How to obtain the startup command line parameters of other processes)

Source: Internet
Author: User
How to obtain the startup command line parameter ilsy of other processes:
This program can obtain the command line parameters of other processes.
// Procmdline. cpp (Windows NT/2000)
//
// This example shows how to get the command line for almost any process
// On System for Windows NT/2000
//
//
// (C) 1999 Ashot Oganesyan K, Smartline, Inc
// Mailto: ashot@aha.ru, http://www.protect-me.com, http://www.codepile.com

# Include <windows. h>
# Include <stdio. h>

# Define processbasicinformation 0

Typedef struct
{
Ushort length;
Ushort maximumlength;
Pwstr buffer;
} Unicode_string, * punicode_string;

Typedef struct
{
Ulong allocationsize;
Ulong actualsize;
Ulong flags;
Ulong unknown1;
Unicode_string unknown2;
Handle inputhandle;
Handle outputhandle;
Handle errorhandle;
Unicode_string currentdirectory;
Handle currentdirectoryhandle;
Unicode_string searchpaths;
Unicode_string applicationname;
Unicode_string CommandLine;
Pvoid environmentblock;
Ulong unknown [9];
Unicode_string unknown3;
Unicode_string unknown4;
Unicode_string unknown5;
Unicode_string unknown6;
} Process_parameters, * pprocess_parameters;

Typedef struct
{
Ulong allocationsize;
Ulong unknown1;
Hinstance processhinstance;
Pvoid listdlls;
Pprocess_parameters processparameters;
Ulong unknown2;
Handle heap;
} Peb, * ppeb;

Typedef struct
{
DWORD exitstatus;
Ppeb pebbaseaddress;
DWORD affinitymask;
DWORD basepriority;
Ulong uniqueprocessid;
Ulong inheritedfromuniqueprocessid;
} Process_basic_information;

// NTDLL! Ntqueryinformationprocess (NT specific !)
//
// The function copies the process information of
// Specified type into a buffer
//
// Ntsysapi
// Ntstatus
// Ntapi
// Ntqueryinformationprocess (
// In handle processhandle, // handle to process
// In processinfoclass informationclass, // information type
// Out pvoid processinformation, // pointer to buffer
// In ulong processinformationlength, // buffer size in bytes
// Out Pulong returnlength optional // pointer to a 32-bit
/// Variable that generated es
/// The number of bytes
/// Written to the buffer
//);
Typedef long (winapi * procntqsip) (handle, uint, pvoid, ulong, Pulong );

Procntqsip ntqueryinformationprocess;

Bool getprocesscmdline (DWORD dwid, lpwstr wbuf, DWORD dwbuflen );

Void main (INT argc, char * argv [])
{
If (argc <2)
{
Printf ("Usage:/n/nw.line.exe procid/N ");
Return;
}

Ntqueryinformationprocess = (procntqsip) getprocaddress (
Getmodulehandle ("NTDLL "),
"Ntqueryinformationprocess"
);

If (! Ntqueryinformationprocess)
Return;

DWORD dwid;
Sscanf (argv [1], "% lu", & dwid );

Wchar wstr [255];

If (getprocesscmdline (dwid, wstr, sizeof (wstr )))
Wprintf (L "command line for process % lu is:/n % s/n", dwid, wstr );
Else
Wprintf (L "cocould not get command line! ");

}

Bool getprocesscmdline (DWORD dwid, lpwstr wbuf, DWORD dwbuflen)
{
Long status;
Handle hprocess;
Process_basic_information PBI;
Peb;
Process_parameters procparam;
DWORD dwdummy;
DWORD dwsize;
Lpvoid lpaddress;
Bool Bret = false;

// Get Process Handle
Hprocess = OpenProcess (process_query_information | process_vm_read, false, dwid );
If (! Hprocess)
Return false;

// Retrieve Information
Status = ntqueryinformationprocess (hprocess,
Processbasicinformation,
(Pvoid) & PBI,
Sizeof (process_basic_information ),
Null
);

If (Status)
Goto cleanup;

If (! Readprocessmemory (hprocess,
PBI. pebbaseaddress,
& Peb,
Sizeof (peb ),
& Dwdummy
)
)
Goto cleanup;

If (! Readprocessmemory (hprocess,
Peb. processparameters,
& Procparam,
Sizeof (process_parameters ),
& Dwdummy
)
)
Goto cleanup;

Lpaddress = procparam. CommandLine. buffer;
Dwsize = procparam. CommandLine. length;

If (dwbuflen <dwsize)
Goto cleanup;

If (! Readprocessmemory (hprocess,
Lpaddress,
Wbuf,
Dwsize,
& Dwdummy
)
)
Goto cleanup;

Bret = true;

Cleanup:

Closehandle (hprocess );


Return Bret;
}
---

Tombkeeper:
In the peb structure, processparameters-> CommandLine is a unicode_string, which is the command line. You can use readprocessmemory () to read data.

1. Locate peb from FS: 0
2. The peb offset 0x10 is processparameters.
3. The processparameters offset 0x40 is CommandLine.

Tombkeeper:
For different versions of NT, The peb structure may not be the same and may need to be treated differently.
The ilsy method is more upright.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.