How do I determine if a process on Windows "has no parent"?

1,025

I am not sure how to do it from command line, but I wrote this to do some filtering of OS related processes from PowerShell. Maybe it will give you an idea. It skips items owned by service, system and null.

gwmi win32_process |select ProcessID,ParentProcessID,Name, @{l="Username";e={$_.getowner().user}}|where {$_.Username -ne "SYSTEM"} | where {$_.Username -ne "LOCAL SERVICE"} | where {$_.Username -ne "NETWORK SERVICE"} | where {$_.Username -ne $null} |Sort-Object ProcessID | ft -AutoSize
#

Output

    ProcessID ParentProcessID Name            Username
    --------- --------------- ----            --------
     2136     3460            notepad.exe     KNUCKLE-DRAGGER
     2504     3460            firefox.exe     KNUCKLE-DRAGGER
     2792      700            dllhost.exe     KNUCKLE-DRAGGER
     2816     4232            conhost.exe     KNUCKLE-DRAGGER
     2916     3460            powershell.exe  KNUCKLE-DRAGGER
     3128     3460            notepad.exe     KNUCKLE-DRAGGER
     3180      576            taskhost.exe    KNUCKLE-DRAGGER
     3196     4308            vmware-tray.exe KNUCKLE-DRAGGER
     3460     4392            explorer.exe    KNUCKLE-DRAGGER
     3644     4636            vmware-vmx.exe  KNUCKLE-DRAGGER
     3696     3460            mplayerc.exe    KNUCKLE-DRAGGER
     4636     3196            vmware.exe      KNUCKLE-DRAGGER
     4828     3460            notepad.exe     KNUCKLE-DRAGGER
Share:
1,025

Related videos on Youtube

dean
Author by

dean

Updated on September 18, 2022

Comments

  • dean
    dean over 1 year

    I'v try to make a SlectBox with react native.

    To make that dropdown menu can be floated, I gava an absolute position to wrapper View, then make a clickable component with TouchableOpacity inside that View. It works well on Ios and Web, but not on android. There were many solutions on google like reordering component or give a zIndex to WrapperView or use Pressable etc.., but I could not find proper solution for my case.

    Belows are my whole code. and You can test this code here.

    Thank you in advance.

    import {
      Animated,
      Easing,
      Platform,
      StyleProp,
      TextStyle,
      TouchableOpacity,
      View,
      ViewStyle,
    } from 'react-native';
    import {DoobooTheme, light, useTheme} from '../theme';
    import React, {FC, ReactElement, useEffect, useRef, useState} from 'react';
    
    import {Icon} from '../Icon';
    import {Typography} from '../Typography';
    import styled from '@emotion/native';
    import {withTheme} from '@emotion/react';
    
    const Title = styled.View`
      width: 200px;
      height: 30px;
      border-width: 1px;
    
      flex-direction: row;
      justify-content: center;
      align-items: center;
    `;
    
    const Item = styled.View`
      height: 30px;
      width: 200px;
      border-bottom-width: 1px;
      border-left-width: 1px;
      border-right-width: 1px;
    
      justify-content: center;
      align-items: center;
    `;
    
    type Styles = {
      titleContainer?: StyleProp<ViewStyle>;
      titleText?: StyleProp<TextStyle>;
      rightElementContainer?: StyleProp<ViewStyle>;
      itemContainer?: StyleProp<ViewStyle>;
      itemText?: StyleProp<TextStyle>;
    };
    interface ItemCompProps {
      value: string;
      order: number;
      styles?: Styles;
      setIsOpened: (value: boolean) => void;
      itemActiveOpacity: number;
      onPress?: (i: number) => void;
    }
    
    const ItemComp: FC<ItemCompProps> = ({
      value,
      order,
      styles,
      setIsOpened,
      itemActiveOpacity,
      onPress,
    }) => {
      const {theme} = useTheme();
    
      const handlePress = (): void => {
        onPress?.(order);
        setIsOpened(false);
      };
    
      return (
        <TouchableOpacity onPress={handlePress} activeOpacity={itemActiveOpacity}>
          <Item
            style={[
              {
                borderColor: theme.primary,
                backgroundColor: theme.textContrast,
              },
              styles?.itemContainer,
            ]}>
            <Typography.Body2 style={styles?.itemText}>{value}</Typography.Body2>
          </Item>
        </TouchableOpacity>
      );
    };
    
