Missing help for @PIDCOMMAND[pid]

May 29, 2008
533
3
Groton, CT
#1
It's in the list of new features, but there's no index entry or description page for it.

It's a GREAT feature. Thanks for adding that. It's going to allow me to eliminate using a command-line utility to get that.

For the NEXT major version, please consider
%@PIDPARENT[pid] which would return the pid of the parent of the process whose pid is given.
 

rconn

Administrator
Staff member
May 14, 2008
10,752
97
#2
> It's in the list of new features, but there's no index entry or
> description page for it.
There is a description page for it, but it didn't have an index entry.


> For the NEXT major version, please consider
> %@PIDPARENT[pid] which would return the pid of the parent of the
> process whose pid is given.
Not straightforward or in many cases possible at all -- Windows does not
have a concept of a "parent" process.

Rex Conn
JP Software
 
#3
I haven't been into the API yet, but when I run Process Explorer, it
shows a parent/child relationship in the Process column (as one of the
3 sorts possible).

I'll see if I can find out what is being used to enumerate the
processes that way.

On Tue, Oct 13, 2009 at 6:30 AM, rconn <> wrote:

> ---Quote---
>> It's in the list of new features, but there's no index entry or
>> description page for it.
> ---End Quote---
> There is a description page for it, but it didn't have an index entry.
>
>
>
> ---Quote---
>> For the NEXT major version, please consider
>> * *%@PIDPARENT[pid] *which would return the pid of the parent of the
>> process whose pid is given.
> ---End Quote---
> Not straightforward or in many cases possible at all -- Windows does not
> have a concept of a "parent" process.
>
> Rex Conn
> JP Software
>
>
>
>
>


--
Jim Cook
2009 Saturdays: 4/4, 6/6, 8/8, 10/10, 12/12 and 5/9, 9/5, 7/11, 11/7.
Next year they're Sunday.
 
May 29, 2008
533
3
Groton, CT
#4
There is a description page for it, but it didn't have an index entry.




Not straightforward or in many cases possible at all -- Windows does not
have a concept of a "parent" process.

Rex Conn
JP Software

Ah, but TCC does. See the description for internal variable %_PPID.

I would envision %@PIDPARENT to return the pid of the process that started the process in question, much like _PPID does for the current process.
 
#5
Not straightforward or in many cases possible at all -- Windows does not have a concept of a "parent" process.
Yes it does (however vague it might be). Once upon a time you could use the undoc'd NtQueryInformationProcess() and dir dwInheritedFronUniqueId out of some struct. Later NtQueryInformationProcess() became documented, but with warnings that it was subject to change. And in the latest VC, it has changed (and can't be used as before).

But there is a documented (and in my tests reliable) way to do it. Here's some code, and below, a little test showing that windows has some notion of the parent of every process running here. Granted, those parents may not still exist and their PIDs may have been re-used.
Code:
#include <tlhelp32.h>tlhelp32.h

INT WINAPI f_PPID ( WCHAR * psz )
{
    DWORD dwPID = wcstoul(psz, NULL, 10);

    Sprintf(psz, L"N/A");

    PROCESSENTRY32 pe = {sizeof(PROCESSENTRY32), 0};

    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if ( hSnap == INVALID_HANDLE_VALUE )
        return 0;

    if ( Process32First(hSnap, &pe) )
        while ( pe.th32ProcessID != dwPID && Process32Next(hSnap, &pe) );

    if ( pe.th32ProcessID == dwPID )
        Sprintf(psz, L"%lu", pe.th32ParentProcessID);

    CloseHandle(hSnap);

    return 0;
}
Note: %_PIDS (below) is in my 4UTILS plugin. @PPID[] is experimental.

Code:
for %pid in ( %_pids ) echo %pid / %@PPID[%pid]

0 / 0
4 / 0
180 / 924
248 / 228
272 / 924
792 / 4
856 / 792
880 / 792
924 / 880
936 / 880
1164 / 924
1232 / 924
1328 / 792
1448 / 2128
1488 / 924
1544 / 924
1628 / 924
1904 / 3096
2664 / 792
2864 / 3548
2900 / 3096
3096 / 2128
3520 / 880
3548 / 3160
3716 / 1328
3916 / 1164
</tlhelp32.h>
 

rconn

Administrator
Staff member
May 14, 2008
10,752
97
#6
> Not straightforward or in many cases possible at all -- Windows does
> not have a concept of a "parent" process.
>
> ---End Quote---
>
> Ah, but TCC does. See the description for internal variable %_PPID.
That's not a parent process, that's just the process that started TCC.
There is no parent/child relationship.

Rex Conn
JP Software
 
#7
On Tue, 13 Oct 2009 18:11:49 -0500, rconn <> wrote:

|> Ah, but TCC does. See the description for internal variable %_PPID.

|That's not a parent process, that's just the process that started TCC.
|There is no parent/child relationship.

What is your notion of "parent process", the notion you say Windows doesn't
have?

I think most users would be quite happy with "the process that started ...".
--
- Vince