How to? Is There an Easy Way to Get the PID of the Current Task

[Jay Sage]

With some work, I can use TASKLIST piped to FSEARCH to find the PID with an asterisk after it and then extract the PID. Can anyone suggest an easier way?

 

[vefatica]

_PID

 

[Jay Sage]

That is, indeed, quite a bit easier :-). Thanks, Vince.

On a related subject, how can one properly identify the TCC sessions running in TCMD tabs. I find the titles in the output from TASKLIST to be quite confusing.

[TCC34.00.24 | C:\commands\bat]
>*tasklist "tc*"
21472  tcmd              TC 34.0 - C:\commands\bat
21760  tcc               TextPipe Engine Single User Edition
23672  tcc               C:\Users\Jay\Dropbox
  356* tcc               GDI+ Window (TCC.EXE)
24232  tcc               GDI+ Window (TCC.EXE)

When I ran that command, I was in a TCC session in the C:\commands\bat folder, which is in the title of the TCMD window. The window title for that TCC session has "GDI+...", as does another TCC session in a tab. A third TCC tab session has the title "TextPipe...". The one with "Dropbox" in the title is a TCC session not running inside TCMD.[/code]

 

[Joe Caverly]

From a TCMD Tab,

E:\Utils>echo %@pidcommand[%_ppid]
tcmd.exe

...shows that the parent process for this TCC is tcmd.exe

From a stand alone TCC.EXE,

C:\...\TCMD34>echo %@pidcommand[%_ppid]
C:\WINDOWS\Explorer.EXE

...shows that the parent process for this TCC is Explorer.exe

Joe

 

[Joe Caverly]

Here are all of the TCC.EXEs that are running on my system;

C:\...\TCMD34>tasklist /m tcc*
22160*   130785280  tcc               Admin: TCC34 - tasklist /m tcc*
 4896     52031488  tcc                - mode con: cols=115 lines=29
21932    116350976  tcc               21932 e:\utils>

This shows the TCC.EXEs that are running within TCMD.EXE

C:\...\TCMD34>tasklist /r tcmd*
24088  tcmd              Admin: TC 34.0 - 21932 e:\utils>
  ├─ 4896  tcc                - mode con: cols=115 lines=29
  │ └─15124  conhost
  └─21932  tcc               21932 e:\utils>
    └─15580  conhost

   Found 5 processes.

Joe

 

[Joe Caverly]

Another method...

C:\...\TCMD34>*tasklist /r tcmd* 
15164  tcmd              Admin: TC 34.0 - 9388 e:\utils>
  ├─ 9996  tcc                - mode con: cols=115 lines=29
  │ └─26940  conhost
  └─ 9388  tcc               9388 e:\utils>
    └─22488  conhost

   Found 5 processes.

C:\...\TCMD34>*tasklist /z tcc* 
22160*  5188 tcc               Admin: TCC34 - tasklist /z tcc*
 9996  15164 tcc                - mode con: cols=115 lines=29
 9388  15164 tcc               9388 e:\utils>

   Found 3 processes.

Joe

 

[Jay Sage]

That's interesting but doesn't explain the various window titles displayed. It also raises some further questions.

[TCC34.00.24 | C:\commands\bat]
>*tasklist /r tc*
21472  tcmd              TC 34.0 - C:\commands\bat
  └─21760  tcc               TextPipe Engine Single User Edition
    └─21768  conhost
    └─ 8696  ShrAlias          ShrAliasWindow
  └─  356* tcc               GDI+ Window (TCC.EXE)
    └─35864  conhost
  └─24232  tcc               GDI+ Window (TCC.EXE)
    └─24684  conhost
21760  tcc               TextPipe Engine Single User Edition
  └─21768  conhost
  └─ 8696  ShrAlias          ShrAliasWindow
23672  tcc               C:\Users\Jay\Dropbox
  └─32352  conhost
  356* tcc               GDI+ Window (TCC.EXE)
  └─35864  conhost
24232  tcc               GDI+ Window (TCC.EXE)
  └─24684  conhost

What is that process 356? There are three TCC tabs in TCMD. The information above does not reveal which ones are which, except that the one with ShrAlias running under it must be the one that was started when the TCMD started when the computer was booted.

Process 356 is listed twice, once for the TCC tab in TCMD and once for the standalone TCC task 23672

 

[vefatica]

Q: Why is the one that started SHRALIAS still running? It doesn't need to be running for SHRALIAS to work.

Apparently TASKLIST uses the first window it finds. If that's a TPIPE window I reckon that's what you'll get.

 

[Joe Caverly]

Displaying which TCC processes are TCMD Tabs would probably have to be a feature request addition for TASKLIST.

Not sure if @Charles Dye would be able to add it to the TASKLIST command in his TASKS Plugin,
which has more features than the internal TCC TASKLIST command.

Joe

 

[Charles Dye]

Not sure if @Charles Dye would be able to add it to the TASKLIST command in his TASKS Plugin,
which has more features than the internal TCC TASKLIST command.

This is actually pretty difficult for an outside process to know.

Processes running in a Take Command tab have a hidden console window — but there are lots of other reasons why a console window might be hidden.

