Jump to content

commandline from running process


Markus23
 Share

Recommended Posts

Hi !

I need to get the commandline options of running process(es) (msaccess.exe), already tried standard "ProcessList()" but this function only delivers program-name and pid.

Also tried "_ProcessListProperties()" . This function works fine BUT it needs local admin rights for the user.

Is it possible to read all running msaccess.exe into an array with its commandline options AND without having the user to be local admin ?

Thanks in advance,

Markus

Link to comment
Share on other sites

Make sure that msaccess.exe is running in the same or a lower bit-mode than the script you are running, and that it has the same privilege level if running Vista+ O/S's.

I have a function in my Processes,Threads & DLL's UDF that also gets command line (as well as environment and misc. other strings) - but it has the same requirements. (script>=bit-mode of process and script>=privilege level of process).

Link to comment
Share on other sites

Hello.

(if a remember correctly this can be done using Autoit Object winmgmts:\\ method without elevated rights.)

Here is WMIC way:

wmic process where (name="msaccess.exe") get commandline

This will output msaccess.exe command line parameters.

I'm sorry dude i can'not help to you more than this ( because i have no experience with objects:( )

Edit:Figured it out.

Here is:

;Grabbed and modified from here ==> http://www.autoitscript.com/autoit3/files/beta/autoit/COM/Wmi-terminate.au3
showmeitpliz("cfp.exe")     ;=> Comodo FW process   ==>cfp.exe  (define your proc.exe)  ;~ Now calling funcsion
Func showmeitpliz($proc, $strComputer=".")
     $proc="cfp.exe"  ;=> Comodo FW process   ==>cfp.exe  (define your proc.exe)

  $oWMI=ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & $strComputer & "\root\cimv2")
  $oProcessColl=$oWMI.ExecQuery("Select * from Win32_Process where Name= " & '"'& $Proc & '"')

  For $Process In $oProcessColl
    $Process=$Process.Commandline
    MsgBox(0,"",$Process)
  Next

EndFunc; ==>showmeitpliz()

It gives for me:

Posted Image

Edited by Fire
[size="5"] [/size]
Link to comment
Share on other sites

...

Edit:Figured it out.

Hey, just tested your code and it's working even if user hasn't local admin rights. :-)

Now I will try to adapt the code into my script. It would be nice to get the results delivered in an array.

Have to check how to manage this.

Thanks alot :-)

Markus

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...