The Process List plugin does not show environment variables and command line (F3) for some processes irrespective whether they are system or user ones.
Here are some popular processes with no environment variables and command line on my PC:
chrome.exe - Chrome 81.0.4044.113 (Official Build) (64-bit)
outlook.exe - MS Office 2019 (Office 365)
winword.exe - MS Office 2019 (Office 365)
devenv.exe - VS 2019
But there are some with available information (environment and command line):
Telegram.exe - Telegram messenger
Skype.exe - Skype 8.58 (not a Windows Store version)
Far.exe - no comments
OneDrive.exe - OneDrive
In Windows Task Manager all of them have command line at least.
Any idea why?
// Windows 10 x64 [Version 10.0.19041.207] / Far 3.0.0.5588 x86
Process List plugin does not show environment and command line
- DrKnS
- Posts: 6114
- Joined: Thu 04 Aug, 2005 06:44
- Location: Kyiv
- Has thanked: 12 times
- Been thanked: 426 times
Process List plugin does not show environment and command line
Probably "access denied" when opening those processes. Are they elevated? Is Far elevated? Is Task Manager elevated?
-
- Posts: 1326
- Joined: Mon 04 Apr, 2005 13:41
- Location: San Ramon, CA / Kharkov, UA
- Has thanked: 32 times
- Been thanked: 61 times
Process List plugin does not show environment and command line
Far is running as administrator (red icon). But the result for problematic processes is the same whether Far is elevated or not. It seems Windows Task Manager is elevated by default.
I gave a few examples of problematic processes with the issue (like devenv.exe, hope you have one). Can you check whether cmdline/env is visible on your PC? I have two laptops running Windows 10 x64 (builds 1909, 2004) and both have the same issue.
I gave a few examples of problematic processes with the issue (like devenv.exe, hope you have one). Can you check whether cmdline/env is visible on your PC? I have two laptops running Windows 10 x64 (builds 1909, 2004) and both have the same issue.
Мы не можем ждать милостей от Фара, взять их у него — наша задача! (C) Мичурин
- DrKnS
- Posts: 6114
- Joined: Thu 04 Aug, 2005 06:44
- Location: Kyiv
- Has thanked: 12 times
- Been thanked: 426 times
Process List plugin does not show environment and command line
In my case it works fine with any non-elevated process, but it's Windows 7, I don't have Windows 10 currently. Maybe it's OS-specific.
I've added reading the command line via WMI: Does it work? (wait a few seconds after opening the panel, WMI is slow). Probably it won't change anything, but just in case.
I've added reading the command line via WMI: Does it work? (wait a few seconds after opening the panel, WMI is slow). Probably it won't change anything, but just in case.
-
- Posts: 1326
- Joined: Mon 04 Apr, 2005 13:41
- Location: San Ramon, CA / Kharkov, UA
- Has thanked: 32 times
- Been thanked: 61 times
Process List plugin does not show environment and command line
This is a 64-bit version of dll, I'm using Far 32-bit version now. BTW there is no problem with Far x64 Process List plugin (from build 5576).
EDIT: Just double checked the latest Far x64 (5587) with Process List (out of the box) - everything is fine. Only Far x86 version has the issue.
EDIT: Just double checked the latest Far x64 (5587) with Process List (out of the box) - everything is fine. Only Far x86 version has the issue.
Last edited by Yegor on Thu 16 Apr, 2020 23:38, edited 1 time in total.
Мы не можем ждать милостей от Фара, взять их у него — наша задача! (C) Мичурин
- t-rex
- Страшный и ужасный
- Posts: 4910
- Joined: Tue 15 Mar, 2005 16:17
- Location: Tel-Aviv
- Has thanked: 1 time
- Been thanked: 8 times
- Contact:
Process List plugin does not show environment and command line
Build 5588 shows the command line after about 10-20 seconds of opening the plugin panel.
- DrKnS
- Posts: 6114
- Joined: Thu 04 Aug, 2005 06:44
- Location: Kyiv
- Has thanked: 12 times
- Been thanked: 426 times
Process List plugin does not show environment and command line
The plugin reads various process data via ReadProcessMemory calls, using pointers from PEB.
Strings there are represented as { size, max_size, data_pointer }.
The first call populates the structure, the second reads the data from data_pointer.
Obviously, data_pointer is 8 bytes in x64, but 4 bytes in x86, so pointer truncation can happen any time.
It looks like NtWow64ReadVirtualMemory64 can help, I'll try that later.
-
- Posts: 1326
- Joined: Mon 04 Apr, 2005 13:41
- Location: San Ramon, CA / Kharkov, UA
- Has thanked: 32 times
- Been thanked: 61 times
Process List plugin does not show environment and command line
196 works fine, thank you.
Мы не можем ждать милостей от Фара, взять их у него — наша задача! (C) Мичурин