Glonce

Sysinternals Process Explorer for Mac appears on GitHub as a native macOS app

toolsThe Glonce editorsHacker News🔥54Glonce rating54Impact42Novelty50Relevance70Surprise40Players60Credibility90
Sysinternals Process Explorer for Mac appears on GitHub as a native macOS app

The repository github.com/microsoft/Procexp-Mac presents Sysinternals Process Explorer for Mac, which its README describes as a native macOS implementation of the core Process Explorer experience. The README itself does not name Microsoft or any author; the organisation shows only in the repository address.

The app offers a live process tree, lower-pane inspection of modules, handles and threads, per-process properties, system-wide performance graphs, code-signing inspection, and macOS-specific equivalents for Process Explorer workflows. It is written in Swift, SwiftUI and AppKit. Sampling relies on public macOS APIs: libproc, sysctl, Mach host statistics, Security.framework, IOKit and Metal, plus optional privileged helper support.

The feature list is long. The process tree uses Process Explorer-style colours for services, own processes, new and deleted processes, suspended processes, sandboxed processes and packed images. The process-name pane stays frozen while metric columns scroll horizontally, and column widths, order and sets are remembered between sessions. Lists support type-to-select, truncated cells get immediate tooltips with path and command-line detail, and the spacebar pauses or resumes refresh. There is a native menu bar (File, Options, View, Process, Find, Window, Help) and a toolbar for refresh, save, process properties, kill, the lower pane, find handle/DLL, a target-window picker and System Information graphs.

The lower pane switches between DLLs/images, handles/file descriptors and threads, and highlights rows that have just appeared or been deleted. The per-process Properties window has eight tabs: Image, Performance, Performance Graph, Threads, TCP/IP, Security, Environment and Strings. The TCP/IP tab shows local and remote addresses, asynchronous reverse-DNS lookup of the remote name, and TCP state. The Security view covers signer, publisher, certificate chain, Team ID, notarization status, platform or ad-hoc status, validation reason, SHA-256 and VirusTotal integration. Module and image windows add metadata, signature verification, VirusTotal, Reveal in Finder and Search Online.

A System Information window has Summary, CPU, Memory, I/O, Network and GPU pages, with graphs for CPU, memory, swap, disk I/O, network I/O, GPU and per-core CPU usage. On Apple Silicon, performance and efficiency cores are labelled and coloured. Hardware details cover CPU topology and cache, memory and page information, storage, network interfaces, GPU capabilities and OS and machine data. A menu-bar item shows CPU history. Process actions are kill, kill tree, suspend/resume, set priority/nice, restart, bring to front, sample process, Search Online and Check VirusTotal.

To build it you need macOS 14 or later for the GUI target, a Swift 5.9 toolchain or later, and xcodegen, which regenerates the Xcode project from project.yml. Xcode 26.6 or later is recommended for the current project configuration. The README gives the steps: install xcodegen with Homebrew, run xcodegen generate, then xcodebuild -scheme ProcexpMac -configuration Debug build. The result is ProcExp (Dev).app under Xcode DerivedData. Tests run with swift test, a live smoke test with swift run ProcexpSmokeRun, and focused suites for the model, network and signing code. A small TCP fixture tool opens a loopback listener, a loopback established connection and, optionally, a DNS-resolved remote connection, so the TCP/IP tab can be checked against a known process.

The optional privileged helper is a launchd daemon reached over XPC and registered with SMAppService. It unlocks richer cross-user detail (full process list, threads, modules, environment) and privileged process control. macOS ties daemon registration to the app's code signature and requires one-time user approval in System Settings, General, Login Items & Extensions. The app must be signed with a stable, non-ad-hoc identity: a Developer ID Application certificate for distribution, or a self-signed identity for local development. A script, Scripts/dev_install_helper.sh, builds a signed app with the helper embedded, installs it in /Applications and launches it; it can create a throwaway self-signed identity in a dedicated keychain. If registration is refused outright, for example because of an ad-hoc signature, the app reports that the helper could not be registered and continues in unprivileged mode.

