C++ 获取其它进程命令行

winxp，win7，win8 32位系统测试有效

 

#include <Windows.h>
#include <Stdio.h>
#include <Tchar.h>

//获取进程命令行
BOOL GetProcessCommandLine(HANDLE hProcess, LPTSTR pszCmdLine, DWORD cchCmdLine)
{
	BOOL			bRet;
	DWORD			dwPos;
	LPBYTE			lpAddr;
	DWORD			dwRetLen;

	bRet = FALSE;

	dwPos = 0;
	lpAddr = (LPBYTE)GetCommandLine;
Win7:
	if(lpAddr[dwPos] == 0xeb && lpAddr[dwPos + 1] == 0x05)
	{
		dwPos += 2;
		dwPos += 5;
Win8:
		if(lpAddr[dwPos] == 0xff && lpAddr[dwPos + 1] == 0x25)
		{
			dwPos += 2;
			lpAddr = *(LPBYTE*)(lpAddr + dwPos);

			dwPos = 0;
			lpAddr = *(LPBYTE*)lpAddr;
WinXp:
			if(lpAddr[dwPos] == 0xa1)
			{
				dwPos += 1;
				lpAddr = *(LPBYTE*)(lpAddr + dwPos);
				bRet = ReadProcessMemory(hProcess,
					lpAddr,
					&lpAddr,
					sizeof(LPBYTE),
					&dwRetLen);
				if(bRet)
				{
					bRet = ReadProcessMemory(hProcess,
						lpAddr,
						pszCmdLine,
						cchCmdLine,
						&dwRetLen);
				}
			}
		}
		else
		{			
			goto WinXp;
		}
	}
	else
	{
		goto Win8;
	}

	return bRet;
}

int _tmain(int argc, TCHAR *argv[])
{
	TCHAR szPath[512];
	HANDLE hProcess;

	if(argc != 2)
		return 1;

	hProcess = OpenProcess(PROCESS_VM_READ, FALSE, _tcstoul(argv[1], NULL, 10));
	if(hProcess)
	{
		if(GetProcessCommandLine(hProcess, szPath, sizeof(szPath)))
		{
			printf("%s\n", szPath);
		}

		CloseHandle(hProcess);
	}

	return 0;
}