How can I get the CommandLine through the process start event provided by Microsoft-Windows-Kernel-Process in etw

Question

I saw here （https://learn.microsoft.com/zh-cn/windows/win32/etw/process-typegroup1） that the property of the ProcessStart event has CommandLine, so I tried to use logman to capture the start event of the process.

logman create trace ProcessTest -p Microsoft-Windows-Kernel-Process

But I found that there is no CommandLine item in the process start event I caught.

What am I doing wrong, or is there any way to get it?

Answer 1

Hello,

Welcome to Microsoft Q&A!

According to your description, whether you want to get the CommandLine of another process? If so, I don't advise you to do this.

Win32 doesn’t expose a process’s command line to other processes. From Win32’s point of view, the command line is just a string that is copied into the address space of the new process. How the launching process and the new process interpret this string is governed not by rules but by convention.

For more details, I suggest you could refer to the Blog: How do I get the command line of another process?

Thank you.

Jeanine

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.