IF ISAPP ... ".exe" or not?

May 20, 2008
11,431
99
Syracuse, NY, USA
IF ISAPP works on conhost.exe and not on conhost. In contrast, it fails on dllhost.exe and works on dllhost. What's going on there?

Code:
v:\> tasklist | egrep "conhost|dllhost"
 7976  conhost
 3164  dllhost

v:\> if isapp conhost.exe echo yes
yes

v:\> if isapp conhost echo yes

v:\> if isapp dllhost.exe echo yes

v:\> if isapp dllhost echo yes
yes

v:\>
 

rconn

Administrator
Staff member
May 14, 2008
12,367
150
Not reproducible here.

Code:
[D:\release]if isapp conhost.exe echo yes
yes

[D:\release]if isapp conhost echo yes

[D:\release]if isapp dllhost.exe echo yes
yes

[D:\release]if isapp dllhost echo yes

[D:\release]

ISAPP enumarates the process list (with CreateToolhelp32Snapshot).
 
May 20, 2008
11,431
99
Syracuse, NY, USA
Hmmm! If I run through the processes (%z) with

Code:
echo %@if[isapp %z,yes,no]^t%@if[isapp %z.exe,yes,no]^t%z

I get a rather interesting mixture of results. User processes give "no yes" and except for SystemProcess and MemoryCompression which give "no no", system processes give "yes no" ... except for svchost, which gives "yes yes". I've used Toolhelp32SnapShots but I'll have to brush up (maybe experiment) to try to figure out what's happening.

Code:
no      no      [System Process]
no      no      Memory Compression
no      yes     AutoHotkeyU64
no      yes     conhost
no      yes     explorer
no      yes     firefox
no      yes     OUTLOOK
no      yes     powerpro
no      yes     ppro64
no      yes     RuntimeBroker
no      yes     SearchUI
no      yes     SecurityHealthSystray
no      yes     sihost
no      yes     sort
no      yes     StartMenuExperienceHost
no      yes     taskhostw
no      yes     tcc
no      yes     uniq
yes     no      csrss
yes     no      dwm
yes     no      fontdrvhost
yes     no      IAStorDataMgrSvc
yes     no      lsass
yes     no      MsMpEng
yes     no      NisSrv
yes     no      OfficeClickToRun
yes     no      PresentationFontCache
yes     no      Registry
yes     no      SecurityHealthService
yes     no      Serv-U
yes     no      services
yes     no      SgrmBroker
yes     no      smss
yes     no      spoolsv
yes     no      System
yes     no      w32tmsvc
yes     no      wininit
yes     no      winlogon
yes     yes     svchost
 
May 20, 2008
11,431
99
Syracuse, NY, USA
I can't figure out what TCC is doing. When I use CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0), except for "[System Process]", "System", "Registry", and "Memory Compression", PROCESSENTRY32::szExeFile always contains ".exe".
 
May 20, 2008
11,431
99
Syracuse, NY, USA
Is this idle curiosity or do you have a specific issue? (The TCC code that handles this is about 1300 lines long and I'm not going to post it here.)
I do use ISAPP and It's hard to remember how to use it ... do I include the ".exe" or not.
 
May 20, 2008
11,431
99
Syracuse, NY, USA
How exactly you are using it? Please show code sample.
Code:
do proc in /L SystemSettingsBroker CompPkgSrv ShellExperienceHost iastoricon smartscreen igfxem
    set procname=%proc.exe
    iff isapp %procname .or. isapp %proc then
        set started=%@wmitcvt[%@wmi[.,"Select CreationDate from Win32_Process where Name='%procname'"]]
        echo %proc.exe (started %started) | tee /a v:\killers.log
        taskend /F %proc
    endiff
enddo
 
May 20, 2008
11,431
99
Syracuse, NY, USA
And for system processes, the syntaxes, elevated vs. not elevated, are exact opposites.

1594659123336.png


1594659148275.png
 
May 20, 2008
11,431
99
Syracuse, NY, USA
Can you ditch ISAPP and rely on return of WMI call solely?
For sure! I have done that in several cases. It's amazing what you can do with WMI. And I also have a plugin ...

