons or menu entries to accomplish the same tasks. If you choose to kill a process HandleEx terminates the process with no additional prompting. | |
| Handle Mode | When HandleEx is in handle
mode you’ll see the names of all the named objects that a selected process
has open. To see all the process’ handles, both named and un-named, select
the “Show Unnamed Handles” menu item or toolbar button. You can
toggle this mode on and off according to what you want to see. Processes and threads are treated as named objects, so you will be shown the process name and, in parenthesis, the process identifier of processes referenced by handles. For thread handles you will be shown the corresponding thread's process name and ID, as well as the thread's ID. |
|
| DLL Mode | Select the “View DLLs” menu item or the equivalent toolbar button to switch to DLL mode. In this mode loaded DLLs are listed in the bottom window. . If you double-click on a DLL, or press the properties toolbar button, HandleEx will present a properties dialog with detailed version information. | |
| Refresh | The F5 key or the “Refresh” menu item will cause HandleEx to rescan process, DLL and handle information. | |
| Searching | You can search for processes that have particular DLLs loaded or handles opened. The search dialog is activated with the search toolbar button or its menu item. Enter a substring in the edit box of the search dialog and select the “Search” button. If HandleEx is in handle mode it will search for opened handles that contain the substring, but if it is in DLL mode it will search for loaded DLLs that have the substring in their path name. In either case, all handles or DLLs are scanned, not just those of the currently selected process. | |
 |
||