Tasks plugin for Take Command / TCC / TCC/LE

Version 1.0.25.3     2024-04-02

Charles Dye

Purpose:

This plugin reimplements the ENUMPROCESSES, SERVICES, and TASKLIST commands. These are syntax-compatible to their TCC equivalents, but include new options and new features including more info, sorting and highlighting.

I also provide three new functions, @ELEVATED, @PIDEXENAME, and @PIDSVCNAMES. These expose internal functions which might be useful to the user.

Installation:

To use this plugin, copy Tasks.dll and Tasks.chm to some known location on your hard drive. (If you are still using the 32-bit version of Take Command, take Tasks-x86.dll instead of Tasks.dll.) Load the .DLL file with a PLUGIN /L command, for example:

plugin /l c:\bin\tcmd\test\tasks.dll

If you copy these files to a subdirectory named PlugIns within your Take Command program directory, the plugin will be loaded automatically when TCC starts.

Plugin Features:

New Commands:
ENUMPROCESSES	SERVICES	TASKLIST
New Functions:
@ELEVATED	@PIDEXENAME	@PIDSVCNAMES

Syntax Note:

The syntax definitions in the following text use these conventions for clarity:

BOLD CODE	indicates text which must be typed exactly as shown.
CODE	indicates optional text, which may be typed as shown or omitted.
Bold italic	names a required argument; a value must be supplied.
Regular italic	names an optional argument.
ellipsis…	after an argument means that more than one may be given.

New Commands:

ENUMPROCESSES — List processes started by the specified process.

Syntax:
ENUMPROCESSES /D /O:keys /P /T /W /X pid…

/D	no highlight
/O:keys	sort processes
/P	page output
/T	tree graphics
/W	show window titles and service names
/X	give process IDs in hexadecimal
pid…	may be decimal, or hexadecimal with a leading 0x

You may supply more than one pid, separated by spaces. If no pid is given, the current instance of TCC is assumed.

/O: can sort by several criteria. The available sort keys are:

N	sort by process name
-N	reverse sort by process name
P	sort by process ID
-P	reverse sort by process ID

These can be combined, e.g. /O:NP to sort by process name first, then by process ID. If you type /O by itself, ENUMPROCESSES will sort by process ID, the same as /O:P. Note that TCC’s ENUMPROCESSES command does not support /O.

•  Note: TCC’s native ENUMPROCESSES only accepts a single pid, which must be in decimal. All options /D, /O:, /P, /T, /W, and /X, are new and incompatible with TCC.

---

SERVICES — List, start, or stop services.

Syntax:
SERVICES /I /P /R /S /Tn name…

	Compatible options:
/I	show process IDs
/P	page output
/R	start services
/S	stop services
/Tn	only services of type n (bitmapped):
	1: kernel drivers
	2: filesystem drivers
	16: services which run in their own process
	32: services that share a process
name	may contain wildcards; required with /R or /S
	New options — incompatible with TCC:
/D	no highlight
/F	show filenames if found
/I:pid	show only processes with the specified process ID
/L	show line numbers
/O:keys	sort services
/V	show service type values
/X	show process IDs in hex

This command is intended to be syntax-compatible with its TCC equivalent. However, its operation and output may differ.

Using any of the new options will break compatibility with TCC.

/O: can sort by several criteria. The available sort keys are:

D	sort by display name
-D	reverse sort by display name
N	sort by service name
-N	reverse sort by service name
P	sort by process ID
-P	reverse sort by process ID
S	sort by status
-S	reverse sort by status

These can be combined, e.g. /O:PN to sort by process ID first, then by service name. If you type /O by itself, SERVICES will sort by service names, the same as /O:N. Note that TCC’s SERVICES command does not support /O.

---

TASKLIST — List running processes.

Syntax:
TASKLIST /C /D /H /I /L /M /N /O /P /R /T /U /X /Z name

	Compatible features:
/C	show priority classes
/D	dump names of modules loaded by each process
/H	list threads for each process
/I	show code integrity levels (Vista and later only)
/L	show startup command lines
/M	show memory usage
/N	show window class names
/O	sort processes by PID
/P	page output
/R	show a process tree
/T	show kernel-mode and user-mode times
/U	display owner username for each process
/U:wildspec	only list processes whose owner names match wildspec
/X	display process and thread IDs in hexadecimal
/Z	include parent PIDs
name	a program name, window title, or =PID
	New features — incompatible with TCC:
/E	show extra info
/F	show the filename for each process
/MM	show memory usage in an abbreviated format
/N:opts	disable features
/O:keys	sort processes
options may follow the name; in TCC’s native TASKLIST they must precede it
. may be used to list the current process (shorthand for =%_PID)

This command is syntax-compatible with its TCC equivalent, but is not guaranteed to display the same information. The format will also differ slightly. Using any of the options listed under “New features” will break compatibility with TCC.

/E displays extra information about each process. Elevated processes (‘Run as administrator’) will be marked with an up arrow: ↑   32-bit programs will be marked with a guillemet: »

/N: disables features:

C	disable highlight
D	do not match name against display names (window titles, service names)
F	no footer (summary line)
S	do not collect service names
W	do not collect window titles

You can combine multiple suboptions. The colon is optional. This option is not compatible with TCC.

/O: can sort by several criteria. The available sort keys are:

N	sort by process name
-N	reverse sort by process name
P	sort by process ID
-P	reverse sort by process ID
T	sort by window title or service name
-T	reverse sort by window title or service name
Z	sort by parent process ID
-Z	reverse sort by parent process ID

These can be combined, e.g. /O:ZP to sort by parent process ID first, then by process ID. Note that TCC’s TASKLIST command does not support this syntax. If you type /O by itself, TASKLIST will sort by process ID, the same as /O:P.

