hightower

EN | PT-BR

A Windows command-line tool that lists every running process and explains, in plain language, what each one is -- flagging the unknown or out-of-place ones. Built for people who have no idea what all those names in Task Manager mean.

New to Windows internals? Start with the beginner's guide (docs/GUIDE.md, pt-BR: docs/GUIDE.pt-BR.md) instead: it explains every term and table column in plain language.

Table of Contents

• Features
• Install
• Architecture
• Project Structure
• Usage
• Risk Heuristics & Disclaimer
• Notes
• Support
• License

Features

• hightower scan --all -- list every running process with PID, full path, category, publisher (when verifiable), and a plain-language risk verdict.
• hightower explain <name|pid> -- a plain-language write-up of a single process: what it is, whether many copies is normal, expected vs. actual path.
• hightower scan --json -- the same scan as machine-readable JSON.
• Offline-first: no network, no telemetry, ever.

All three commands work today, including risk verdicts, Authenticode signature checks, and the embedded known-process database.

Install

Windows only.

Recommended -- no Rust needed. Download the installer, read it (good practice for any script off the internet), then run it:

irm https://raw.githubusercontent.com/gsjonio/hightower/main/install.ps1 -OutFile install.ps1
# read install.ps1, then:
.\install.ps1

It puts hightower.exe in %LOCALAPPDATA%\Programs\hightower and adds that folder to your user PATH -- no administrator rights, nothing touched outside your user profile. Open a new terminal afterwards, then run hightower scan.

Re-running it upgrades in place. To remove it: .\uninstall.ps1. The binary is unsigned, so SmartScreen may warn on first run.

From source -- needs the Rust toolchain (1.82+):

git clone https://github.com/gsjonio/hightower.git
cd hightower
cargo install --path cli

cargo install puts the binary in %USERPROFILE%\.cargo\bin; make sure that folder is on your PATH. (rustup normally adds it -- if hightower is not found in a new terminal, that is why.)

Architecture

hightower is a Cargo workspace laid out as a hexagonal (ports & adapters) architecture, one crate per ring:

• core -- the domain and the ports (traits). Pure logic, zero OS dependencies. It does not depend on the windows crate, so any attempt to call Windows from the domain fails to compile -- the boundary is enforced by the compiler, not by code review.
• adapters -- the driven side: real Windows implementations of the ports (process listing via ToolHelp32, Authenticode signature checks) and the embedded known-process database.
• cli -- the driving side: argument parsing plus the composition root that wires the adapters into the core.

See the Architecture wiki page for the full rationale.

Project Structure

hightower/
├── core/        domain + ports (traits). No OS deps.
├── adapters/    Windows adapters (ToolHelp32, Authenticode) + known-process DB.
└── cli/         clap + composition root; produces the `hightower` binary.

Usage

hightower scan --all          # explain every running process
hightower scan --json         # same, as JSON for scripts
hightower explain <name|pid>  # deep-dive a single process

Risk Heuristics & Disclaimer

hightower is an educational aid, not an antivirus. It uses simple heuristics to flag processes worth a human look:

1. A known Windows process name (e.g. svchost.exe) running from outside %SystemRoot%\System32 / SysWOW64 -- a classic masquerading technique.
2. A binary with no valid or trusted signature.
3. A process running from Temp, Downloads, or AppData\Roaming unsigned.
4. A name absent from the known-process database with no recognized publisher -- reported as unknown, review manually.

These heuristics produce false positives and false negatives. A suspicious verdict does not mean malware, and a trusted verdict does not guarantee safety. hightower never tells you to kill or delete a system process. When in doubt, research the process or ask someone you trust -- do not act on the verdict alone.

Notes

• Some protected processes require an elevated (administrator) terminal for full details. Without it they appear as restricted -- they are never dropped and never crash the scan.
• No network access, no telemetry.

Support

hightower is free and open source. If it saves you time, you can support its development with a coffee. Thank you!

License

MIT