@echo off wmic process |find /i "Caption" |perl -CS -ne "($caption,$commandline,$ppid,$pid)=unpack('a[21] a[270] @798a[17] @899a[11]',$_);print '}',$caption,'-',$ppid,'-',$pid,'-',$commandline,'{',$/;" |find /i "parent" wmic process |find /i "%1" |perl -CS -ne "($caption,$commandline,$ppid,$pid)=unpack('a[21] a[270] @798a[17] @899a[11]',$_);print '}',$caption,'-',$ppid,'-',$pid,'-',$commandline,'{',$/;" |find /v /i "find" #### #!/usr/bin/perl -WCD use strict; use warnings; use Data::Dumper; $\ = $/; my $debug = 1; #array of fields to display my @processFields = ('Caption','ParentProcessId','ProcessId','CommandLine'); #ARGV processing #my $searchfor = $ARGV[0] ? join(' ',@ARGV) : die("I need a process to look for."); # corrected, per bug in discussion below. You might also check out the style discussion not changed here. my $searchfor = @ARGV ? join(' ',@ARGV) : die("I need a process to look for."); #set up handle - note -CD arg, above open (PROCINFO, "wmic process |")||die("Can't open wmic for process info pipe!"); #loop my $template=''; while () { #first time get header, find position of columns, build unpack template unless ($template) { while (@processFields) { my @allFields = split; my $field = pop @processFields; my $fieldIndex; for ($fieldIndex=0; $fieldIndex<=$#allFields; $fieldIndex++) { if ($allFields[$fieldIndex] eq $field) { last; } #assert: found $field in @allfields with index $fieldIndex } pos=undef; /\b$field\b/g or die("Could not find field $field"); my $fieldPos = pos; $fieldPos = $fieldPos - length($field); my $nextFieldPos; if ($fieldIndex+1 <= $#allFields) { pos=undef; /\b$allFields[$fieldIndex+1]\b/g or die("Could not find next field $allFields[$fieldIndex+1]"); $nextFieldPos = pos; $nextFieldPos = $nextFieldPos - length($allFields[$fieldIndex+1]); } else { $nextFieldPos = length($_)+1; } my $fieldlength = $nextFieldPos - $fieldPos; $template = '@'.$fieldPos.'a['.$fieldlength.'] '.$template; } #do it once for the header row my $fieldVal; my $outLine=''; foreach $fieldVal (unpack($template, $_)) { $outLine .= ($outLine?'-':'}').$fieldVal; } $outLine .= '{'; print $outLine; #all other times look for, unpack and display if matches arg } if (/$searchfor/) { my $fieldVal; my $outLine=''; foreach $fieldVal (unpack($template, $_)) { $outLine .= ($outLine?'-':'}').$fieldVal; } $outLine .= '{'; print $outLine; } } close(PROCINFO);