从windows xp
开始,tlist
命令被tasklist
命令取代。
旧的tlist
命令有选项t
,它允许查询父/子进程关系。
tasklist
中是否存在类似的选项?
谢谢
我想你想要这个:
tasklist /SVC
如果这没有帮助,那么我推荐进程资源管理器。它是一个显示所有父进程和子进程的程序。
这是官方链接:http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
你也可以试试
tasklist /M
它会给你这样的结果:
BESClientUI.exe 4296 ntdll.dll, wow64.dll, wow64win.dll,
wow64cpu.dll
SynTPHelper.exe 2216 N/A
sihost.exe 9340 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, combase.dll, ucrtbase.dll,
RPCRT4.dll, bcryptPrimitives.dll,
sechost.dll, advapi32.dll,
CoreMessaging.dll, ntmarta.dll,
你也可以过滤它
tasklist /M /FI "xxx"
其中 xxx 您可以指定过滤器参数
Filters:
Filter Name Valid Operators Valid Value(s)
----------- --------------- --------------------------
STATUS eq, ne RUNNING | SUSPENDED
NOT RESPONDING | UNKNOWN
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number
SESSIONNAME eq, ne Session name
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh - hours,
mm - minutes, ss - seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in [domain]user
format
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
MODULES eq, ne DLL name
例如:
tasklist /M /FI "IMAGENAME eq explorer.exe"
哪个给你一些相似的东西:
Image Name PID Modules
========================= ======== ============================================
explorer.exe 9912 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, combase.dll, ucrtbase.dll,
RPCRT4.dll, bcryptPrimitives.dll,
OLEAUT32.dll, msvcp_win.dll, shcore.dll,
advapi32.dll, sechost.dll, powrprof.dll,
user32.dll, win32u.dll, GDI32.dll,
gdi32full.dll, shlwapi.dll,
windows.storage.dll, kernel.appcore.dll,
profapi.dll, FLTLIB.DLL, SHELL32.dll,
cfgmgr32.dll, TWINAPI.dll, PROPSYS.dll,
winmm.dll, settingsynccore.dll,
UxTheme.dll, dwmapi.dll, SspiCli.dll,
USERENV.dll, twinapi.appcore.dll,
WININET.dll, WTSAPI32.dll,
TextInputFramework.dll, WINMMBASE.dll,
bcrypt.dll, cryptsp.dll, RMCLIENT.dll,
CoreUIComponents.dll, CoreMessaging.dll,
wintypes.dll, ntmarta.dll, IMM32.DLL,