Question

我正在使用以下命令杀死cmd中的一些任务：

taskkill /f /im innovyze* /t

它完成工作并杀死所有IMAGENAME中的任务；但是，看着它给了我什么，我看到了一些有趣的东西。看下面：

SUCCESS: The process with PID 14712 (child process of PID 9068) has been terminated.
SUCCESS: The process with PID 12184 (child process of PID 9068) has been terminated.
SUCCESS: The process with PID 16344 (child process of PID 9068) has been terminated.
SUCCESS: The process with PID 6816 (child process of PID 9068) has been terminated.
SUCCESS: The process with PID 10656 (child process of PID 9068) has been terminated.
SUCCESS: The process with PID 14912 (child process of PID 9068) has been terminated.
SUCCESS: The process with PID 11908 (child process of PID 9068) has been terminated.
SUCCESS: The process with PID 9068 (child process of PID 10060) has been terminated.

因此，正如预期的那样，所有进程都附加到一个集中任务PID = 9068中。但是，该过程还是PID = 10060的子过程，它是PID的{{1}}。这项工作没有explorer.exe。因此，我很惊讶地看到它是GUI的子进程。

因此，这是主要问题： windows中explorer下将进行哪种处理？

_{注意：这距离我的专业知识和知识领域很远，所以请宽恕我使用错误的术语或者我的问题很广泛。如果一切结束，我不会感到惊讶。}

Answer 1

父进程与子进程是图形，控制台还是服务应用程序无关。如果资源管理器是父级，则仅意味着资源管理器称为CreateProcess或另一个进程称为CreateProcess或CreateProcessAsUser，并将资源管理器的句柄替换为子项的PROC_THREAD_ATTRIBUTE_PARENT_PROCESS。 / p>

例如，如果用户双击资源管理器中的.py脚本图标，则外壳程序将查找文件关联（例如，使用IQueryAssociations接口的内部实现）并使用该脚本执行相应的程序作为参数，使用"C:\Windows\py.exe" "path\to\script.py"之类的命令。如果直接执行，Explorer会以此命令行作为参数调用CreateProcess。如果它是“以管理员身份运行”，Explorer会将请求发送到Application Information服务，该服务通过CreateProcessAsUser创建提升的流程，并通过上述流程创建属性将Explorer设置为父级。

Answer 2

以下.bat脚本可以帮助理解父/子进程及其行为……

@ECHO OFF
SETLOCAL EnableExtensions DisableDelayedExpansion
echo "%~1%~2%~3" | findstr /I "\? \/h \-h">NUL 2>&1
if %errorlevel% EQU 0 goto :usage 

set "_explorerName=explorer.exe"
set "_NameToKill=%~1"
set "_Terminate=%~2"
set "_KillForce=%~3"

if NOT defined _NameToKill if not [%1]==[] (
  rem debugging 
  set "_NameToKill=CMD.EXE"
  rem debugging: start a child process
  start "" /MIN notepad.exe
)

for /F "tokens=1,2 delims=," %%G in ('
    TASKLIST /NH /FI "IMAGENAME eq %_explorerName%"  /FO CSV
') do (
  set "_explorerPID=%%~H"
)
ECHO checking '%_NameToKill%*' as child of %_explorerName% ^(PID=%_explorerPID%^)  
for /F "skip=1 tokens=1-3" %%G in ('
    wmic process WHERE "Name like '%_NameToKill%%%' and ParentProcessId=%_explorerPID%" get Name^,ParentProcessId^,ProcessId^,Status
') do (
  if NOT "%%H"=="" (
    echo %%G
    for /F "skip=1 tokens=1-3" %%g in ('
        2^>NUL wmic process WHERE "ParentProcessId=%%I" get Name^,ParentProcessId^,ProcessId^,Status
    ') do (
      if NOT "%%h"=="" (
        echo    ProcessId=%%i, ParentProcessId=%%h, %%g child of %%G ^(%%I^)
        if defined _Terminate (
          if /I "%%~g"=="conhost.exe" (
            rem debugging
            taskkill /PID %%i /T
          ) else (
            taskkill /PID %%i %_Terminate% %_KillForce%
          )
          echo(
        )
      )
    )
    echo    ParentProcessId=%%H, ProcessId=%%I, %%G child of %_explorerName% ^(%_explorerPID%^)
    if defined _Terminate (
      taskkill /PID %%I /T
      echo(- 
    )
  )
)
if [%1]==[] goto :usage
:endlocal
ENDLOCAL
goto :eof

:usage
  echo USAGE:
  echo %~nx0 -? ^| /? ^| /h ^| -h           this help message
  echo %~nx0                             list all childs of %_explorerName%
  echo %~nx0 ^<processName^> [/T] [/F]     list all childs of a process
  echo %~nx0 ""            [/T] [/F]     a particular test case for cmd.exe
  echo(
  echo Optional parameters /T and /F ^(or -T and -F^): see taskkill /? 
goto :endlocal

Explorer.exe作为Windows中的父进程

2 个答案: