0

This question already has an answer here:

I have a program in Windows 7 that launches ffmpeg in an external command prompt window but it is impossible to see what arguments were passed in.

Is there a way to see what arguments were given?

marked as duplicate by Ƭᴇcʜιᴇ007 windows-7 Jan 7 '16 at 22:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    ProcessExplorer (from Microsoft) can do this as well. It even have a handy tree view. – billc.cn Jan 7 '16 at 20:37
  • @Ƭᴇcʜιᴇ007 This question does not mention a running program, just a program that was launched, which may have long ended before one had a chance to look at a list of running processes in their favorite utility. As such, I don't see the reason to mark it as a duplicate. – dxiv Jan 8 '16 at 3:35
  • @dxiv You should edit your question to make that clear. At the moment it doesn't mention you requirement to know about a program that has already ended (which by the way invalidates my answer). If you don't update the question it probably won't get reopened. – DavidPostill Jan 8 '16 at 9:21
  • @DavidPostill It's obviously not my question (though I edited the title to better match the contents). It is true that the question does not mention the program having ended, but it also doesn't mention it having not ended (and, as it happens, there do exist quick ffmpeg tasks that can take a fraction of a second to complete). Marking the question outright as a duplicate relies on the additional assumption that the program is still running, which is simply not present in the question as asked. A request to clarify, or flag for insufficient information, would have been more appropriate. – dxiv Jan 9 '16 at 1:31
  • @dxiv Apologies, I mistook you for the OP. In that case if the OP thinks it is not a duplicate it is up to him to edit his question, say why it is not a duplicate for him, and it will go into the reopen queue. – DavidPostill Jan 9 '16 at 9:08
1

Is there a way to see what arguments were given?

ProcessHacker (a Task Manager replacement) will display the command line arguments for any selected process:

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.

Example:

F:\test>cmd /c test.cmd

F:\test>echo off
Press any key to continue . . .

In ProcessHacker:

  1. Select the process you are interested in.

    There may be several cmd shell processes running and you will have to make sure you select the correct one. Hovering over the process name will show the command line so you know the correct one to select:

    enter image description here

  2. Right click and select "Properties" or just press Enter.

  3. The resulting "Properties" dialog shows the command line used to start the process.

    enter image description here


Disclaimer

I am not affiliated with ProcessHacker in any way, I am just an end user of the software.

  • Windows' built-in Task Manager also shows the full command line for a running process under the Command Line column in the Processes tab, so there is no real need for a 3rd party utility. That said, if the process closes too quickly to catch a glimpse of its command line in the list of running processes, then @Craig620's answer works better. – dxiv Jan 8 '16 at 3:29
1
  1. Edit local policy and enable "Audit Process Tracking" (secpol.msc)
  2. Install KB3004375 and reboot https://support.microsoft.com/en-us/kb/3004375
  3. Enable Audit Process Creation/Include CLI (gpedit.msc)
  4. If you're using Win7 Home instead of professional you won't have gpedit.msc. Regedit to HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit. Set key ProcessCreationIncludeCmdLine_Enabled = 1

  5. Run the program that launches FFMEG

  6. Review the security event log for event ID 4688

auditPol

auditCli

4688

Not the answer you're looking for? Browse other questions tagged or ask your own question.