Detecting running program spawned by Java

The Toolkit General Discussion
1

Trying to look for a way to detect a running program that is spawned by java.exe. The program name is Tracker which uses Open Source Physics Java framework.

image
image236×179 5.85 KB

Normally I’d just use the .exe name as a parameter for Show-ADTInstallationWelcome -CloseProcesses but I can’t pass “java” in this instance as the user may be running other apps that use Java. I tried passing “Tracker” but the installer happily continued and ended up with an error as it could not completely uninstall the program since it was still running.

2

Ooooh, That’s an interesting challenge, I like a challenge :grinning_face_with_smiling_eyes:

I’ve had a quick Google (“Other search engines are available”)
If you have JDK installed the command jps may help, or this this ‘might’ work

Get-CIMInstance Win32_Process -Filter {CommandLine LIKE '%tracker%' and name = 'java.exe'}

N.B. The CommandLine would depend on the name of the ‘Tracker’ applications path

N.B. You would need to run the Get-CIMInstance command as Admin as some Java apps run under the Network Service which would need Admin credentials to reliably interogate

1 Like
3

The upcoming 4.1.0 release allows more advanced filtration for running processes, such as by full path and other process properties.

Using the source code for the RunningProcess class here, you’ve got:

  • Process (a standard System.Diagnostics.Process object as returned via Get-Process)
  • Description (either a custom description if you specified one, or the app’s title, which may very well be “Tracker”)
  • FileName (the full path of the process, named to match System.Diagnostics.ProcessModule’s FileName property.
  • Arguments (the arguments used when starting the process)

The next release is due soon. We’re hoping to have it out by the end of Q2, but the quality of our release is more important than a “come hell or high water” release date.

2 Likes
4

You can use some code similar to the one below to find parent processes:

$processID = #the ID you want to query

# Open object to store all parents for returning. This also avoids an infinite loop situation.
$parents = [System.Collections.Generic.List[Microsoft.Management.Infrastructure.CimInstance]]::new()

# Get all processes from the system. WMI consistently gives us the parent on PowerShell 5.x and Core targets.
$processes = Get-CimInstance -ClassName Win32_Process
$process = $processes | & { process { if ($_.ProcessId -eq $processID) { return $_ } } } | Select-Object -First 1

# Get all parents for the currently stored process.
while ($process = $processes | & { process { if ($_.ProcessId -eq $process.ParentProcessId) { return $_ } } } | Select-Object -First 1)
{
    if ($parents.Contains($process))
    {
        break
    }
    $parents.Add($process)
}
1 Like