| 109 | } |
| 110 | |
| 111 | BOOL ReadPEBProcessParameters(HANDLE hProcess, PEB* peb, WCHAR** args) { |
| 112 | UNICODE_STRING commandLine; |
| 113 | if (!ReadProcessMemory(hProcess, &peb->ProcessParameters->CommandLine, &commandLine, sizeof(commandLine), NULL)) { |
| 114 | PRINT("Could not read CommandLine\n"); |
| 115 | } |
| 116 | *args = (WCHAR*)malloc(commandLine.MaximumLength); |
| 117 | if (*args != 0 && !ReadProcessMemory(hProcess, commandLine.Buffer, *args, commandLine.MaximumLength, NULL)) |
| 118 | { |
| 119 | PRINT("Could not read the command line string\n"); |
| 120 | free(*args); |
| 121 | return FALSE; |
| 122 | } |
| 123 | return TRUE; |
| 124 | } |
| 125 | |
| 126 | BOOL GetTokenUser(IN HANDLE hProcess) { |
| 127 | HANDLE hToken = NULL; |