Как по PID процесса узнать CMDLINE?, то есть командную строку |
Previous Top Next |
Code: |
function GetProcessCmdLine(PID:DWORD):string; {©Drkb v.3(2007): www.drkb.ru}
var h:THandle; pbi:TProcessBacicInformation; ret:NTSTATUS; r:Cardinal; ws:WideString; begin result:=''; if pid=0 then exit; h:=OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, FALSE, pid); if h=0 then exit; try ret:=NtQueryInformationProcess(h,ProcessBasicInformation,@pbi,sizeof(pbi),@r); if ret=STATUS_SUCCESS then if ReadProcessMemory(h,pbi.PebBaseAddress.ProcessParameters.CommandLine.Buffer,PWideChar(ws), pbi.PebBaseAddress.ProcessParameters.CommandLine.Length,r) then result:=string(ws); finally closehandle(h) end end; |
Автор: Krid
Взято из http://forum.sources.ru
©Drkb::02134