Copyright: Copyright © 19981-2000  Mark Russinovich


NTHandle Help

HandleEx for Windows NT/2000

Copyright  1996-2000 Mark Russinovich

http://www.sysinternals.com

Introduction

HandleEx is a GUI/device driver combination that together show you information about which handles and DLLs processes have opened or loaded. Its display consists of two sub-windows. The top always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that HandleEx is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if it is in DLL mode you’ll see the DLLs that the process has loaded.  HandleEx also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.

The unique capabilities of HandleEx make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way NT and applications work.

You can obtain equivalent command-line tools, Handle and ListDLLs, at the Systems Internals Web site (http://www.sysinternals.com).

HandleEx  works on NT 4.0 and Windows 2000.

Starting  HandleEx

Simply run the HandleEx GUI (nthandleex.exe). Note that it must be located on a non-network drive and that you must have administrative privilege to run HandleEx. When HandleEx is started for the first time it will be in handle-mode. Menus, hot-keys, or toolbar buttons can be used to refresh the display or switch to DLL-mode.

HandleEx will remember its window positions and the mode that it was in each time you exit it, and initialize with these settings when started again.

Processes

Using toolbar buttons, menu commands, or by double-clicking on a process, you can obtain a properties dialog that displays additional information regarding the process. Right-clicking on a process displays a pop-up menu with entries for viewing the process’ properties or killing the process.

Handle Mode

When HandleEx is in handle mode you’ll see the names of all the named objects that a selected process has open. To see all the process’ handles, both named and un-named, select the “Show Unnamed Handles” menu item or toolbar button. You can toggle this mode on and off according to what you want to see.

DLL Mode

Select the “View DLLs” menu item or the equivalent toolbar button to switch to DLL mode. In this mode loaded DLLs are listed in the bottom window. If you double-click on a DLL, or press the properties toolbar button, HandleEx will present a properties dialog with detailed version information.

The “MM” column indicates whether the corresponding file has been memory-mapped rather than loaded as a module. This corresponds to an applications use of MapViewOfFile. If a file is memory-mapped the base and size columns indicate the virtual address range where the file has been mapped. If you are unable to delete a file and don’t find any handle references to it, the file may have been memory mapped, since WinNT/2K does not let memory mapped files be deleted or portions of a file that have been mapped be truncated.

Refresh

The F5 key or the “Refresh” menu item will cause HandleEx to rescan process, DLL and handle information.

Searching

You can search for processes that have particular DLLs loaded or handles opened. The search dialog is activated with the search toolbar button or its menu item. Enter a substring in the edit box of the search dialog and select the “Search” button. If HandleEx is in handle mode it will search for opened handles that contain the substring, but if it is in DLL mode it will search for loaded DLLs that have the substring in their path name. In either case, all handles or DLLs are scanned, not just those of the currently selected process.

Reporting Bugs and Feedback

If you encounter a problem while running HandleEx, please visit http://www.sysinternals.com to obtain the latest version. If you still have problems, please record all the information relevant to the problem. Determine if the problem is reproducible, and if so, how, and send this information to:

mark@sysinternals.com