HandleEx Logo
Copyright © 1998 Mark Russinovich
Last Updated March 26, 1998 Version 1.2
Introduction Ever wondered which program has a particular file or directory open? Now you can find out. HandleEx is a GUI/device driver combination that together show you information about which handles and DLLs processes have opened or loaded. Its display consists of two sub-windows. The top always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that HandleEx is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if it is in DLL mode you’ll see the DLLs that the process has loaded. HandleEx also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.

The unique capabilities of HandleEx make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way NT and applications work. You can also obtain equivalent command-line tools,
Handle for Windows NT and ListDLLs.

Version 1.2 has an improved user-interface, displays DLL file time-stamps, and has a save-to-file capability.

HandleEx has been tested on NT 3.51 and NT 4.0.
Screen shot Here is a screenshot of HandleEx displaying open handles.
Installation Simply run the HandleEx GUI (NTHandleEx.exe). Note that it must be located on a non-network drive and that you must have administrative privilege to run HandleEx. When HandleEx is started for the first time it will be in handle-mode. Menus, hot-keys, or toolbar buttons can be used to refresh the display or switch to DLL-mode.

HandleEx will remember its window positions and the mode that it was in each time you exit it, and initialize with these settings when started again.
Handle Mode When HandleEx is in handle mode you’ll see the names of all the named objects that a selected process has open. To see all the process’ handles, both named and un-named, select the “Show Unnamed Handles” menu item or toolbar button. You can toggle this mode on and off according to what you want to see.
DLL Mode Select the “View DLLs” menu item or the equivalent toolbar button to switch to DLL mode. In this mode loaded DLLs are listed in the bottom window. To switch back to handle mode press the “ View DLLs” toolbar button or select the menu item again.
Refresh The F5 key or the “Refresh” menu item will cause HandleEx to rescan process, DLL and handle information.
Searching You can search for processes that have particular DLLs loaded or handles opened. The search dialog is activated with the search toolbar button or its menu item. Enter a substring in the edit box of the search dialog and select the “Search” button. If HandleEx is in handle mode it will search for opened handles that contain the substring, but if it is in DLL mode it will search for loaded DLLs that have the substring in their path name. In either case, all handles or DLLs are scanned, not just those of the currently selected process.
     

Download HandleEx (36KB)