C++ 获取其它进程命令行

来源：互联网发布：淘宝红人店铺申请编辑：程序博客网时间：2024/06/06 00:34

winxp，win7，win8 32位系统测试有效

#include <Windows.h>#include <Stdio.h>#include <Tchar.h>//获取进程命令行BOOL GetProcessCommandLine(HANDLE hProcess, LPTSTR pszCmdLine, DWORD cchCmdLine){BOOLbRet;DWORDdwPos;LPBYTElpAddr;DWORDdwRetLen;bRet = FALSE;dwPos = 0;lpAddr = (LPBYTE)GetCommandLine;Win7:if(lpAddr[dwPos] == 0xeb && lpAddr[dwPos + 1] == 0x05){dwPos += 2;dwPos += 5;Win8:if(lpAddr[dwPos] == 0xff && lpAddr[dwPos + 1] == 0x25){dwPos += 2;lpAddr = *(LPBYTE*)(lpAddr + dwPos);dwPos = 0;lpAddr = *(LPBYTE*)lpAddr;WinXp:if(lpAddr[dwPos] == 0xa1){dwPos += 1;lpAddr = *(LPBYTE*)(lpAddr + dwPos);bRet = ReadProcessMemory(hProcess,lpAddr,&lpAddr,sizeof(LPBYTE),&dwRetLen);if(bRet){bRet = ReadProcessMemory(hProcess,lpAddr,pszCmdLine,cchCmdLine,&dwRetLen);}}}else{goto WinXp;}}else{goto Win8;}return bRet;}int _tmain(int argc, TCHAR *argv[]){TCHAR szPath[512];HANDLE hProcess;if(argc != 2)return 1;hProcess = OpenProcess(PROCESS_VM_READ, FALSE, _tcstoul(argv[1], NULL, 10));if(hProcess){if(GetProcessCommandLine(hProcess, szPath, sizeof(szPath))){printf("%s\n", szPath);}CloseHandle(hProcess);}return 0;}