Skip to content

wmic removal #1721 #1722

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Alexander Gottwald (ago1024) wants to merge 2 commits into
base: main
Choose a base branch
from
Open

wmic removal #1721 #1722

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cb72053
wmic removal #1721
ago1024 Oct 26, 2026
b382633
Merge branch 'main' into main
wenytang-ms Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions src/processTree.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,17 +73,17 @@ export function getProcesses(one: (pid: number, ppid: number, command: string, a
if (process.platform === 'win32') {

// attributes columns are in alphabetic order!
const CMD_PAT = /^(.*)\s+([0-9]+)\.[0-9]+[+-][0-9]+\s+([0-9]+)\s+([0-9]+)$/;
const CMD_PAT = /^(.*)\s+([0-9]+)\s+([0-9]+)$/;

const wmic = join(process.env['WINDIR'] || 'C:\\Windows', 'System32', 'wbem', 'WMIC.exe');
proc = spawn(wmic, [ 'process', 'get', 'CommandLine,CreationDate,ParentProcessId,ProcessId' ]);
const command = 'Get-CimInstance Win32_Process | ForEach-Object { "$($_.CommandLine) $($_.ParentProcessId) $($_.ProcessId)" }';

@wenytang-ms wenyt (wenytang-ms) Oct 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please make stdout UTF-8 before decoding it as UTF-8. This keeps already-UTF-8 constrained sessions working and reports a port-attach workaround when policy prevents changing the encoding:

Suggested change
const command = 'Get-CimInstance Win32_Process | ForEach-Object { "$($_.CommandLine) $($_.ParentProcessId) $($_.ProcessId)" }';
const command = `
$ErrorActionPreference = 'Stop'
if ([Console]::OutputEncoding.CodePage -ne 65001) {
if ($ExecutionContext.SessionState.LanguageMode -ne 'FullLanguage') {
throw 'UTF-8 process discovery is restricted by policy. Attach using hostName and port instead.'
}
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
}
Get-CimInstance Win32_Process | ForEach-Object { "$($_.CommandLine) $($_.ParentProcessId) $($_.ProcessId)" }
`;

const powershell = join(process.env['WINDIR'] || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
proc = spawn(powershell, [ '-Command', command ]);

@wenytang-ms wenyt (wenytang-ms) Oct 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please keep this background query independent of user profiles and prevent interactive prompts:

Suggested change
proc = spawn(powershell, [ '-Command', command ]);
proc = spawn(powershell, [ '-NoLogo', '-NoProfile', '-NonInteractive', '-Command', command ], { windowsHide: true });

proc.stdout.setEncoding('utf8');
proc.stdout.on('data', lines(line => {
let matches = CMD_PAT.exec(line.trim());
if (matches && matches.length === 5) {
const pid = Number(matches[4]);
const ppid = Number(matches[3]);
const date = Number(matches[2]);
if (matches && matches.length === 4) {
const pid = Number(matches[3]);
const ppid = Number(matches[2]);
let args = matches[1].trim();
if (!isNaN(pid) && !isNaN(ppid) && args) {
let command = args;
Expand All @@ -102,7 +102,7 @@ export function getProcesses(one: (pid: number, ppid: number, command: string, a
args = '';
}
}
one(pid, ppid, command, args, date);
one(pid, ppid, command, args);
}
}
}));
Expand Down