获取进程命令行参数

#include <Winternl.h>


void GetProcessCommandLine(DWORD pid)
{
pid = 1688;
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);


if (INVALID_HANDLE_VALUE != hProc)
{
HANDLE hNewProcess = NULL;
PEB peb;
RTL_USER_PROCESS_PARAMETERS upps;
HMODULE hModule = LoadLibrary(_T("Ntdll.dll"));
typedef NTSTATUS(WINAPI *NtQueryInformationProcessFace)(HANDLE, DWORD, PVOID, ULONG, PULONG);
NtQueryInformationProcessFace NtQueryInformationProcess = (NtQueryInformationProcessFace)GetProcAddress(hModule, "NtQueryInformationProcess");
if (DuplicateHandle(GetCurrentProcess(), hProc, GetCurrentProcess(), &hNewProcess, 0, FALSE, DUPLICATE_SAME_ACCESS))
{
PROCESS_BASIC_INFORMATION pbi;
NTSTATUS isok = NtQueryInformationProcess(hNewProcess, ProcessBasicInformation, (PVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION), 0);
if (BCRYPT_SUCCESS(isok))
{
if (ReadProcessMemory(hNewProcess, pbi.PebBaseAddress, &peb, sizeof(PEB), 0))
{
if (ReadProcessMemory(hNewProcess, peb.ProcessParameters, &upps, sizeof(RTL_USER_PROCESS_PARAMETERS), 0)) {
WCHAR *buffer = new WCHAR[upps.CommandLine.Length + 1];
ZeroMemory(buffer, (upps.CommandLine.Length + 1) * sizeof(WCHAR));
ReadProcessMemory(hNewProcess, upps.CommandLine.Buffer, buffer, upps.CommandLine.Length, 0);
delete buffer;
}
}
}
CloseHandle(hNewProcess);
}


CloseHandle(hProc);
}

}

typedef struct _PROCESS_BASIC_INFORMATION {
PVOID Reserved1;
PPEB PebBaseAddress;
PVOID Reserved2[2];
ULONG_PTR UniqueProcessId;
PVOID Reserved3;

} PROCESS_BASIC_INFORMATION;

该结构中的Reserved3为父进程id，当然，这个值可能在以后的系统API中被修改