Windows sysinternals

Chapter 3 Process Explorer 73
when loaded into memory. Memory strings might also include dynamically constructed data
areas of the image’s memory range.
Note In computer programming, the term “string” refers to a data structure consisting of a
s equence of characters, usually representing human-readable text.
FIGURE 3-22 The Strings tab of the DLL Properties dialog box.
Click the Save button to save the displayed strings to a text file. To compare image and
memory strings, save the image and memory strings to separate files and then identify the
differences with a text-comparison utility.
To search for specific text in the strings list, click the Find button to display the standard Find
dialog box. To search for additional occurrences of the same text, simply press F3 or click
Find and Find Next again—the search continues from the currently selected row.
Handle View
Procexp’s Handle view lists the object handles belonging to the process selected in the upper
pane, as shown in Figure 3-23. Object handles are what programs use to manipulate system
objects managed by kernel-mode code, such as files, registry keys, synchronization objects,
memory sections, window stations, and desktops. Even though disparate types of resources
are involved, all kernel object types use this consistent mechanism for managing access.
www.it-ebooks.info