This is no cleaned up version... as it's the code I've used and tested with
It's part of my local __ProcessX.au3 I use for different kind of things...
It's part of my local __ProcessX.au3 I use for different kind of things...
;~ https://www.autoitscript.com/forum/topic/88214-_winapi_getcommandlinefrompid-from-any-process/
;~ Func _WinAPI_GetCommandLineFromPID($iPID)
;~ If $iDELETE = replace CommandLine with "*" so no one can read it again (ProgramPath isn't replaced)
;~ If $iDELETE > 1 = even replace the ProgramPath
Func _ProcessGetCommandLine($iPID = @AutoItPID, $iDELETE = 0)
Local $dwDesiredAccess = 0x0410; 0x0410 = PROCESS_VM_READ (0x0010) | PROCESS_QUERY_INFORMATION (0x0400) 0x0438 = && PROCESS_VM_OPERATION (0x0008) | PROCESS_VM_WRITE (0x0020)
If $iDELETE Then
$iDELETE = Int($iDELETE + 0);
$dwDesiredAccess += 0x0028;
EndIf
Local $aCall = DllCall('Kernel32.dll', 'HANDLE', 'OpenProcess', _
'DWORD', $dwDesiredAccess, _
'BOOL', 0, _
'DWORD', $iPID)
If @error Or Not $aCall[0] Then
Return SetError(1, 0, '')
EndIf
Local $hProcess = $aCall[0]
Local $tPROCESS_BASIC_INFORMATION = DllStructCreate('dword_ptr ExitStatus;' & _
'ptr PebBaseAddress;' & _
'dword_ptr AffinityMask;' & _
'dword_ptr BasePriority;' & _
'dword_ptr UniqueProcessId;' & _
'dword_ptr InheritedFromUniqueProcessId')
$aCall = DllCall('ntdll.dll', 'int', 'NtQueryInformationProcess', _
'handle', $hProcess, _
'dword', 0, _ ; ProcessBasicInformation
'ptr', DllStructGetPtr($tPROCESS_BASIC_INFORMATION), _
'dword', DllStructGetSize($tPROCESS_BASIC_INFORMATION), _
'dword*', 0)
If @error Then
DllCall('Kernel32.dll', 'bool', 'CloseHandle', 'handle', $hProcess)
Return SetError(2, 0, '')
EndIf
Local $tPEB = DllStructCreate('byte InheritedAddressSpace;' & _
'byte ReadImageFileExecOptions;' & _
'byte BeingDebugged;' & _
'byte Spare;' & _
'ptr Mutant;' & _
'ptr ImageBaseAddress;' & _
'ptr LoaderData;' & _
'ptr ProcessParameters;' & _
'ptr SubSystemData;' & _
'ptr ProcessHeap;' & _
'ptr FastPebLock;' & _
'ptr FastPebLockRoutine;' & _
'ptr FastPebUnlockRoutine;' & _
'dword EnvironmentUpdateCount;' & _
'ptr KernelCallbackTable;' & _
'ptr EventLogSection;' & _
'ptr EventLog;' & _
'ptr FreeList;' & _
'dword TlsExpansionCounter;' & _
'ptr TlsBitmap;' & _
'dword TlsBitmapBits[2];' & _
'ptr ReadOnlySharedMemoryBase;' & _
'ptr ReadOnlySharedMemoryHeap;' & _
'ptr ReadOnlyStaticServerData;' & _
'ptr AnsiCodePageData;' & _
'ptr OemCodePageData;' & _
'ptr UnicodeCaseTableData;' & _
'dword NumberOfProcessors;' & _
'dword NtGlobalFlag;' & _
'ubyte Spare2[4];' & _
'int64 CriticalSectionTimeout;' & _
'dword HeapSegmentReserve;' & _
'dword HeapSegmentCommit;' & _
'dword HeapDeCommitTotalFreeThreshold;' & _
'dword HeapDeCommitFreeBlockThreshold;' & _
'dword NumberOfHeaps;' & _
'dword MaximumNumberOfHeaps;' & _
'ptr ProcessHeaps;' & _
'ptr GdiSharedHandleTable;' & _
'ptr ProcessStarterHelper;' & _
'ptr GdiDCAttributeList;' & _
'ptr LoaderLock;' & _
'dword OSMajorVersion;' & _
'dword OSMinorVersion;' & _
'dword OSBuildNumber;' & _
'dword OSPlatformId;' & _
'dword ImageSubSystem;' & _
'dword ImageSubSystemMajorVersion;' & _
'dword ImageSubSystemMinorVersion;' & _
'dword GdiHandleBuffer[34];' & _
'dword PostProcessInitRoutine;' & _
'dword TlsExpansionBitmap;' & _
