Skip to content

Why My CMD Opened 0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Aug 11:27
· 18 commits to main since this release
v0.2.0
8754e4c

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

Install

Download wymcmd-0.2.0-win-x64.zip, unpack it anywhere, then:

wymcmd install

That copies both files to %LOCALAPPDATA%\Programs\wymcmd, adds the folder to your PATH and puts
a shortcut in the start menu — no administrator needed. Open a new terminal and wymcmd works
from any folder.

wymcmd doctor              # what this machine can currently tell you
wymcmd sources enable      # one-time, elevated, fully reversible
wymcmd blackbox on         # the recorder: nothing resident, command lines included
wymcmd why last            # what opened that console?

The binary is not code-signed, so SmartScreen will call it an unrecognised app the first time:
"More info", then "Run anyway". A .sha256 ships beside every download.

New in 0.2.0

The black box records command lines. Kernel-Process events carry none, so there are two ETW
sessions now — the manifest one that works everywhere, and a system trace that does carry the
command line — and the reader merges them. Enabling no longer waits for the next boot: both
sessions start immediately, and still nothing of ours stays resident. wymcmd blackbox read
shows what the recorder is holding.

It forgets on purpose. Retention (30 days, 256 MB by default, in settings.json) runs in the
background when capture starts and on demand with wymcmd prune. Stored ancestor chains dropped
their command lines, which were most of a row's weight.

Prefetch is parsed for real — run count and the last eight run times, straight out of the
compressed file — and AmCache answers when this machine first catalogued a binary, with its
SHA-1. So "runs every morning" and "appeared twenty minutes ago" are now different answers.

The window caught up with the command line: a rules view that shows how often each rule would
have fired and can write one from the selected launch, a timeline view that rebuilds a moment
from every source, and export to CSV, JSON lines or a report.

76 tests and a build workflow that runs them on every push. Writing them turned up a real bug
— FlushAsync threw on an unbounded channel — which is fixed.

ARM64 zip is published as well, built from the same source. No ARM machine runs the test
suite, so treat that one as untested.

Verified on Windows 11 26200

  • ETW capture: 500/500 and 300/300 short-lived cmd.exe launches recorded, command lines intact
  • Black box: 136 launches read back from the trace, all 136 with a command line
  • Retroactive: a console started while nothing of ours ran was reconstructed with its full command
    line and attributed, confidence certain
  • Watchdog service: installed, captured, streamed its feed over the named pipe, uninstalled clean

License

Source-available, not open source: free to use, no modification, no redistribution, no resale.

Türkçe: Ekranda parlayıp kaybolan konsolu neyin açtığını söyler — hiçbir şeyimiz çalışmıyorken
olmuş açılışlar için de. Zip'i indir, wymcmd install ile PATH'e koy, yeni bir terminalde
wymcmd doctor ile başla. Bu sürümde kara kutu artık komut satırlarını da kaydediyor, veriler
30 gün / 256 MB politikasıyla kendiliğinden budanıyor, Prefetch ve AmCache okunuyor, pencereye
kurallar, zaman tüneli ve dışa aktarma geldi. Arayüz ve çıktılar tamamen Türkçe: --lang tr.

Assets 9
Loading