问题
Starting windows xp the tlist was changed by the tasklist.
tlist has the option \t,which permitted to query parent/child process relationship
does similar option exist in tasklist?
Thank you
回答1:
I think you want this:
tasklist /SVC
If this is not helpful then I recommend Process Explorer. It is a program which shows all parent and child processes.
This is the official link: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
回答2:
Also you can tried
tasklist /M
It will give you result like that:
BESClientUI.exe 4296 ntdll.dll, wow64.dll, wow64win.dll,
wow64cpu.dll
SynTPHelper.exe 2216 N/A
sihost.exe 9340 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, combase.dll, ucrtbase.dll,
RPCRT4.dll, bcryptPrimitives.dll,
sechost.dll, advapi32.dll,
CoreMessaging.dll, ntmarta.dll,
Also you can filter it
tasklist /M /FI "xxx"
Where as xxx you can specyfi filter parameters
Filters:
Filter Name Valid Operators Valid Value(s)
----------- --------------- --------------------------
STATUS eq, ne RUNNING | SUSPENDED
NOT RESPONDING | UNKNOWN
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number
SESSIONNAME eq, ne Session name
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh - hours,
mm - minutes, ss - seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in [domain\]user
format
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
MODULES eq, ne DLL name
for example:
tasklist /M /FI "IMAGENAME eq explorer.exe"
Which give's you somethin similar:
Image Name PID Modules
========================= ======== ============================================
explorer.exe 9912 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, combase.dll, ucrtbase.dll,
RPCRT4.dll, bcryptPrimitives.dll,
OLEAUT32.dll, msvcp_win.dll, shcore.dll,
advapi32.dll, sechost.dll, powrprof.dll,
user32.dll, win32u.dll, GDI32.dll,
gdi32full.dll, shlwapi.dll,
windows.storage.dll, kernel.appcore.dll,
profapi.dll, FLTLIB.DLL, SHELL32.dll,
cfgmgr32.dll, TWINAPI.dll, PROPSYS.dll,
winmm.dll, settingsynccore.dll,
UxTheme.dll, dwmapi.dll, SspiCli.dll,
USERENV.dll, twinapi.appcore.dll,
WININET.dll, WTSAPI32.dll,
TextInputFramework.dll, WINMMBASE.dll,
bcrypt.dll, cryptsp.dll, RMCLIENT.dll,
CoreUIComponents.dll, CoreMessaging.dll,
wintypes.dll, ntmarta.dll, IMM32.DLL,
来源：https://stackoverflow.com/questions/11269165/viewing-the-process-tree-tlist-tasklist