Microsoft ports Sysinternals Process Explorer to macOS with process trees, handle inspection and GPU graphs

Microsoft has published a native macOS port of Sysinternals Process Explorer, the long-standing Windows utility for inspecting running processes, their loaded modules and their open handles. The project lives on GitHub under Microsoft's own organization as Procexp-Mac and reached the Hacker News front page on 10 November 2026. According to the repository's README, it recreates the core Process Explorer workflow as a real Mac application rather than a cross-platform imitation.

A familiar tree, rebuilt in AppKit

The centerpiece is a live process tree that mirrors the Windows original, using color coding to distinguish services, your own processes, newly created and recently deleted processes, suspended processes, sandboxed processes and packed images. The process-name column stays frozen while metric columns scroll sideways, and column widths, ordering and the selected column set persist between sessions. There is type-to-select in every list, tooltips for truncated cells and process paths, and a spacebar shortcut to pause and resume the refresh. A native menu bar and toolbar expose refresh, save, process properties, kill, lower-pane mode, find handle/DLL, a target-window picker and the System Information graphs.

Lower pane, properties and process actions

Below the tree, a lower pane switches between DLLs/images, handles/file descriptors and threads, highlighting rows that appear or disappear between updates. Each process opens a properties window with tabs for Image, Performance, a performance graph, Threads, TCP/IP, Security, Environment and Strings; the TCP/IP tab lists local and remote addresses, resolves remote names with asynchronous reverse-DNS lookups and shows TCP connection state. Process actions cover kill, kill tree, suspend and resume, priority and nice settings, restart, bring to front, sampling the process, an online search and a VirusTotal check.

System graphs and Apple Silicon

A System Information window adds Summary, CPU, Memory, I/O, Network and GPU pages, with graphs for CPU, memory, swap, disk I/O, network I/O, GPU and per-core CPU usage. On Apple Silicon machines, performance and efficiency cores are labeled and colored separately. The app also reports hardware details such as CPU topology and cache, memory and page information, storage, network interfaces and GPU device capabilities, and it can place a CPU history graph in the menu bar.

Code-signing inspection

Security inspection gets particular attention. For any process or module, the app can show the signer, publisher, certificate chain, Team ID, notarization status, platform or ad-hoc status, the reason a signature failed validation and the SHA-256 hash, with VirusTotal lookups available for individual images as well as whole processes.

How it is built

The application is written in Swift on top of SwiftUI and AppKit, and it gathers data exclusively through public macOS APIs, among them libproc, sysctl, Mach host statistics, Security.framework, IOKit and Metal. Operations that need elevation, such as a full cross-user process list with threads, modules and environment variables, go through an optional privileged helper: a launchd daemon contacted over XPC and registered with SMAppService. The README notes that macOS gates that registration on the app's code signature and a one-time user approval in System Settings, so the helper requires a stable, non-ad-hoc signing identity, meaning a Developer ID certificate for distribution or a self-signed one for local development.

Availability

For now, the README describes building from source. The GUI requires macOS 14 or later, Xcode 26.6 or later is recommended for the current project configuration, the Swift 5.9 toolchain or newer is needed, and the Xcode project is generated with xcodegen. Development builds use a separate .dev bundle identifier so they cannot overwrite an installed official copy, while the official identities are reserved for a Developer ID build or the Azure release pipeline. Scripts for DMG creation, signing and notarization are included, which suggests a packaged release will come through that pipeline.

Why it matters

Process Explorer has been a fixture of Windows troubleshooting for years, while the Mac has never had a true equivalent: Activity Monitor offers a flat process list with limited per-process detail, and deeper digging usually means command-line tools such as lsof, ps and top. A native port, from Microsoft of all vendors, gives developers and administrators who work across both platforms the same tree-based process, handle and DLL inspection they already know. It is also a technically credible effort rather than a superficial one, built on public macOS APIs, respecting the Mac's code-signing and notarization model, and even distinguishing performance from efficiency cores on Apple Silicon. The main caveat is that, as documented, you currently have to build it yourself.