How do I find out command line arguments of a running program?

Question

I'm looking for a tool or method to find out what command line parameters have been passed to a program, for example when it was run by another program (launcher-application scenario).

Answer 1

You can do that using Process Explorer.

Just hover with your mouse over a process to see the command line arguments used to start it:

Alternatively, you can open the properties of the process and inspect the command line right there:

Answer 2

You can do it without Process Explorer, too, using Windows' WMI service. Run the following from the command prompt:

WMIC path win32_process get Caption,Processid,Commandline

If you want to dump the output to a file (makes it a bit easier to read), use the /OUTPUT switch:

WMIC /OUTPUT:C:\Process.txt path win32_process get Caption,Processid,Commandline

Answer 3

One can also achieve that by using Task Manager.

Open task manager (by CTRL-SHIFT-ESC, CTRL-ALT-DELETE or any other method).

For Windows 7 (and probably Windows XP):

• Go to "Processes" tab. The on the "View" menu, select "Select Columns...".
• Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it)

For Windows 8:

• Go to "Details" tab. Right-click on any of the columns (eg. Names, PID etc.) and select "Select columns".
• Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it)

A column of Command lines of will be added to the currently displayed columns.

Answer 4

PowerShell to the rescue.

Find:

Get-WmiObject Win32_Process -Filter "name = 'perl.exe'" | where {$_.CommandLine -eq '"C:\strawberry\perl\bin\perl.exe" t/Server_PreFork.t'}

And kill as bonus:

Get-WmiObject Win32_Process -Filter "name = 'perl.exe'" | where {$_.CommandLine -eq '"C:\strawberry\perl\bin\perl.exe" t/Server_PreFork.t'} | ForEach-Object { Invoke-WmiMethod -Path $_.__Path –Name Terminate }

You can run it from powershell directly or from a ps1 if you've got your system setup. I detail unrestricted script setup on i kill zombies with powershell as well as other powershell tricks...

Answer 5

Previous answers are great in case the process is already running and is not going to terminate any soon. However If you need (as I did) to do this perhaps with processses start up multiple times and/or quickly terminate, or perhaps log occurences in a longer period of time, there is a way to this using Process Monitor.

Basically it logs various events in the system, in this case we can just filter the "Process Start" event and the name of the process we want to monitor, as shown below:

Then just keep the process monitor running and do whatever you do to get the process you want to log running. You can see in either the "Detail" column or the "Command line" column (depends on how you configure those) the command line arguments. For example:

Of course this way you can extract much more related information such as what is the working directory, what environment variables have been passed on the process, etc... Also it is easy to export the results into a file.

Answer 6

When using CygWin, if I start a Python process, this is an example of command line:

c:\CygWin\bin\python2.7.exe /usr/local/bin/sudoserver.py

But Process Explorer only sees the main exe:

(note the "path: [Error opening process message]" (see EDIT-1)). Same results for tasklist:

C:\>tasklist | find "python" /i
python2.7.exe                 5740 Console                    1    15.312 KB

So, the only trick I know until now, is finding it via CygWin Bash shell pgrep:

Luis@Kenobi /cygdrive/c/
$ pgrep -f -l server.py
5740 /usr/bin/python2.7 /usr/local/bin/sudoserver.py

It is useful to know this, as long as CygWin cohabits with no problems in Windows, and you can use it to run many POSIX and Python programs.

EDIT: In Windows you don't seem to need administrator priviledges for tasklist. In CygWin you will need them to be able to view an administrator's process (what seems more logical to me: the full command-line could have some parameters like passwords inside), so we must run the CygWin Bash in elevated Administrator Mode.

EDIT-1: This problem will not happen if you run Process Explorer as administrator. Thanks you for pointing, @Pacerier.

Answer 7

go to run or goto start and search:

tasklist -m

tasklist -svc