Save Resource Handles with Process Explorer on Windows 8

Q

How to save resource handle information to a file with Process Explorer on Windows 8? I want to keep a copy of all resource handles of Firefox.

✍: FYIcenter.com

A

When you are viewing the DLL library dependency tree with Dependency Walker in Process Explorer, you can same the DLL dependency tree to file using these steps:

1.Right-mouse click on C:\fyicenter\ProcessExplorer\procexp.exe and use "Run as administrator" to start Process Explorer. You will all processes displayed in a tree structure.

2. Locate and select the Firefox process "firefox.exe".

3. Click menu "View > Show Lower Pane" to open the process details pane.

4. Click menu "View > Lower Pane View > Handles" to list resource handles only.

5. Click menu "File > Save as".

6. Locate folder and enter file name to save data to C:\fyicenter\process_explorer_handles_and_dll.txt.

7. Open the file in notepad. You will see something like:

Process CPU Private Bytes   Working Set PID Description Company Name
System Idle Process 92.75   0 K 24 K    0       
System  0.39    164 K   308 K   4       
 Interrupts 0.35    0 K 0 K n/a Hardware Interrupts and DPCs    
 smss.exe       328 K   44 K    308     
csrss.exe   < 0.01   1,748 K 720 K   428     
csrss.exe   0.30    4,408 K 60,488 K    484     
 conhost.exe        1,368 K 356 K   6608    Console Window Host 
wininit.exe     1,076 K 40 K    492     
winlogon.exe        2,652 K 1,312 K 544     
explorer.exe    0.14    141,972 K   72,068 K    5836    Windows Explorer    
 TpKnrres.exe   < 0.01   976 K   404 K   3400    Microphone volume control module    
 hkcmd.exe      1,736 K 1,036 K 2848    hkcmd Module    Intel Corporation
 igfxpers.exe       2,192 K 2,332 K 3632    persistence Module  Intel Corporation
 msseces.exe    0.03    6,148 K 1,396 K 3676    Microsoft Security Client User Interface    
 firefox.exe    0.46    590,156 K   157,012 K   5160    Firefox Mozilla Corporation
...
 
Process: firefox.exe Pid: 5160

Name    Description Company Name    Path
{1F1C33BF-CD49-43A8-9DD0-4D3A5BE20082}.2.ver0x0000000000000002.db           
    C:\ProgramData\Microsoft\Windows\Caches\{1F1C33BF-CD49-43A8-9DD0-4D3A5BE20082}...
...
~FontCache-FontFace.dat         
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\~FontCache-FontFace.dat
~FontCache-S-1-5-21-602162358-823518204-1417001333-44272.dat            
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\~FontCache-S-1-5-21-...
~FontCache-System.dat           
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\~FontCache-System.dat
actxprxy.dll    ActiveX Interface Marshaling Library        
    C:\Windows\System32\actxprxy.dll
advapi32.dll    Advanced Windows 32 Base API        
    C:\Windows\System32\advapi32.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll    ApiSet Stub DLL     
    C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
api-ms-win-downlevel-advapi32-l2-1-0.dll    ApiSet Stub DLL     
    C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
...
apisetschema.dll    ApiSet Schema DLL       C:\Windows\System32\apisetschema.dll
apphelp.dll Application Compatibility Client Library        
    C:\Windows\System32\apphelp.dll
arial.ttf           C:\Windows\Fonts\arial.ttf
arialbd.ttf         C:\Windows\Fonts\arialbd.ttf
arialbi.ttf         C:\Windows\Fonts\arialbi.ttf
ariali.ttf          C:\Windows\Fonts\ariali.ttf
atl.dll ATL Module for Windows XP (Unicode)     C:\Windows\System32\atl.dll
atl100.dll  ATL Module for Windows      
    C:\Program Files\Microsoft Office 15\root\office15\atl100.dll
ATL90.dll   ATL Module for Windows (Unicode)        
    C:\Windows\winsxs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729....
AudioSes.dll    Audio Session       C:\Windows\System32\AudioSes.dll
avrt.dll    Multimedia Realtime Runtime     C:\Windows\System32\avrt.dll
bcrypt.dll  Windows Cryptographic Primitives Library        
    C:\Windows\System32\bcrypt.dll
browsercomps.dll        Mozilla Foundation  
    C:\Program Files\Mozilla Firefox\browser\components\browsercomps.dll
C_936.NLS           C:\Windows\System32\C_936.NLS
C_949.NLS           C:\Windows\System32\C_949.NLS
cabinet.dll Microsoft® Cabinet File API     C:\Windows\System32\cabinet.dll
calibri.ttf         C:\Windows\Fonts\calibri.ttf
calibrib.ttf            C:\Windows\Fonts\calibrib.ttf
...
d2d1.dll    Microsoft D2D Library       C:\Windows\System32\d2d1.dll
d2d1.dll.mui    Microsoft D2D Library       C:\Windows\System32\en-US\d2d1.dll.mui
d3d10_1.dll Direct3D 10.1 Runtime       C:\Windows\System32\d3d10_1.dll
d3d10_1core.dll Direct3D 10.1 Runtime       C:\Windows\System32\d3d10_1core.dll
d3d11.dll   Direct3D 11 Runtime     C:\Windows\System32\d3d11.dll
d3d8thk.dll Microsoft Direct3D OS Thunk Layer       C:\Windows\System32\d3d8thk.dll
d3d9.dll    Direct3D 9 Runtime      C:\Windows\System32\d3d9.dll
d3dcompiler_47.dll  Direct3D HLSL Compiler for Redistribution       
    C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll
d3dx10_40.dll   Direct3D 10.1 Extensions        C:\Windows\System32\d3dx10_40.dll
davclnt.dll Web DAV Client DLL      C:\Windows\System32\davclnt.dll
davhlpr.dll DAV Helper DLL      C:\Windows\System32\davhlpr.dll
dbghelp.dll Windows Image Helper        C:\Windows\System32\dbghelp.dll
devobj.dll  Device Information Set DLL      C:\Windows\System32\devobj.dll
dhcpcsvc.dll    DHCP Client Service     C:\Windows\System32\dhcpcsvc.dll
dhcpcsvc6.dll   DHCPv6 Client       C:\Windows\System32\dhcpcsvc6.dll
dnsapi.dll  DNS Client API DLL      C:\Windows\System32\dnsapi.dll
...

 

Dependency Walker on Windows 8

Resource Handles in Process Explorer on Windows 8

Process Explorer on Windows 8

⇑⇑ Windows 8 Processes Tutorials

2016-12-30, 1587🔥, 0💬