'byte TlsExpansionBitmapBits[128];' & _
'dword SessionId')
$aCall = DllCall('Kernel32.dll', 'bool', 'ReadProcessMemory', _
'ptr', $hProcess, _
'ptr', DllStructGetData($tPROCESS_BASIC_INFORMATION, 'PebBaseAddress'), _
'ptr', DllStructGetPtr($tPEB), _
'dword', DllStructGetSize($tPEB), _
'dword*', 0)
If @error Or Not $aCall[0] Then
DllCall('Kernel32.dll', 'bool', 'CloseHandle', 'handle', $hProcess)
Return SetError(3, 0, '')
EndIf
Local $tPROCESS_PARAMETERS = DllStructCreate('dword AllocationSize;' & _
'dword ActualSize;' & _
'dword Flags;' & _
'dword Unknown1;' & _
'word LengthUnknown2;' & _
'word MaxLengthUnknown2;' & _
'ptr Unknown2;' & _
'handle InputHandle;' & _
'handle OutputHandle;' & _
'handle ErrorHandle;' & _
'word LengthCurrentDirectory;' & _
'word MaxLengthCurrentDirectory;' & _
'ptr CurrentDirectory;' & _
'handle CurrentDirectoryHandle;' & _
'word LengthSearchPaths;' & _
'word MaxLengthSearchPaths;' & _
'ptr SearchPaths;' & _
'word LengthApplicationName;' & _
'word MaxLengthApplicationName;' & _
'ptr ApplicationName;' & _
'word LengthCommandLine;' & _
'word MaxLengthCommandLine;' & _
'ptr CommandLine;' & _
'ptr EnvironmentBlock;' & _
'dword Unknown[9];' & _
'word LengthUnknown3;' & _
'word MaxLengthUnknown3;' & _
'ptr Unknown3;' & _
'word LengthUnknown4;' & _
'word MaxLengthUnknown4;' & _
'ptr Unknown4;' & _
'word LengthUnknown5;' & _
'word MaxLengthUnknown5;' & _
'ptr Unknown5;')
$aCall = DllCall('Kernel32.dll', 'bool', 'ReadProcessMemory', _
'ptr', $hProcess, _
'ptr', DllStructGetData($tPEB, 'ProcessParameters'), _
'ptr', DllStructGetPtr($tPROCESS_PARAMETERS), _
'dword', DllStructGetSize($tPROCESS_PARAMETERS), _
'dword*', 0)
If @error Or Not $aCall[0] Then
DllCall('Kernel32.dll', 'bool', 'CloseHandle', 'handle', $hProcess)
Return SetError(4, 0, '')
EndIf
$aCall = DllCall('Kernel32.dll', 'bool', 'ReadProcessMemory', _
'ptr', $hProcess, _
'ptr', DllStructGetData($tPROCESS_PARAMETERS, 'CommandLine'), _
'wstr', '', _
'dword', DllStructGetData($tPROCESS_PARAMETERS, 'MaxLengthCommandLine'), _
'dword*', 0)
If @error Or Not $aCall[0] Then
DllCall('Kernel32.dll', 'bool', 'CloseHandle', 'handle', $hProcess)
Return SetError(5, 0, '')
EndIf
If $iDELETE Then
Local $tmp = '';
Local $tmp_len = DllStructGetData($tPROCESS_PARAMETERS, 'LengthCommandLine');
Local $tmp_slen = ($tmp_len / 2)
Local $tmp_nlen = 0;
Local $pos = 0;
If $iDELETE == 1 Then
$pos = StringInStr($aCall[3], ' ');
If $pos <> 0 Then
Local $pos2 = StringInStr($aCall[3], '"');
If $pos2 == 0 Or $pos < $pos2 Then
$tmp = StringLeft($aCall[3], $pos);
Else
$pos2 = StringInStr($aCall[3], '"', 0, 2);
$pos = StringInStr($aCall[3], ' ', 0, 1, $pos2);
If $pos <> 0 Then
$tmp = StringLeft($aCall[3], $pos);
Else
$pos = $tmp_slen;
EndIf
EndIf
Else
$pos = $tmp_slen;
EndIf
EndIf
;~ $tmp &= '/TUStart /pid:532';
For $i = $pos To $tmp_slen
$tmp &= '*';
Next
_WinAPI_WriteProcessMemory($hProcess, DllStructGetData($tPROCESS_PARAMETERS, 'CommandLine'), $tmp, $tmp_len, $tmp_nlen, 'wstr');
If $tmp_nlen <> $tmp_len Then
;~ ConsoleWrite('WriteError!' & @LF);
DllCall('Kernel32.dll', 'bool', 'CloseHandle', 'handle', $hProcess)
Return SetError(0, 6, $aCall[3])
EndIf
EndIf
DllCall('Kernel32.dll', 'bool', 'CloseHandle', 'handle', $hProcess)
Return $aCall[3]
EndFunc ;==>_ProcessGetCommandLine