1

I know how to list all the processes in the system by running:

0: kd>dx -r1 Debugger.Sessions[0].Processes  

OR
0: kd>.tlist

But how can I search for a process by name?
I tried to use the Contains function but it didn't work:

0: kd> dx -r1 Debugger.Sessions[0].Processes.Contains("chrome.exe")
Error: Cannot compare non-intrinsic values to each other. 
1

Here is how to do it:

dx @$cursession.Processes.Where(p => p.Environment.EnvironmentBlock.ProcessParameters->CommandLine->ToDisplayString().Contains("chrome"))  

If you have other way, please share.

0

You Cannot use contains for objects they are not strings
contains only is meaningful when you have a partial case Sensitive pattern

here is how you may use contains

0: kd> dx Debugger.Sessions.First().Processes.Where(p=>p.Name.Contains("Taskm"))
Debugger.Sessions.First().Processes.Where(p=>p.Name.Contains("Taskm"))
    [0x2c14]         : Taskmgr.exe

or if you have a proper complete case sensitive pattern you can simply use == on the Process name

0: kd> dx Debugger.Sessions.First().Processes.Where(p=>p.Name  == "Taskmgr.exe")
Debugger.Sessions.First().Processes.Where(p=>p.Name  == "Taskmgr.exe")
    [0x2c14]         : Taskmgr.exe
0: kd> dx Debugger.Sessions.First().Processes.Where(p=>p.Name  == "tAskmgr.exe")
Debugger.Sessions.First().Processes.Where(p=>p.Name  == "tAskmgr.exe")
0: kd>  

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.