---

New Functions:

@ELEVATED — Tests whether a process is elevated.

Syntax:
%@ELEVATED[pid]

pid	the process ID of the process to check

The pid may be entered in decimal, or hexadecimal with a leading 0x. If pid is not specified, the current instance of TCC is assumed. @ELEVATED returns one of:

1	if the specified process is elevated
0	if the specified process is not elevated
-1	on any error

echo %@elevated[0x25A0]

---

@PIDEXENAME — Returns the filename used to start a process.

Syntax:
%@PIDEXENAME[pid]

the process ID of the process to check

The pid is required. It may be entered in decimal, or hexadecimal with a leading 0x.

echo %@pidexename[0x25A0]

---

@PIDSVCNAMES — Returns the names of services with the given process ID.

Syntax:
%@PIDSVCNAMES[pid]

the process ID to check

The pid is required. It may be entered in decimal, or hexadecimal with a leading 0x.

If no process with the given PID is found, @PIDSVCNAMES returns an empty string. If multiple services share the same PID, they will be separated by a semicolon and space.

echo %@pidsvcnames[%@pid[lsass.exe]]

---

Paging Options:

The commands in this plugin have a /P option to page output. This option supports two suboptions:

/P:time,lines

time	time in seconds, or (with a trailing M) milliseconds
lines	number of lines to display before pausing

Both time and lines are optional. The colon is not required, but you must use the comma if you want to specify lines.

rem  Scroll every ten seconds:
type /p:10 myfile.txt

rem  Display ten lines at a time:
type /p:,10 myfile.txt

rem  Display twenty lines at a time, and
rem    scroll every 2.5 seconds:
type /p:2500m,20


At the “Press a key to continue” prompt, most keys will advance by another screenful (or lines). But a few keys behave differently:

A or C	turns off paging, and scrolls continuously
Esc or Ctrl-C	aborts the current command
/	scrolls half a screen, or half of lines
1 to 9	scrolls that many lines, e.g. 3 scrolls three lines

Highlight Variable:

The commands in this plugin feature highlighted output. You can customize this feature by setting an environment variable Highlight:

rem  Disable highlight:
set highlight=none

rem  Set the highlight foreground:
set highlight=bright cyan

rem  Set both foreground and background:
set highlight=bri whi on blu

rem  Numbers are also supported:
set highlight=46


If the Highlight environment variable is not defined, the plugin will check the registry for a value named Highlight of type REG_SZ. The plugin will search, in this order:

•  HKEY_CURRENT_USER\Software\JPPlugins\Tasks	(affects this plugin only)
•  HKEY_CURRENT_USER\Software\JPPlugins	(affects several of my plugins)

Many commands also have a /D or /NC option to disable highlighting.

Startup Message:

This plugin displays an informational line when it initializes. The message will be suppressed in transient or pipe shells. You can disable it for all shells by defining an environment variable named NOLOADMSG, for example:

set /e /u noloadmsg=1

Changes:

Version:	Date:	Changes:
1.0.25.3	2024-04-02	(code changes not relevant to this plugin)
1.0.25.2	2024-03-13	(code changes not relevant to this plugin)
1.0.24.1	2024-01-04	Updated to conlist v1.1 to better support Ctrl-C and Ctrl-Break.
1.0.24.0	2023-10-20	ENUMPROCESSES: added /W; allow . as a synonym for %_PID. All functions which expect a PID now accept . as a synonym for %_PID.
1.0.23.2	2023-10-13	Tweaked ShowCmdHelp() to include VER_PATCH.
1.0.23.1	2023-10-12	Updated the plugin’s web address.
1.0.23.0	2023-10-06	ENUMPROCESSES improvements: added /O:. If a process name was specified, does not contain a period, and was not found, append “.exe” and try again. Added a couple of missing options to ENUMPROCESSES’s help text.
1.0.22.0	2023-10-05	Added @PIDSVCNAMES.
1.0.21.0	2023-10-05	If more than one /HL: is given, the wildspecs will be concatenated.
1.0.20.0	2023-10-04	Bug fix: if a process's alleged parent was started after the process, then your daddy ain't your daddy (but your daddy don't know). Formatting fix: TASKLIST /Z now shows "no parent" as a blank, not a zero.
1.0.19.1	2023-09-15	Tightened up whitespace in TASKLIST to more closely resemble TCC’s.
1.0.19.0	2023-09-15	TASKLIST /R with no process name or pid specified now behaves more like TCC’s, though not exactly the same. It displays a process tree for every process found which does not have an extant parent.
1.0.18.3	2023-09-01	Added support for SECURITY_MANDATORY_PROTECTED_PROCESS_RID (theoretical, at this point; I have no processes running at this level.)
1.0.18.2	2023-09-01	TASKLIST /E now marks WOW64 processes with a right guillemet instead of an arrowhead (less distracting). Minor tweaks to help text: options were out of (alphabetical) order in /O? text for TASKLIST.
1.0.18.0	2023-08-29	TASKLIST: allow PID without a leading equals sign, only if it is an actual, current PID.
1.0.17.0	2023-04-12	Added /HL: option to TASKLIST and SERVICES. Now supports matching multiple wildspecs (|-separated) in many places.
1.0.16.0	2023-03-01	Added optional ‘full’ help text; #define TASKS_FULL_HELP to enable. This expanded text includes more options, those not common to TCC’s native commands.
1.0.15.0	2023-02-28	Changes to support post-TCC/LE versions of TCC.

Status and Licensing:

This plugin is © Copyright 2024, Charles Dye. Unaltered copies of the binary and documentation files may be freely distributed without restriction. I make no guarantee and give no warranty for its operation. If you find a problem, you can report it in the JP Software support forum.

Download:

You can download the current version of the plugin from http://charlesdye.net/dl/tasks.zip.