How to obtain the startup command line parameters of other processes)

How to obtain the startup command line parameter ilsy of other processes:
This program can obtain the command line parameters of other processes.
// Procmdline. cpp (Windows NT/2000)
//
// This example shows how to get the command line for almost any process
// On System for Windows NT/2000
//
//
// (C) 1999 Ashot Oganesyan K, Smartline, Inc
// Mailto: ashot@aha.ru, http://www.protect-me.com, http://www.codepile.com

# Include <windows. h>
# Include <stdio. h>

# Define processbasicinformation 0

Typedef struct
{
Ushort length;
Ushort maximumlength;
Pwstr buffer;
} Unicode_string, * punicode_string;

Typedef struct
{
Ulong allocationsize;
Ulong actualsize;
Ulong flags;
Ulong unknown1;
Unicode_string unknown2;
Handle inputhandle;
Handle outputhandle;
Handle errorhandle;
Unicode_string currentdirectory;
Handle currentdirectoryhandle;
Unicode_string searchpaths;
Unicode_string applicationname;
Unicode_string CommandLine;
Pvoid environmentblock;
Ulong unknown [9];
Unicode_string unknown3;
Unicode_string unknown4;
Unicode_string unknown5;
Unicode_string unknown6;
} Process_parameters, * pprocess_parameters;

Typedef struct
{
Ulong allocationsize;
Ulong unknown1;
Hinstance processhinstance;
Pvoid listdlls;
Pprocess_parameters processparameters;
Ulong unknown2;
Handle heap;
} Peb, * ppeb;

Typedef struct
{
DWORD exitstatus;
Ppeb pebbaseaddress;
DWORD affinitymask;
DWORD basepriority;
Ulong uniqueprocessid;
Ulong inheritedfromuniqueprocessid;
} Process_basic_information;

// NTDLL! Ntqueryinformationprocess (NT specific !)
//
// The function copies the process information of
// Specified type into a buffer
//
// Ntsysapi
// Ntstatus
// Ntapi
// Ntqueryinformationprocess (
// In handle processhandle, // handle to process
// In processinfoclass informationclass, // information type
// Out pvoid processinformation, // pointer to buffer
// In ulong processinformationlength, // buffer size in bytes
// Out Pulong returnlength optional // pointer to a 32-bit
/// Variable that generated es
/// The number of bytes
/// Written to the buffer
//);
Typedef long (winapi * procntqsip) (handle, uint, pvoid, ulong, Pulong );

Procntqsip ntqueryinformationprocess;

Bool getprocesscmdline (DWORD dwid, lpwstr wbuf, DWORD dwbuflen );

Void main (INT argc, char * argv [])
{
If (argc <2)
{
Printf ("Usage:/n/nw.line.exe procid/N ");
Return;
}

Ntqueryinformationprocess = (procntqsip) getprocaddress (
Getmodulehandle ("NTDLL "),
"Ntqueryinformationprocess"
);

If (! Ntqueryinformationprocess)
Return;

DWORD dwid;
Sscanf (argv [1], "% lu", & dwid );

Wchar wstr [255];

If (getprocesscmdline (dwid, wstr, sizeof (wstr )))
Wprintf (L "command line for process % lu is:/n % s/n", dwid, wstr );
Else
Wprintf (L "cocould not get command line! ");

}

Bool getprocesscmdline (DWORD dwid, lpwstr wbuf, DWORD dwbuflen)
{
Long status;
Handle hprocess;
Process_basic_information PBI;
Peb;
Process_parameters procparam;
DWORD dwdummy;
DWORD dwsize;
Lpvoid lpaddress;
Bool Bret = false;

// Get Process Handle
Hprocess = OpenProcess (process_query_information | process_vm_read, false, dwid );
If (! Hprocess)
Return false;

// Retrieve Information
Status = ntqueryinformationprocess (hprocess,
Processbasicinformation,
(Pvoid) & PBI,
Sizeof (process_basic_information ),
Null
);

If (Status)
Goto cleanup;

If (! Readprocessmemory (hprocess,
PBI. pebbaseaddress,
& Peb,
Sizeof (peb ),
& Dwdummy
)
)
Goto cleanup;

If (! Readprocessmemory (hprocess,
Peb. processparameters,
& Procparam,
Sizeof (process_parameters ),
& Dwdummy
)
)
Goto cleanup;

Lpaddress = procparam. CommandLine. buffer;
Dwsize = procparam. CommandLine. length;

If (dwbuflen <dwsize)
Goto cleanup;

If (! Readprocessmemory (hprocess,
Lpaddress,
Wbuf,
Dwsize,
& Dwdummy
)
)
Goto cleanup;

Bret = true;

Cleanup:

Closehandle (hprocess );

Return Bret;
}
---

Tombkeeper:
In the peb structure, processparameters-> CommandLine is a unicode_string, which is the command line. You can use readprocessmemory () to read data.

1. Locate peb from FS: 0
2. The peb offset 0x10 is processparameters.
3. The processparameters offset 0x40 is CommandLine.

Tombkeeper:
For different versions of NT, The peb structure may not be the same and may need to be treated differently.
The ilsy method is more upright.