    interface Props {
      data: string[];
      onPress?: (i: number) => void;
      selectedIndex?: number;
      theme?: DoobooTheme;
      style?: StyleProp<ViewStyle>;
      styles?: Styles;
      rotateDuration?: number;
      titleActiveOpacity?: number;
      itemActiveOpacity?: number;
      isRotate?: boolean;
      rightElement?: ReactElement | null;
    }
    
    const Component: FC<Props> = ({
      data,
      onPress,
      selectedIndex = 0,
      style,
      styles,
      rotateDuration = 200,
      titleActiveOpacity = 1,
      itemActiveOpacity = 1,
      isRotate: shouldRotate = true,
      rightElement = <Icon name="chevron-down-light" />,
    }) => {
      const {theme} = useTheme();
      const [isOpened, setIsOpened] = useState(false);
    
      const rotateAnimValue = useRef(new Animated.Value(0)).current;
    
      useEffect(() => {
        const toValue = isOpened ? 1 : 0;
    
        if (!shouldRotate) rotateAnimValue.setValue(toValue);
    
        Animated.timing(rotateAnimValue, {
          toValue,
          duration: rotateDuration,
          easing: Easing.linear,
          useNativeDriver: Platform.OS !== 'web' ? true : false,
        }).start();
      }, [isOpened, rotateAnimValue, rotateDuration, shouldRotate]);
    
      return (
        <View style={[style]}>
          <TouchableOpacity
            onPress={() => setIsOpened((prev) => !prev)}
            activeOpacity={titleActiveOpacity}>
            <Title
              style={[
                {
                  borderColor: theme.primary,
                  backgroundColor: theme.textContrast,
                },
                styles?.titleContainer,
              ]}>
              <Typography.Body2 style={styles?.titleText} testID="selected-value">
                {data[selectedIndex]}
              </Typography.Body2>
              {rightElement ? (
                <Animated.View
                  style={[
                    {
                      position: 'absolute',
                      right: 10,
                      transform: [
                        {
                          rotate: rotateAnimValue.interpolate({
                            inputRange: [0, 1],
                            outputRange: ['0deg', '180deg'],
                          }),
                        },
                      ],
                    },
                    styles?.rightElementContainer,
                  ]}>
                  {rightElement}
                </Animated.View>
              ) : null}
            </Title>
          </TouchableOpacity>
          <View>
            <View style={{position: 'absolute'}}>
              {isOpened &&
                data.map((datum, key) => (
                  <ItemComp
                    key={key}
                    order={key}
                    value={datum}
                    styles={styles}
                    setIsOpened={setIsOpened}
                    onPress={onPress}
                    itemActiveOpacity={itemActiveOpacity}
                  />
                ))}
            </View>
          </View>
        </View>
      );
    };
    
    Component.defaultProps = {theme: light};
    
    export const SelectBox = withTheme(Component);
    
    

    My solution

    I resolved this problem with react-native-gesture-handler. :) Install react-native-gesture-handler, then using TouchableOpacity from that.

  • Knuckle-Dragger
    Knuckle-Dragger over 10 years
    and you can see most items in the list are owned by 3460 which is my explorer.exe
  • user972276
    user972276 over 10 years
    I guess in my example, all processes would not be owned by system, local service, or network service. But, all processes I am trying to look at have actually been created by a Windows service running under the LOCAL SYSTEM user. So the differentiation have to work for both types of processes started in session 0 under the local system user.
  • user1984103
    user1984103 over 10 years
    You need to look at which processes have a parent process ID that doesn't exist. I.e., if explorer.exe's parent process is listed as PPID 5072, but there is no process with a PID of 5072 running on the system, then you have an unparented process.
  • Knuckle-Dragger
    Knuckle-Dragger over 10 years
    so create one GWMI of parent id's filtering just the processes you want to check, then run a second GWMI of all pids and foreach on the list of parent id's from the first query. The ones that don't have match are $profit.
  • dean
    dean over 2 years
    Thank you for answering me. But I'm little confused how can I apply your solution.
  • Shubham Waje
    Shubham Waje over 2 years
    Which touchable opacity is not working one in ItemComp or one in Component?
  • dean
    dean over 2 years
    Opps! It's InItemComp :)
  • dean
    dean over 2 years
    Thank you for your answer. I tried to do that like you said, but it doesn't work as I wish. I solve this problem with react-native-gesture-handler. :)