Processes running in a tab window might or might not have have TCMD.EXE as a parent process, since tabs can be attached to and detached from Take Command; and because programs like TCC or CMD can easily start new copies of themselves (or others) as child processes.

Take Command seems to attach itself to the console window of the program running in the currently active tab window, while the program is actively writing to the screen; but it can detach itself if the program is not writing to the screen, or if it's not in the current tab window; so this is not a good test.

If you never attach or detach tabs, you could try tasklist /r tcmd — but just at the moment, on my system, using the internal tasklist, that command is giving some wildly wrong results....

 

[vefatica]

If you never attach or detach tabs, you could try tasklist /r tcmd — but just at the moment, on my system, using the internal tasklist, that command is giving some wildly wrong results....

For example?

 

[Charles Dye]

I'd post a screen shot, but it's not doing it any more. It had somehow decided that wininit was a child process of one of my TCC instances, dragging in all of wininit's child processes.... including services.exe and about a hundred little baby svchosts....

 

[Jay Sage]

I shut down all the TCC processes and TCMD and then restarted TCMD. Now I have the one simple TCC in a tab.

[TCC34.00.24 | C:\Users\Jay\Dropbox]
>*tasklist /r tc*
68216  tcmd              TC 34.0 - C:\Users\Jay\Dropbox
  └─57136* tcc               GDI+ Window (TCC.EXE)
    └─39428  conhost
57136* tcc               GDI+ Window (TCC.EXE)
  └─39428  conhost

Now I started another TCC in a tab and one freestanding. The task list still looks reasonable. Apparently, the tasks running in tabs often get the window name "GDI+ Window (TCC.EXE)", while the freestanding task and TCMD get the open folder.

[TCC34.00.24 | C:\Users\Jay\Dropbox\scans]
>*tasklist /r tc*
68216  tcmd              TC 34.0 - C:\Users\Jay\Dropbox\scans
  └─57136  tcc               GDI+ Window (TCC.EXE)
    └─39428  conhost
  └─57636* tcc               GDI+ Window (TCC.EXE)
    └─69156  conhost
57136  tcc               GDI+ Window (TCC.EXE)
  └─39428  conhost
57636* tcc               GDI+ Window (TCC.EXE)
  └─69156  conhost
63464  tcc               C:\Users\Jay\Dropbox
  └─34904  conhost

I don't see any obvious way to tell one tabbed TCC from another from this list. In this case it's the one in the scans folder (the new one) that is active (57636). Of course, one can launch some other program from the tab, after which that program is listed as a subprocess.

Does anyone know what GDI+ means?

 

[vefatica]

I suppose GDI is "Graphics Device Interface". "GDI+ Window" is probably just the tab mechanism's chosen title. I don't see them in TASKLIST. And they don't belong to TCC. I think TASKLIST is getting confused. I have six tabs open in TCMD and I see only one such window.

d:\tc34> whichwin /r /p 10092 /t *gdi*
Handle:  0x001409B6
Process: 10092
Thread:  0x680
Module:  D:\tc34\tcmd.exe
Class:   GDI+ Hook Window Class
Title:   GDI+ Window (tcmd.exe)
Enabled: Yes
Visible: No
Show:    NORMAL
LTRB:    0,0,1,1 (1 x 1)

1 windows found / 580 windows processed

That said, Windows Terminal does some smoke and mirror stuff with window owners. Maybe TCMD does also.

 

[rconn]

The /Z option will also show the parent PID, which in the case of TCC in a tab window will be the TCMD PID.

I don't see "GDI+ ..." as titles for any of my tabs. But if you have tab title updating turned off, you'll get whatever Windows decides to put there.

The window titles displayed by TASKLIST are the first main window that Windows finds for that process. However, a process can have multiple main windows, so depending on the process this may not display anything useful.

 

[Joe Caverly]

For those that may be interested,
the PROCTREE command from the PROCTREE plugin may be easier to use than TASKLIST for use with TCC and TCMD.

This plugin provides two commands and a function to display or return a process’s genealogy.

PROCTREE displays a tree-formatted list of descendants of a given process. It’s like a cross between TASKLIST and ENUMPROCESSES.

ANCESTRY is essentially the reverse: it displays a list of a process’s ancestors. Since each process has only one parent, the output is not a tree but a simple list, from the earliest known ancestor to the specified process. @ANCESTRY is ANCESTRY as a function. It returns a space-separated list of ancestral process IDs.

For example, PROCTREE alone will identify the Process Tree starting from TCC by default;

R:\>proctree 

5A38  tcc  Admin: TCC34 - proctree
   ├──1E30  AutoHotkey64  C:\Program Files\AutoHotkey\UX\launcher.ahk - AutoHotkey v2.0.18
   │  └──565C  AutoHotkey64  E:\Utils\HotStrings.ahk - AutoHotkey v2.0.18
   ├──3A94  Everything  EVERYTHING_HTTP_SERVER
   ├──44A4  ShrAlias  ShrAliasWindow
   ├──5160  AppNetworkCounter  AppNetworkCounter
   └──5A5C  conhost

Posting for those that may be interested.

Joe