Note: this will only work if both processes have the same word size (64 vs 32)
| 75 | } |
| 76 | //Note: this will only work if both processes have the same word size (64 vs 32) |
| 77 | std::wstring GetProcessCommandLine(HANDLE hProc) |
| 78 | { |
| 79 | typedef NTSTATUS(NTAPI* NtQueryInformationProcess_FuncType)( |
| 80 | IN HANDLE ProcessHandle, |
| 81 | ULONG ProcessInformationClass, |
| 82 | OUT PVOID ProcessInformation, |
| 83 | IN ULONG ProcessInformationLength, |
| 84 | OUT PULONG ReturnLength OPTIONAL |
| 85 | ); |
| 86 | static const auto _QueryProcInfo = (NtQueryInformationProcess_FuncType)GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtQueryInformationProcess"); |
| 87 | |
| 88 | PROCESS_BASIC_INFORMATION info; |
| 89 | if (!NT_SUCCESS(_QueryProcInfo(hProc, ProcessBasicInformation, &info, sizeof(info), NULL))) { |
| 90 | throw std::exception("Failed to get process information"); |
| 91 | } |
| 92 | PEB peb; |
| 93 | RTL_USER_PROCESS_PARAMETERS procParams; |
| 94 | ReadProcessMemory(hProc, info.PebBaseAddress, &peb, sizeof(peb), NULL); |
| 95 | ReadProcessMemory(hProc, peb.ProcessParameters, &procParams, sizeof(procParams), NULL); |
| 96 | |
| 97 | std::wstring cmdLine(procParams.CommandLine.Length, '\0'); |
| 98 | ReadProcessMemory(hProc, procParams.CommandLine.Buffer, cmdLine.data(), cmdLine.size(), NULL); |
| 99 | return cmdLine; |
| 100 | } |
| 101 | |
| 102 | #define COL_RED "\033[1;91m" |
| 103 | #define COL_GREEN "\033[1;92m" |