Code:
v:\> help @isapp
@ISAPP[spec] = -1|PID - PID if wildcard match
 
May 20, 2008
11,431
99
Syracuse, NY, USA
Apparently @PID and ISAPP use the same mechanism. Unelevated, to get the PID of explorer, ".exe" must be present, while to get the PID of spoolsv, ".exe" must be absent.

1596214460578.png


And when the current process is elevated, it's exactly the opposite for some processes.

1596214563409.png
 
Similar threads
Thread starter Title Forum Replies Date
fpefpe Documentation if isapp .... Support 6
vefatica @PID, ISAPP - don't see system processes Support 12
dcantor IF ISAPP failure Support 12
C COMSPEC constantly reset to TCC.EXE Support 6
C updater.exe not catching updates Support 10
L FTYPE in TCC, less quirky than in cmd.exe Support 3
Joe Caverly Embedding an .EXE (or other file) into a .BTM Support 8
L Using TCC.exe through an SSH connection Support 3
fpefpe bash.exe as a tab Support 0
vefatica Piping Cscript.exe to HEAD? Support 9
G Console exe up / down history Support 8
D Unnecessary environment dependencies of TCC.EXE Support 3
vefatica IDE.EXE's command line? Support 19
Joe Caverly PUSHD with UNC path in CMD.EXE Support 2
I how to make TCC default/replace cmd.exe? Support 9
David McClelland TCMD 24 & Perl - perl thinks it's own executable is ...\TCMD24\TCC.EXE??? Support 3
M Command line parsing differences between cmd.exe and TCC Support 6
Joe Caverly Works with CMD.EXE, no output with TCC.EXE Support 7
L WAD ECHO. expansion of non-existent env-vars differs from CMD.exe Support 6
Joe Caverly "Functions" in cmd.exe batch files Support 6
P Symantec Endpoint Protection trapped TCMD.EXE and said it contained WS.Reputation.1 (Virus?) Support 3
CWBillow Everything.exe - 64-bit? Support 8
C How to make list of drive contents when shutdown PC / Everything.exe Support 7
P Labels in batch files: TCC vs CMD.exe Support 9
D Custom ini-file is not read, by tcmd.exe cli Support 6
Joe Caverly CMD.EXE and filename(1).ext Support 3
Joe Caverly CMDebug and TCC.EXE Support 4
vefatica TPIPE.EXE crashes on Ctrl-C Support 9
thorntonpg TCC_RT_21\tcc.exe runs tcstart Support 4
B how to do in "start" command thing like in tcc.exe Support 1
w_krieger v.exe and everything.exe Support 5
E Fixed SHRALIAS doesn't work / SHRALIAS.EXE is missing in v20.11.35 Support 2
C everything.exe .vs. new installs Support 4
TT's Help! Uninstalling TCC did not restore cmd.exe as Win10 default batch file processor. Support 4
T tchelp.exe issues Support 2
vefatica OT: snippingtool.exe Support 14
Alpengreis I have a 0xc0000005 with tcmd.exe and ntdll.dll Support 6
cgunhouse Orphaned conhost.exe processes Support 8
redwdc TCC.exe opens to 11 characters x 3 rows Support 1
D Tab completion differences with cmd.exe Support 3
D WAD The /@ and // arguments to TCMD.EXE have no decernable effect. Support 11
D How to? How to access iPhone from tcmd.exe? Support 1
CWBillow The file tcc.exe is not marked for installation Support 4
T 64 bit TCCLE appears to crash when opening tcc.exe from within tcc.exe window Support 7
R How to? Launch and execute commands in tcmd.exe through MSBuild Script. Support 3
M Console-Mode (*.exe) works in TCC, not in TCMD Support 2
A Download of tcmd64.exe corrupted Support 2
R Difference in behavior of RMDIR vs. CMD.EXE? Support 5
C WAD TCC: (Sys) C:\Program Files\JPSoft\TCMD17\tcc.exe is not a valid Win32 application. Support 6
Joe Caverly How to? Run DOS .exe's the same way Wine does... Support 3

Similar threads