If I can see a process running using
ps -e, how can I find the file which launched it?
On Linux: if you know the PID, you can cat the cmdline file for that file. E.g.:
This will probably fail if the binary was moved after the program was started.
And of course:
which is a symbolic link to the executable.
Copy the process id from
None of the methods (
This is my winner,:
Or, in order to obtain only the PID to use it in programming:
Tested on Kali Linux v1.0.6 (Debian based).