Как узнать откуда запущен процесс windows

Помогла ли Вам статья?

There is a thing called PPID (Parent Process ID) but it’s relatively «tricky» to find in Windows because it’s not a column shown in Task Manager, and i’m not even seeing it for columns in Process Explorer either.

Two methods of doing this

Method 1 - WMIC
Method 2 - Process Monitor

Both of these are pretty quick methods

Method 1 — WMIC

I’ll use an answer of how to find the PPID using WMIC from over here
https://stackoverflow.com/questions/7486717/finding-parent-process-id-on-windows

And that makes the rest of this fairly simple

C:blah>wmic process get processid,parentprocessid
ParentProcessId  ProcessId
0                0
0                4
4                320
392              572
320              656
648              664
392              688
688              740
688              756
688              764
...              ...

The rest is fairly obvious.

So let’s suppose you want to find who launched calc.exe

and calc.exe you see from task manager, is PID 7384

C:blah>wmic process get processid,parentprocessid | find "7384"
10896            7384

PPID             PID


C:crp>

WMIC shows the associations between PID and PPID. Then look up 10896 in Task Manager, (10896 is the PPID listed for calc.exe’s PID of 7384), and in task manager I see that the process with PID of 10896 is cmd.exe which is the process I used to launch calc.exe And indeed cmd.exe is the parent process that spawned calc.exe

Method 2 — Process Monitor

You can do it in sysinternals process monitor.

click filter..filter in the menu bar, and add a filter filtering the name or path or PID of the process e.g. process name calc.exe or a filter for path and enter c:windowssystem32calc.exe

I happened to use process name

Do OK.. and file..capture if it’s not yet capturing.

Double click the right process so in this case load image calc.exe and a properties dialog comes up, click the correct tab, ‘process’, and you see the PID and PPID(parent process id).

And of course when you know the PPID as you now would, then you can look it up in task manager to know what process spawned it

There is a thing called PPID (Parent Process ID) but it’s relatively «tricky» to find in Windows because it’s not a column shown in Task Manager, and i’m not even seeing it for columns in Process Explorer either.

Two methods of doing this

Method 1 - WMIC
Method 2 - Process Monitor

Both of these are pretty quick methods

Method 1 — WMIC

I’ll use an answer of how to find the PPID using WMIC from over here
https://stackoverflow.com/questions/7486717/finding-parent-process-id-on-windows

And that makes the rest of this fairly simple

C:blah>wmic process get processid,parentprocessid
ParentProcessId  ProcessId
0                0
0                4
4                320
392              572
320              656
648              664
392              688
688              740
688              756
688              764
...              ...

The rest is fairly obvious.

So let’s suppose you want to find who launched calc.exe

and calc.exe you see from task manager, is PID 7384

C:blah>wmic process get processid,parentprocessid | find "7384"
10896            7384

PPID             PID


C:crp>

WMIC shows the associations between PID and PPID. Then look up 10896 in Task Manager, (10896 is the PPID listed for calc.exe’s PID of 7384), and in task manager I see that the process with PID of 10896 is cmd.exe which is the process I used to launch calc.exe And indeed cmd.exe is the parent process that spawned calc.exe

Method 2 — Process Monitor

You can do it in sysinternals process monitor.

click filter..filter in the menu bar, and add a filter filtering the name or path or PID of the process e.g. process name calc.exe or a filter for path and enter c:windowssystem32calc.exe

I happened to use process name

Do OK.. and file..capture if it’s not yet capturing.

Double click the right process so in this case load image calc.exe and a properties dialog comes up, click the correct tab, ‘process’, and you see the PID and PPID(parent process id).

And of course when you know the PPID as you now would, then you can look it up in task manager to know what process spawned it

Lauf, для x64 систем определение пути к процессу — довольно распространенная проблема. Не раз обсуждалась и на англоязычных форумах.
Самому интересно. Пытался реализовать через GetProcessImageFileName, получив предварительно PID процесса по имени — не пошло.
Для 32-разрядных систем, программа по ссылке выше, должна отработать как надо.

Нашел в сети

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

var
  lpidProcess: array [0..$ffff] of DWORD;
  cbNeeded: DWORD;
  i: Integer;
  openprocesshandle: THandle;
  lphModule: HMODULE;
  lpFilename: array [0..MAX_PATH] of Char;
  len: Cardinal;
begin
  Memo1.Lines.Clear;
  if EnumProcesses(@lpidProcess, SizeOf(lpidProcess), cbNeeded) then
  begin
    for i:=0 to cbNeeded div SizeOf(DWORD)-1 do
    begin
      openprocesshandle:=OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, lpidProcess[i]);
      if openprocesshandle>0 then
      begin
        if EnumProcessModules(openprocesshandle, @lphModule, SizeOf(HMODULE), cbNeeded) then
        begin
          len:=GetModuleFileNameEx(openprocesshandle, lphModule, lpFilename, SizeOf(lpFilename));
          if len>0 then
            Memo1.Lines.Add(Copy(lpFilename, 1, len));
        end;
        CloseHandle(openprocesshandle);
      end;
    end;
  end;
end;

Отображает пути к множеству процессов. Однако, если процессов в системе больше, чем 4096, код отработает не айс.

Народ! Кто сталкивался, подключайтесь к теме.