获取其他进程的命令行(ReadProcessMemory其它进程的PPROCESS_PARAMETERS和PEB结构体)

Posted 朝闻道

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了获取其他进程的命令行(ReadProcessMemory其它进程的PPROCESS_PARAMETERS和PEB结构体)相关的知识,希望对你有一定的参考价值。

type
  UNICODE_STRING = packed record
    Length: Word;
    MaximumLength: Word;
    Buffer: PWideChar;
  end;
  PUNICODE_STRING = UNICODE_STRING;
type
  PROCESS_PARAMETERS = packed record
    AllocationSize: ULONG;
    ActualSize: ULONG;
    Flags: ULONG;
    Unknown1: ULONG;
    Unknown2: UNICODE_STRING;
    InputHandle: THandle;
    OutputHandle: THandle;
    ErrorHandle: THandle;
    CurrentDirectory: UNICODE_STRING;
    CurrentDirectoryHandle: THandle;
    SearchPaths: UNICODE_STRING;
    ApplicationName: UNICODE_STRING;
    CommandLine: UNICODE_STRING;
    EnvironmentBlock: Pointer;
    Unknown: array[0..9 - 1] of ULONG;
    Unknown3: UNICODE_STRING;
    Unknown4: UNICODE_STRING;
    Unknown5: UNICODE_STRING;
    Unknown6: UNICODE_STRING;
  end;
  PPROCESS_PARAMETERS = ^PROCESS_PARAMETERS;
(*//
type
  _PEB = packed record
    Reserved1: array[0..2 - 1] of Byte;
    BeingDebugged: Byte;
    Reserved2: array[0..229 - 1] of Byte;
    Reserved3: array[0..59 - 1] of Pointer;
    SessionId: ULONG;
  end;
  PEB = _PEB;
  PPEB = ^PEB;
//*)
type
  PEB = packed record
    AllocationSize: ULONG;
    Unknown1: ULONG;
    ProcessHinstance: Longword;
    ListDlls: Pointer;
    ProcessParameters: PPROCESS_PARAMETERS;
    Unknown2: ULONG;
    Heap: THandle;
  end;
  PPEB = ^PEB;

type
  _PROCESS_BASIC_INFORMATION = packed record
    Reserved1: Pointer;
    PebBaseAddress: PPEB;
    Reserved2: array[0..1] of Pointer;
    UniqueProcessId: PULONG;
    Reserved3: Pointer;
  end;

  PROCESS_BASIC_INFORMATION = _PROCESS_BASIC_INFORMATION;
  PPROCESS_BASIC_INFORMATION = ^PROCESS_BASIC_INFORMATION;
  PROCESSINFOCLASS = (
    ProcessBasicInformation = 0,
    ProcessWow64Information = 26
  );
  NTSTATUS = DWORD;

function NtQueryInformationProcess(
  ProcessHandle: THandle;
  ProcessInformationClass: PROCESSINFOCLASS;
  ProcessInformation: Pointer;
  ProcessInformationLength: ULONG;
  ReturnLength: PULONG
): NTSTATUS; stdcall; external ‘ntdll.dll‘ name ‘NtQueryInformationProcess‘;

function Process_CmdLine(
  mProcessID: THandle
): WideString;
var
  vProcess: THandle;
  vProcessBasicInformation: PROCESS_BASIC_INFORMATION;
  vPEB: PEB;
  vNumberOfBytesRead: Longword;
  vProcessParameters: PROCESS_PARAMETERS;
begin
//设计 Zswang 2006-09-09 wjhu111#21cn.com 尊重作者,转贴请注明出处
  Result := ‘‘;
  vProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ,
    False, mProcessID);
  if vProcess = 0 then Exit;
  try
    if NtQueryInformationProcess(
      vProcess,
      ProcessBasicInformation,
      @vProcessBasicInformation,
      SizeOf(vProcessBasicInformation),
      nil) <> 0 then Exit;
    if not ReadProcessMemory(vProcess,
      vProcessBasicInformation.PebBaseAddress,
      @vPEB,
      SizeOf(vPEB),
      vNumberOfBytesRead) then Exit;
    if not ReadProcessMemory(vProcess,
      vPEB.ProcessParameters,
      @vProcessParameters,
      SizeOf(vProcessParameters),
      vNumberOfBytesRead) then Exit;
    SetLength(Result, vProcessParameters.CommandLine.Length div 2);
    if not ReadProcessMemory(vProcess,
      vProcessParameters.CommandLine.Buffer,
      @Result[1],
      vProcessParameters.CommandLine.Length,
      vNumberOfBytesRead) then Exit;
  finally
    CloseHandle(vProcess);
  end;
end; { Process_CmdLine }

http://blog.csdn.net/zswang/article/details/1214857

以上是关于获取其他进程的命令行(ReadProcessMemory其它进程的PPROCESS_PARAMETERS和PEB结构体)的主要内容,如果未能解决你的问题,请参考以下文章

我可以使用其他命令行参数从命令行启动 aws fargate 进程吗?

使用命令行获取进程 ID

如何获取启动进程的命令行

让其他进程当小兵,Java调用命令行,so easy

通过子进程或其他方法的 Python 速度命令行调用

如何在 PowerShell 或 C# 中获取进程的命令行信息