WMI 取外部进程命令行 / GetCommandLine

如何获取外部进程的命令行 似乎有很多人有该问题 有人是通过PSAPI

但并不太适合C# && VBS && VB.NET那有没有更好的办法 有利用WMI

 服务获取到Win32_Process class在获取CommandLine

下面含三种不同语言的代码：

VBScript

Function GetCommandLine(dwProcessId)

    Set objWMIService = GetObject("WinMgmts:\\.\root\cimv2")
    Set objWin32PCollect = objWMIService.ExecQuery("select CommandLine from Win32_Process where Handle = " & dwProcessId)

    For Each objWin32Process in objWin32PCollect

        GetCommandLine = GetCommandLine & objWin32Process.CommandLine & Chr(10) & Chr(13)

    Next

End Function

MsgBox GetCommandLine(4) 

VB.NET

Imports System.Runtime.InteropServices

Module MainModule

    Declare Function GetCurrentProcessId Lib "kernel32" () As UInteger

    Sub Main()
        Dim dwProcessId = GetCurrentProcessId()
        Console.WriteLine(GetCommandLine(dwProcessId))
        Console.ReadKey(False)
    End Sub

    Function GetCommandLine(ByVal dwProcessId As UInteger) As String
        Dim objWMIService As Object = Nothing
        Dim objWin32PCollect As Object = Nothing
        Try
            Dim strCommandLine As String = Nothing
            objWMIService = GetObject("WinMgmts:\\.\root\cimv2")
            objWin32PCollect = objWMIService.ExecQuery("select CommandLine from Win32_Process where Handle = " & dwProcessId)
            For Each objWin32Process In objWin32PCollect
                strCommandLine = objWin32Process.CommandLine
            Next
            Return strCommandLine
        Finally
            Marshal.ReleaseComObject(objWMIService)
            Marshal.ReleaseComObject(objWin32PCollect)
        End Try
    End Function

End Module

C#.NET

        public static string GetCommandLine(int dwProcessId)
        {
            object objVBScript = Activator.CreateInstance(Type.
                GetTypeFromProgID("MSScriptControl.ScriptControl", true)
            );
            try
            {
                // Language engine to use.
                objVBScript.SetProperty("Language", "VBScript");
                // Add code to the global module.
                objVBScript.Invoke("AddCode",
                    "Function GetCommandLine(dwProcessId)\r\n" +

                        "Set objWMIService = GetObject(\"WinMgmts:\\\\.\\root\\cimv2\")\r\n" +
                        "Set objWin32PCollect = objWMIService.ExecQuery(\"select CommandLine from Win32_Process where Handle = \" & dwProcessId)\r\n" +

                        "For Each objWin32Process in objWin32PCollect\r\n" +
                            "objRetValue = objRetValue & objWin32Process.CommandLine\r\n" +
                        "Next\r\n" +

                        "GetCommandLine = objRetValue\r\n" +

                    "End Function"
                );
                // Call a procedure defined in the global module.
                object objCommandLine = objVBScript.Invoke("Run", "GetCommandLine", dwProcessId);
                return objCommandLine as string;
            }
            finally
            {
                Marshal.ReleaseComObject(objVBScript);
            }
        }

        public static string GetCommandLine(IntPtr hWnd)
        {
            int nNoOfPID = -1;
            if (!NativeMethod.GetWindowThreadProcessId(hWnd, ref nNoOfPID))
                throw new ArgumentException("Unable to get window associated the process id.");
            return GetCommandLine(nNoOfPID);
        }

        public abstract class NativeMethod
        {
            [DllImport("user32.dll", SetLastError = true)]
            [return: MarshalAs(UnmanagedType.Bool)]
            public static extern bool GetWindowThreadProcessId(IntPtr hWnd, ref int lpdwProcessId);
        }

    using System;
    using System.Reflection;
    using System.Runtime.InteropServices;

    public static class CComObject
    {
        public static object Invoke(this object obj, string name, params object[] args)
        {
            return CComObject.Invoke(obj, name, BindingFlags.InvokeMethod, args);
        }

        public static object GetProperty(this object obj, string name, params object[] args)
        {
            return CComObject.Invoke(obj, name, BindingFlags.GetProperty, args);
        }

        public static object SetProperty(this object obj, string name, params object[] args)
        {
            return CComObject.Invoke(obj, name, BindingFlags.SetProperty, args);
        }

        public static object GetField(this object obj, string name)
        {
            return CComObject.Invoke(obj, name, BindingFlags.GetField, null);
        }

        public static object SetField(this object obj, string name)
        {
            return CComObject.Invoke(obj, name, BindingFlags.SetField, null);
        }

        private static object Invoke(object obj, string name, BindingFlags attr, object[] args)
        {
            if (obj == null || Marshal.IsComObject(obj) != true)
                throw new ArgumentException("obj param can not be null and must be valid COM object.");
            return (obj.GetType()).InvokeMember(name, attr, null, obj, args);
        }
    }