Sysinternals Process Explorer for Mac
Sysinternals Process Explorer for Mac is a native macOS implementation of the core Process Explorer experience. It provides a live process tree, lower-pane module/handle/thread inspection, rich per-process properties, system-wide performance graphs, code-signing inspection, and macOS-specific equivalents for Process Explorer workflows.
The app is built with Swift, SwiftUI, and AppKit, with sampling backed by public macOS APIs such as libproc, sysctl, Mach host statistics, Security.framework, IOKit, Metal, and optional privileged helper support.
Features
- Live process tree with Process Explorer-style colors for services, own processes, new/deleted processes, suspended processes, sandboxed processes, and packed images.
- Frozen process-name pane with horizontally scrollable metric columns.
- Persisted process-list column widths, ordering, column sets, and selected columns.
- Type-to-select in process and lower-pane lists.
- Immediate tooltips for truncated cells and process path/command-line detail.
- Pause/resume refresh with the spacebar.
- Native menu bar with File, Options, View, Process, Find, Window, and Help commands.
- Toolbar actions for refresh, save, process properties, kill, lower pane, find handle/DLL, target-window picker, and System Information graphs.
- Lower pane modes for DLLs/images, handles/file descriptors, and threads.
- Lower-pane row highlighting for newly appeared and deleted items.
- Per-process Properties window with Image, Performance, Performance Graph, Threads, TCP/IP, Security, Environment, and Strings tabs.
- TCP/IP tab with local address, remote address, async reverse-DNS remote name lookup, TCP state, and column persistence.
- Security/signature detail with signer, publisher, certificate chain, Team ID, notarization status, platform/ad-hoc status, validation reason, SHA-256, and VirusTotal integration.
- Module/image detail windows with metadata, signature verification, VirusTotal, Reveal in Finder, and Search Online.
- Handle/file-descriptor detail windows.
- System Information window with Summary, CPU, Memory, I/O, Network, and GPU pages.
- System Information graphs for CPU, memory, swap, disk I/O, network I/O, GPU, and per-core CPU usage.
- Performance vs. efficiency core labeling and coloring on Apple Silicon.
- Hardware details for CPU topology/cache, memory/page information, storage, network interfaces, GPU device capabilities, and OS/machine data.
- Menu-bar CPU history item.
- Process actions: kill, kill tree, suspend/resume, set priority/nice, restart, bring to front, sample process, Search Online, Check VirusTotal.
- Optional privileged helper architecture for cross-user and privileged operations.
- Release scripts for DMG creation, signing, and notarization.
Requirements
- macOS 14 or later for the GUI app target.
- Xcode 26.6 or later recommended for the current project configuration.
- Swift 5.9 toolchain or later.
xcodegen for regenerating ProcexpMac.xcodeproj from project.yml.
Install xcodegen if needed:
brew install xcodegen
Build
Generate the Xcode project and build the Debug app:
xcodegen generate
xcodebuild -scheme ProcexpMac -configuration Debug build
The Debug app is written under Xcode DerivedData. On this machine the path is typically:
~/Library/Developer/Xcode/DerivedData/ProcexpMac-czqddcuyalgzfgebjezrhssregtw/Build/Products/Debug/ProcExp\ \(Dev\).app
You can also open the generated project in Xcode:
xcodegen generate
open ProcexpMac.xcodeproj
Run
After a Debug build, launch the app with:
open "$HOME/Library/Developer/Xcode/DerivedData/ProcexpMac-czqddcuyalgzfgebjezrhssregtw/Build/Products/Debug/ProcExp (Dev).app"
If your DerivedData suffix differs, locate the product with:
find ~/Library/Developer/Xcode/DerivedData -path '*/Build/Products/Debug/ProcExp (Dev).app' -print
To relaunch a freshly built app from this workspace:
app="$HOME/Library/Developer/Xcode/DerivedData/ProcexpMac-czqddcuyalgzfgebjezrhssregtw/Build/Products/Debug/ProcExp (Dev).app"
pids=$(pgrep -f "$app/Contents/MacOS/ProcexpMac" || true)
if [[ -n "$pids" ]]; then kill $pids 2>/dev/null || true; fi
open -n "$app"
Bundle identity: development vs. official
Unqualified Xcode and local ad-hoc builds use ProcExp (Dev).app with bundle
ID com.sysinternals.procexpmac.dev. Its helper uses the separate launchd and
Mach service ID com.sysinternals.procexpmac.dev.helper. The development app,
helper approval, preferences, and LaunchServices registration therefore do not
replace an installed official copy.
The official identities are reserved for an explicit Developer ID build or the
Azure release pipeline: ProcExp.app, com.sysinternals.procexpmac, and
com.sysinternals.procexpmac.helper. The build and signing scripts validate the
entire tuple before signing or publishing it.
Validate
Run the full Swift package test suite:
swift test
Run the live smoke test:
swift run ProcexpSmoke
Run focused test suites:
swift test --filter ProcexpModelTests
swift test --filter ProcexpNetworkTests
swift test --filter ProcexpSigningTests
TCP/IP Test Fixture
The repository includes a small stateful TCP fixture for testing the TCP/IP tab:
swift build --product ProcexpTcpFixture
.build/debug/ProcexpTcpFixture --duration 3600 --remote-host github.com --remote-port 22
The fixture opens a loopback listener, creates a loopback established connection, and optionally opens a DNS-resolved remote TCP connection. Select the fixture process in Process Explorer and open Properties > TCP/IP to inspect the sockets and remote-name resolution.
以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗
