3 ms·

I wonder what Process Explorer shows. https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx https://technet.microsoft.com/en-us/sysinternals/pro

I wonder what Process Explorer shows. https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx https://technet.microsoft.com/en-us/sysinternals/processexpl...

besselheim 11y ago
It correctly displays those processes, as does the tasklist.exe command line tool, and taskmgr.exe from earlier versions of Windows. Looks like this is just a bug in the Windows 10 Task Manager.
- ygra 11y ago
  Or maybe they forgot to show processes from all users.
  - besselheim 11y ago
    There appears to be no option that will make these processes appear, even if you run the Task Manager as an administrator. It shows all the other processes on the system, just not the ones running in the Linux subsystem.
- poizan42 11y ago
  Those processes are weird compared to normal processes. The main place the user mode information about a process is tracked in a normal windows process is through the Process Environment Block (PEB). You get the list of modules and commandline and tons of other information by reading the PEB of a process. The processes in the Linux subsystem does not interact with the usual usermode parts of Windows at all, so they don't need a PEB. Actually their PEB is mapped to address 0 which is reserved. A lot of APIs for getting information about processes will try to read the PEB, and fail if they can't read that. So if you want useful information about those processes you can only use those APIs that queries the kernel about its information about the process. The Task Manager probably just assumes that it can get all the information normally, and ignores the process if something fails. Maybe it's even the API it uses that's the issue, someone could check whether the ToolHelp32 API even returns those processes (I don't know whether the Task Manager uses the ToolHelp32 API or the lower level PSAPI).

3 ms·

I wonder what Process Explorer shows. https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx https://technet.microsoft.com/en-us/sysinternals/pro

by manojlds 11y ago

I wonder what Process Explorer shows. https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx https://technet.microsoft.com/en-us/sysinternals/processexpl...

besselheim 11y ago
It correctly displays those processes, as does the tasklist.exe command line tool, and taskmgr.exe from earlier versions of Windows. Looks like this is just a bug in the Windows 10 Task Manager.
- ygra 11y ago
  Or maybe they forgot to show processes from all users.
  - besselheim 11y ago
    There appears to be no option that will make these processes appear, even if you run the Task Manager as an administrator. It shows all the other processes on the system, just not the ones running in the Linux subsystem.
- poizan42 11y ago
  Those processes are weird compared to normal processes. The main place the user mode information about a process is tracked in a normal windows process is through the Process Environment Block (PEB). You get the list of modules and commandline and tons of other information by reading the PEB of a process. The processes in the Linux subsystem does not interact with the usual usermode parts of Windows at all, so they don't need a PEB. Actually their PEB is mapped to address 0 which is reserved. A lot of APIs for getting information about processes will try to read the PEB, and fail if they can't read that. So if you want useful information about those processes you can only use those APIs that queries the kernel about its information about the process. The Task Manager probably just assumes that it can get all the information normally, and ignores the process if something fails. Maybe it's even the API it uses that's the issue, someone could check whether the ToolHelp32 API even returns those processes (I don't know whether the Task Manager uses the ToolHelp32 API or the lower level PSAPI).