C++ 获取其它进程命令行参数

最新推荐文章于 2025-09-06 14:31:15 发布

原创最新推荐文章于 2025-09-06 14:31:15 发布 · 7.7k 阅读

10 ·

CC 4.0 BY-SA版权

文章标签：

#原创 #c语言

原创同时被 2 个专栏收录

25 篇文章

订阅专栏

c++

2 篇文章

订阅专栏

本文介绍了一种通过使用Windows API函数NtQueryInformationProcess来获取指定进程的命令行参数的方法。该方法首先打开目标进程，然后利用动态链接库Ntdll.dll中的NtQueryInformationProcess函数读取进程的基本信息，并进一步获取PEB及进程启动参数结构，最终读取出进程的完整命令行。

wintenl.h 下载地址

#include "stdafx.h"
#include "winternl.h"

typedef NTSTATUS  (WINAPI *NtQueryInformationProcessFake)(HANDLE, DWORD, PVOID, ULONG, PULONG);

NtQueryInformationProcessFake ntQ = NULL;


void getProcCMD(DWORD pid) {
	HANDLE hproc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid );
	if (INVALID_HANDLE_VALUE != hproc){
		HANDLE hnewdup = NULL;
		PEB peb;
		RTL_USER_PROCESS_PARAMETERS upps;
		WCHAR buffer[MAX_PATH] = {NULL};
		HMODULE hm = LoadLibrary(_T("Ntdll.dll"));
		ntQ = (NtQueryInformationProcessFake)GetProcAddress(hm, "NtQueryInformationProcess");
		if ( DuplicateHandle(GetCurrentProcess(), hproc, GetCurrentProcess(), &hnewdup, 0, FALSE, DUPLICATE_SAME_ACCESS) ) {
			PROCESS_BASIC_INFORMATION pbi;
			NTSTATUS isok = ntQ(hnewdup, 0/*ProcessBasicInformation*/, (PVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION), 0);        
			if (BCRYPT_SUCCESS(isok)) {
				if ( ReadProcessMemory(hnewdup, pbi.PebBaseAddress, &peb, sizeof(PEB), 0) )
					if ( ReadProcessMemory(hnewdup, peb.ProcessParameters, &upps, sizeof(RTL_USER_PROCESS_PARAMETERS), 0) ) {
						WCHAR *buffer = new WCHAR[upps.CommandLine.Length + 1];
						ZeroMemory(buffer, (upps.CommandLine.Length + 1) * sizeof(WCHAR));
						ReadProcessMemory(hnewdup, upps.CommandLine.Buffer, buffer, upps.CommandLine.Length, 0);
						delete buffer;
					}
			}
			CloseHandle(hnewdup);
		}

		CloseHandle(hproc);
	}
}