Process Hacker is a powerful free and open source process viewer.

## Getting started

Simply run ProcessHacker.exe to start Process Hacker. There are two

versions, 32-bit (x86) and 64-bit (x64). If you are not sure which
version to use, open Control Panel > System and check the "System
type". You cannot run the 32-bit version of Process Hacker on a
64-bit system and expect it to work correctly, unlike other programs.

## System requirements

Windows XP SP2 or higher, 32-bit or 64-bit.

== Process Hacker ==
Process Hacker is licensed under the GNU GPL v3, with exceptions. A full
copy of the license is provided in LICENSE.txt.

Copyright (C) 2009-2016 wj32 and various authors

This program is free software: you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,

but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.

== Mini-XML ==
Process Hacker uses Mini-XML licensed under the following terms:

The Mini-XML library and included programs are provided under the
terms of the GNU Library General Public License (LGPL) with the
following exceptions:

1. Static linking of applications to the Mini-XML library

does not constitute a derivative work and does not require
the author to provide source code for the application, use
the shared Mini-XML libraries, or link their applications
against a user-supplied version of Mini-XML.

If you link the application to a modified version of

Mini-XML, then the changes to Mini-XML must be provided
under the terms of the LGPL in sections 1, 2, and 4.

2. You do not have to provide a copy of the Mini-XML license

with programs that are linked to the Mini-XML library, nor
do you have to identify the Mini-XML license in your
program or documentation as required by section 6 of the
LGPL.

== PCRE ==
Process Hacker uses Perl-Compatible Regular Expressions licensed under the
following terms:
 PCRE is a library of functions to support regular expressions whose syntax
and semantics are as close as possible to those of the Perl 5 language.

Release 8 of PCRE is distributed under the terms of the "BSD" licence, as

specified below.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:

* Redistributions of source code must retain the above copyright notice,

this list of conditions and the following disclaimer.

* Redistributions in binary form must reproduce the above copyright

notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.

* Neither the name of the University of Cambridge nor the name of Google
Inc. nor the names of their contributors may be used to endorse or
promote products derived from this software without specific prior
written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

== MD5 ==
Process Hacker uses a MD5 implementation licensed under the following terms:

MD5 hash implementation and interface functions

Copyright (c) 2003-2005, Jouni Malinen <jkmaline@cc.hut.fi>

This program is free software; you can redistribute it and/or modify

it under the terms of the GNU General Public License version 2 as
published by the Free Software Foundation.

== SHA ==
Process Hacker uses a SHA implementation licensed under the following terms:

Copyright 2004 Filip Navara

Based on public domain SHA code by Steve Reid <steve@edmweb.com>

This library is free software; you can redistribute it and/or

modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful,

but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
 You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA

== Natural order string comparison ==

Process Hacker uses "strnatcmp.c" licensed under the following terms:

strnatcmp.c -- Perform 'natural order' comparisons of strings in C.

Copyright (C) 2000, 2004 by Martin Pool <mbp sourcefrog net>

This software is provided 'as-is', without any express or implied

warranty. In no event will the authors be held liable for any damages
arising from the use of this software.

Permission is granted to anyone to use this software for any purpose,

including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not
claim that you wrote the original software. If you use this software
in a product, an acknowledgment in the product documentation would be
appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.

This code has been modified for Process Hacker.

## Settings

If you are running Process Hacker from a USB drive, you may want to
save Process Hacker's settings there as well. To do this, create a
blank file named "ProcessHacker.exe.settings.xml" in the same
directory as ProcessHacker.exe. You can do this using Windows Explorer:

1. Make sure "Hide extensions for known file types" is unticked in

Tools > Folder options > View.
2. Right-click in the folder and choose New > Text Document.
3. Rename the file to ProcessHacker.exe.settings.xml (delete the ".txt"
extension).

## Plugins

Plugins can be configured from Hacker > Plugins.

If you experience any crashes involving plugins, make sure they

are up to date.

The ExtendedTools plugin is only available for Windows Vista and

above. Disk and Network information provided by this plugin is
only available when running Process Hacker with administrative
rights.

## KProcessHacker

Process Hacker uses a kernel-mode driver, KProcessHacker, to

assist with certain functionality. This includes:
* Capturing kernel-mode stack traces
* More efficiently enumerating process handles
* Retrieving names for file handles
* Retrieving names for EtwRegistration objects
* Setting handle attributes

KProcessHacker is only available on Windows 7 and above.

Note that by default, KProcessHacker only allows connections from

processes with SeDebugPrivilege. To allow Process Hacker to show details
for all processes when it is not running as administrator:

1. In Registry Editor, navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KProcessHacker3
2. Under this key, create a key named Parameters if it does not exist.
3. Create a DWORD value named SecurityLevel and set it to 2. If you are
not using an official build, you may need to set it to 0 instead.
4. Restart the KProcessHacker3 service (sc stop KProcessHacker3,
sc start KProcessHacker3).