深入解析windows XP/2003：查看进程树

在windows调试工具箱中使用tilist.exe的/t开关，显示进程树。

Microsoft Windows XP [版本 5.1.2600]
(C) 版权所有 1985-2001 Microsoft Corp.

C:/Program Files/Debugging Tools for Windows (x86)>tlist /t
System Process (0)
System (4)
smss.exe (420)
csrss.exe (476)
winlogon.exe (500)
services.exe (544)
svchost.exe (704)
svchost.exe (752)
svchost.exe (820)
svchost.exe (880)
svchost.exe (944)
ZhuDongFangYu.exe (972)
spoolsv.exe (1028)
svchost.exe (1996)
360rp.exe (2024)
WPService.exe (116)
sqlservr.exe (200)
nmesrvc.exe (560)
cmd.exe (1768)
perl.exe (1776)
isqlplussvc.exe (892)
TNSLSNR.EXE (1248)
sqlwriter.exe (1284)
svchost.exe (1332)
alg.exe (2852)
lsass.exe (556)
explorer.exe (1272) Program Manager
360tray.exe (1448)
TheWorld.exe (1076) 个人空间—后台 - 世界之窗 3.0
flashget.exe (3208)
cmd.exe (1560) windows调试工具箱 - tlist /t
conime.exe (688)
tlist.exe (1100)
java.exe (1868)
emagent.exe (2284)

C:/Program Files/Debugging Tools for Windows (x86)>

以上使用缩进形式显示了进程的父子关系，为了证明windows仅维护了父进程ID而没有记录更多的信息，我们实验如下：

1、start cmd

2、打开任务管理器

3、切换到第二个cmd

4、运行画笔，输入mspaint

5、在这个命令窗口中输入exit

6、切换到任务管理器，在应用程序视图中选择command prompt任务，选择转到进程

7、点击加亮显示的cmd

8、结束进程树

9、在弹出的警告中选择yes

结果，第一个cmd会消失，但是仍然可以看到画笔窗口，因为它是你所终止的命令的孙子进程，而且由于中间进程，（画笔的父进程）已经被终止，所以父进程和孙子进程之间已经没有链接了。

C:/Program Files/Debugging Tools for Windows (x86)>tlist /?
Microsoft (R) Windows NT (TM) Version 5.1 TLIST
Copyright (c) Microsoft Corporation. All rights reserved.

usage: TLIST <<-m <pattern>> | <-t> | <pid> | <pattern> | <-p <processname>>> |
<-k> | <-s>
[options]:
-t
Print Task Tree

<pid>
List module information for this task.

<pattern>
The pattern can be a complete task
name or a regular expression pattern
to use as a match. Tlist matches the
supplied pattern against the task names
and the window titles.

-c
Show command lines for each process

-e
Show session IDs for each process

-g
Show group affinity for each process (Win7+)

-k
Show MTS packages active in each process.

-m <pattern>
Lists all tasks that have DLL modules loaded
in them that match the given pattern name

-s
Show services active in each process.

-p <processname>
Returns the PID of the process specified or -1
if the specified process doesn't exist. If there
are multiple instances of the process running only
the instance with the first PID value is returned.

-v
Show all process information

-w
Show Wow64 process information

C:/Program Files/Debugging Tools for Windows (x86)>