The README separates development and official builds. Unqualified Xcode and local ad-hoc builds produce ProcExp (Dev).app with bundle ID com.sysinternals.procexpmac.dev and a separate helper service ID, so they do not replace an installed official copy. The official identities (ProcExp.app, com.sysinternals.procexpmac and its helper) are reserved for an explicit Developer ID build or the Azure release pipeline, and the build and signing scripts validate the whole identity tuple first. Release scripts cover DMG creation, signing and notarization. The README closes with a limit: macOS does not expose every Process Explorer data source through public APIs, so where access is denied or a metric is unavailable the UI leaves values blank rather than fabricating data, and some details appear only for same-user processes or when the helper is active.

Key facts

  • The repository microsoft/Procexp-Mac describes Sysinternals Process Explorer for Mac as a native macOS implementation of the core Process Explorer experience, written in Swift, SwiftUI and AppKit.
  • Features include a live process tree, lower-pane DLL, handle and thread views, an eight-tab Properties window (Image, Performance, Performance Graph, Threads, TCP/IP, Security, Environment, Strings) and a System Information window with Summary, CPU, Memory, I/O, Network and GPU pages.
  • Building needs macOS 14 or later, a Swift 5.9 toolchain or later and xcodegen; Xcode 26.6 or later is recommended.
  • An optional privileged root helper, a launchd daemon over XPC registered with SMAppService, adds cross-user process detail and privileged control; without it, or if registration is refused, the app runs in unprivileged mode.
  • Because macOS does not expose every Process Explorer data source through public APIs, unavailable values are left blank rather than fabricated.

Why it matters

Process Explorer is a well-known Windows tool for inspecting processes, modules and handles. This repository brings that kind of view to macOS as a native app instead of a wrapper. It reproduces familiar Process Explorer touches such as the colour-coded process tree and the lower pane for DLLs, handles and threads, and adds macOS-specific features like notarization status, Team ID, and performance versus efficiency core labelling on Apple Silicon. The address places it under the microsoft organisation on GitHub, though the README does not name an author or team.

Who it affects

Developers and administrators who work on macOS and want a Process Explorer-style view of what is running, which files and sockets a process holds, and whether its binaries are signed and notarized. People who use security checks such as SHA-256 hashes and VirusTotal lookups on modules will find them built in. Anyone who wants to build the app needs a recent Xcode setup, since the GUI target requires macOS 14 or later.

How to use it

The README describes a build from source. Install xcodegen (brew install xcodegen), run xcodegen generate, then xcodebuild -scheme ProcexpMac -configuration Debug build, or open the generated ProcexpMac.xcodeproj in Xcode. The Debug build is named ProcExp (Dev).app and sits under Xcode DerivedData. For privileged features, run Scripts/dev_install_helper.sh (with a Developer ID identity set in DEV_SIGN_IDENTITY, or let it create a throwaway self-signed one), choose ProcexpMac, Install Privileged Helper in the app, and approve the daemon once in System Settings under General, Login Items & Extensions. Scripts/dev_uninstall_helper.sh removes the install. Tests run with swift test. The README mentions release scripts for DMG creation, signing and notarization, but gives no release date, version number, license or download link for a finished release.

How solid is it

The only source is the project README, which is detailed about features, build, test and signing steps. It states no release date, version number or license, and says nothing about whether the app is officially supported, stable or production-ready. It gives no benchmarks or resource-usage figures and no comparison with other macOS tools. Whether it runs on Intel Macs is not stated; only Apple Silicon core labelling is mentioned. The feature list is the README's own claim; this account has not tested the app.

Risks and caveats

The README says macOS does not expose every Process Explorer data source through public APIs, so some values will be blank where access is denied or a metric is unavailable. Some details appear only for same-user processes or when the privileged helper is active. The helper needs a stable, non-ad-hoc code signature and a one-time user approval; with an ad-hoc signature, registration is refused and the app continues in unprivileged mode. Repeated reinstalls can clear a remembered approval, so macOS may ask again. When the helper's own code changes, the root helper keeps running its already-loaded binary until restarted, which the README says prompts for sudo. The helper runs as root, so installing it is a real privilege decision.

“Where macOS denies access or a metric is not available through supported APIs, the UI leaves values blank rather than fabricating data.”

— Project README, microsoft/Procexp-Mac