March 1, 2021
Hot Topics:

Snooping Around

  • By Mike Gunderloy
  • Send Email »
  • More Articles »

Windows, at this point, is fiendishly complex. But much of this complexity is exposed for you to inspect, if you know how to look for it. Because they depend on well-defined APIs and program structures, Windows applications (and Windows itself, for that matter) are relatively easy to poke around in. Here are half a dozen free tools that you can use to help you find out what's going on, whether in your own code or programs produced by other people.

Process Explorer

Process Explorer is one of the many useful freeware utilities supplied by SysInternals. One way to think of Process Explorer is that it's what Task Manager could have been if Microsoft had spent any time on improving Task Manager over the past few years.

Click here for a larger image.

Process Explorer starts out by presenting a list of all the processes running on your computer. You might well be surprised at how many there are, once you take into account all of the startup applications and hidden windows that keep your system smoothly moving along. You can see the process ID, owning user, amount of CPU being used, and so on. The context menu lets you kill a process, suspend it, or alter its priority. You can also see other details, such as the number of assemblies and classes that a .NET process has loaded; the list of columns here is long and configurable.

The lower pane of Process Explorer toggles between two different views. In DLL view, shown in the figure, you can see what libraries the process has loaded. In handle view, you cand see which Windows resources (such as threads and events) the application is using.

Perhaps the best part of Process Explorer is its ability to search across all running processes. Ever wondered which application is holding a DLL in memory, forcing you to reboot to replace that DLL? Or been frustrated by not being able to delete a file, because some application is hanging on to it, and not knowing what application is the culprit? Process Explorer can answer these questions easily, and let you delete the offending handle as well.


One of the key facts about .NET applications is that you can use reflection to look inside of them and discover details about their code (there's a whole industry of obfuscators springing up in response to make your code more confusing). The .NET SDK includes the ILDASM utility to get you started, but if you're really interested in the internals of .NET applications, you'll want to download Lutz Roeder's Reflector instead.

Click here for a larger image.

Reflector lets you easily drill into the structure of a .NET application. You can see all the assemblies, namespaces, types, and members that it contains. Once you've located something that interests you, you can inspect the lower pane of Reflector to see its declaration (switching between C#, VB .NET, and Delphi syntax as you choose), or use the right pane to disassemble it into MSIL (the low-level language shared by all of .NET) or to decompile it into C# code. You can also get a call tree showing other members called by the current method.

Because the .NET Framework is itself .NET code, one great use of Reflector is to understand what's going on in the Framework. If you want to know what causes a particular Framework method to throw an exception, or to see what other objects and methods it uses, Reflector will show you all the information quickly. This is great when you don't understand why a particular call is failing, or when you want to make sure that your own code is consistent with the .NET way of doing things.

Developer Playground

Developer Playground goes one step beyond showing you the processes running on your computer, and actually lets you see which functions they're running as you execute them.

Click here for a larger image.

Page 1 of 2

This article was originally published on November 12, 2003

Enterprise Development Update

Don't miss an article. Subscribe to our newsletter below.

Thanks for your registration, follow us on our social networks to keep up-to-date