Sysinternals Process Explorer for Mac

Sysinternals Process Explorer for Mac is a native macOS implementation of the core Process Explorer experience. It provides a live process tree, lower-pane module/handle/thread inspection, rich per-process properties, system-wide performance graphs, code-signing inspection, and macOS-specific equivalents for Process Explorer workflows.

The app is built with Swift, SwiftUI, and AppKit, with sampling backed by public macOS APIs such as libproc, sysctl, Mach host statistics, Security.framework, IOKit, Metal, and optional privileged helper support.

Features

• Live process tree with Process Explorer-style colors for services, own processes, new/deleted processes, suspended processes, sandboxed processes, and packed images.
• Frozen process-name pane with horizontally scrollable metric columns.
• Persisted process-list column widths, ordering, column sets, and selected columns.
• Type-to-select in process and lower-pane lists.
• Immediate tooltips for truncated cells and process path/command-line detail.
• Pause/resume refresh with the spacebar.
• Native menu bar with File, Options, View, Process, Find, Window, and Help commands.
• Toolbar actions for refresh, save, process properties, kill, lower pane, find handle/DLL, target-window picker, and System Information graphs.
• Lower pane modes for DLLs/images, handles/file descriptors, and threads.
• Lower-pane row highlighting for newly appeared and deleted items.
• Per-process Properties window with Image, Performance, Performance Graph, Threads, TCP/IP, Security, Environment, and Strings tabs.
• TCP/IP tab with local address, remote address, async reverse-DNS remote name lookup, TCP state, and column persistence.
• Security/signature detail with signer, publisher, certificate chain, Team ID, notarization status, platform/ad-hoc status, validation reason, SHA-256, and VirusTotal integration.
• Module/image detail windows with metadata, signature verification, VirusTotal, Reveal in Finder, and Search Online.
• Handle/file-descriptor detail windows.
• System Information window with Summary, CPU, Memory, I/O, Network, and GPU pages.
• System Information graphs for CPU, memory, swap, disk I/O, network I/O, GPU, and per-core CPU usage.
• Performance vs. efficiency core labeling and coloring on Apple Silicon.
• Hardware details for CPU topology/cache, memory/page information, storage, network interfaces, GPU device capabilities, and OS/machine data.
• Menu-bar CPU history item.
• Process actions: kill, kill tree, suspend/resume, set priority/nice, restart, bring to front, sample process, Search Online, Check VirusTotal.
• Optional privileged helper architecture for cross-user and privileged operations.
• Release scripts for DMG creation, signing, and notarization.

Requirements

• macOS 14 or later for the GUI app target.
• Xcode 26.6 or later recommended for the current project configuration.
• Swift 5.9 toolchain or later.
• xcodegen for regenerating ProcexpMac.xcodeproj from project.yml.

Install xcodegen if needed:

brew install xcodegen

Build

Generate the Xcode project and build the Debug app:

xcodegen generate
xcodebuild -scheme ProcexpMac -configuration Debug build

The Debug app is written under Xcode DerivedData. On this machine the path is typically:

~/Library/Developer/Xcode/DerivedData/ProcexpMac-czqddcuyalgzfgebjezrhssregtw/Build/Products/Debug/ProcExp\ \(Dev\).app

You can also open the generated project in Xcode:

xcodegen generate
open ProcexpMac.xcodeproj

Run

After a Debug build, launch the app with:

open "$HOME/Library/Developer/Xcode/DerivedData/ProcexpMac-czqddcuyalgzfgebjezrhssregtw/Build/Products/Debug/ProcExp (Dev).app"

If your DerivedData suffix differs, locate the product with:

find ~/Library/Developer/Xcode/DerivedData -path '*/Build/Products/Debug/ProcExp (Dev).app' -print

To relaunch a freshly built app from this workspace:

app="$HOME/Library/Developer/Xcode/DerivedData/ProcexpMac-czqddcuyalgzfgebjezrhssregtw/Build/Products/Debug/ProcExp (Dev).app"
pids=$(pgrep -f "$app/Contents/MacOS/ProcexpMac" || true)
if [[ -n "$pids" ]]; then kill $pids 2>/dev/null || true; fi
open -n "$app"

Bundle identity: development vs. official

Unqualified Xcode and local ad-hoc builds use ProcExp (Dev).app with bundle ID com.sysinternals.procexpmac.dev. Its helper uses the separate launchd and Mach service ID com.sysinternals.procexpmac.dev.helper. The development app, helper approval, preferences, and LaunchServices registration therefore do not replace an installed official copy.

The official identities are reserved for an explicit Developer ID build or the Azure release pipeline: ProcExp.app, com.sysinternals.procexpmac, and com.sysinternals.procexpmac.helper. The build and signing scripts validate the entire tuple before signing or publishing it.

Validate

Run the full Swift package test suite:

swift test

Run the live smoke test:

swift run ProcexpSmoke

Run focused test suites:

swift test --filter ProcexpModelTests
swift test --filter ProcexpNetworkTests
swift test --filter ProcexpSigningTests

TCP/IP Test Fixture

The repository includes a small stateful TCP fixture for testing the TCP/IP tab:

swift build --product ProcexpTcpFixture
.build/debug/ProcexpTcpFixture --duration 3600 --remote-host github.com --remote-port 22

The fixture opens a loopback listener, creates a loopback established connection, and optionally opens a DNS-resolved remote TCP connection. Select the fixture process in Process Explorer and open Properties > TCP/IP to inspect the sockets and remote-name resolution.

This is the beginning of the README. Read the rest at the original. Read the full README ↗