Determine if script is running hidden

3
votes

I am trying to programmatically determine if a .ps1 script is running visibly or not. If it is running visibly, it should restart itself hidden. If it is already hidden, take no action.

The problem I have is a loop where it continually restarts itself because hidden status cannot be determined.

I've been looking at both get-process cmdlet and GWMI Win32_process and see nothing like a .visible property to check status. 

    If ($me -eq visible ???)
{
$Invisible = New-Object System.Diagnostics.ProcessStartInfo
$Invisible.FileName = "PowerShell.exe"
$Invisible.windowStyle ="Hidden"
$Invisible.arguments = "$myInvocation.MyCommand.Definition"
$Invisible.Verb = 'runas'
[System.Diagnostics.Process]::Start($Invisible)
}

Any idea what field I can If -eq against ???

4
powershellwmipowershell-2.0powershell-3.0powershell-4.0
or maybe my question is how do I Get - Set the WindowStyle of a running process from powershell so that I do not have to re-invoke. - Knuckle-Dragger
I would use two scripts. One would be a launcher, and the other would be the main script. That would make things a lot simpler, especially for debugging. It's better to be straight-forward than clever in my opinion. You would still however need to be able to detect if the main script is running. I would use a Windows Semaphore object. But that's a different question, so I won't answer it here. If you asked that question ("How to determine if a PowerShell script it running"), I could answer it. - dan-gph
am specifically trying to avoid the second file. - Knuckle-Dragger

4 Answers

3
votes

Try using the user32 function 'IsWindowVisible'

If (-not ([System.Management.Automation.PSTypeName]'My_User32').Type) {
Add-Type -Language CSharp -TypeDefinition @"
    using System.Runtime.InteropServices;
    public class My_User32
    { 
        [DllImport("user32.dll")]
        public static extern bool IsWindowVisible(int hwnd);
    }
"@
}

$proc = Start-Process powershell.exe -WindowStyle Hidden -ArgumentList $myInvocation.MyCommand.Definition -Verb runas -PassThru
If ([My_User32]::IsWindowVisible($proc.MainWindowHandle)) {
    #Window is visible
}
Else {
    #Window is not visible
}

Note that the return value for 'isWindowVisible' isn't strictly a boolean. It returns the WS_VISIBLE style bit of a window. Because the value for hidden is zero and the value for visible is nonzero, it will work as a boolean. But if you want to be safe, you can rewrite the If statement to check for -ne 0 to determine if visible.

Also note the use of $proc.MainWindowHandle. You can't use $proc.Handle, as that is not the handle of the parent window.

For more information on the 'IsWindowVisible' function, see Microsoft documentation at:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms633530%28v=vs.85%29.aspx

For more information on window styles, see Microsoft documentation at:
http://msdn.microsoft.com/en-us/library/czada357.aspx

1
votes

From within the process you can deterine if it's running hidden by testing:

(get-process -Id $PID).StartInfo.WindowStyle
1
votes

You can get the StartInfo properties by capturing new the process:

$proc = [System.Diagnostics.Process]::Start($Invisible)
$proc.StartInfo.WindowStyle

You could also start the process and set its StartInfo using the Start-Process cmdlet 

$proc = Start-Process powershell.exe -WindowStyle Hidden -ArgumentList $myInvocation.MyCommand.Definition -Verb runas -PassThru
$proc.StartInfo.WindowStyle
1
votes

I've created a kludge but it is far from an answer. It has some limitations in that it will false report if the file or folder path contains "Hidden" in it. It also requires calling itself from vbs method because internal Start-Process cmdlet does not report the correct wmi_win32process.commandline like vbs.shell does. 

If ((gwmi win32_process -filter "ProcessID=$PID" | select commandline).commandline -notmatch 'Hidden')
{
$INVISIBLE = $myInvocation.MyCommand.Definition
$COMMAND = "powershell.exe -nologo -WindowStyle Hidden -command $INVISIBLE"
[void][System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');[Microsoft.VisualBasic.Interaction]::Shell("$COMMAND",0)
exit
}

So what it is reading in the commandline is this. On right click, run with powershell (aka run visibly) it results in a wmi.commandline of 

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "B:\INVISIBLE.ps1"

But when re-spawned via the VBS command we can grep for 'Hidden' because VBS plays well with WMI and sends the entire command into the value.

powershell.exe -nologo -WindowStyle Hidden -command B:\INVISIBLE.ps1

Still interested in an answer with a wmi property we can read or method we can toggle.