Getting another process command line in Windows

by

It looks like ZwReadVirtualMemory is called only once. That is not enough. It has to be called for each level of pointer indirection. In other words when you retrieve a pointer it points to other process’ address space. You cannot read it directly. You have to call ZwReadVirtualMemory again. For the case of those data structures ZwReadVirtualMemory has to be called 3 times: once to read PEB (that is what the code above does), once to read RTL_USER_PROCESS_PARAMETERS and once to read UNICODE_STRING’s buffer.
The following code fragment worked for me (error handling omitted for clarity and I used documented ReadProcessMemory API instead of ZwReadVirtualMemory):

        LONG status = NtQueryInformationProcess(hProcess,
                                                0,
                                                pinfo,
                                                sizeof(PVOID)*6,
                                                NULL);
        PPEB ppeb = (PPEB)((PVOID*)pinfo)[1];
        PPEB ppebCopy = (PPEB)malloc(sizeof(PEB));
        BOOL result = ReadProcessMemory(hProcess,
                                        ppeb,
                                        ppebCopy,
                                        sizeof(PEB),
                                        NULL);

        PRTL_USER_PROCESS_PARAMETERS pRtlProcParam = ppebCopy->ProcessParameters;
        PRTL_USER_PROCESS_PARAMETERS pRtlProcParamCopy =
            (PRTL_USER_PROCESS_PARAMETERS)malloc(sizeof(RTL_USER_PROCESS_PARAMETERS));
        result = ReadProcessMemory(hProcess,
                                   pRtlProcParam,
                                   pRtlProcParamCopy,
                                   sizeof(RTL_USER_PROCESS_PARAMETERS),
                                   NULL);
        PWSTR wBuffer = pRtlProcParamCopy->CommandLine.Buffer;
        USHORT len =  pRtlProcParamCopy->CommandLine.Length;
        PWSTR wBufferCopy = (PWSTR)malloc(len);
        result = ReadProcessMemory(hProcess,
                                   wBuffer,
                                   wBufferCopy, // command line goes here
                                   len,
                                   NULL);

Why we see see the command line of our own process? That is because processes are laid out in a similar way. Command line and PEB-related structures are likely to have the same addresses. So if you missed ReadProcessMemory you end up exactly with local process’ command line.

More Related Contents:

  1. How to get main window handle from process id?
  2. How to make thread sleep less than a millisecond on Windows
  3. Win32 API to enumerate dll export functions?
  4. How can I get a process handle by its name in C++?
  5. What does “WINAPI” in main function mean?
  6. How do I call ::CreateProcess in c++ to launch a Windows executable?
  7. Detecting Windows 10 version
  8. Can I use CreateFile, but force the handle into a std::ofstream?
  9. SetupDiGetDeviceProperty usage example
  10. C++, How to determine if a Windows Process is running?
  11. updating a string table with UpdateResource
  12. How to get the process name in C++
  13. How to query a running process for its parameters list? (Windows, C++)
  14. How can I get the path of a Windows “special folder” for a specific user?
  15. Intercept windows open file
  16. C++ Executing CMD Commands
  17. Detecting simulated keyboard/mouse input
  18. How to programmatically create a shortcut using Win32
  19. How can I save HICON to an .ico file?
  20. Load the same dll multiple times [closed]
  21. Check the file-size without opening file in C++?
  22. winapi: CreateProcess but hide the process’ window?
  23. How to effectively kill a process in C++ (Win32)?
  24. Win32: How to hide 3rd party windows in taskbar by hWnd
  25. Why does MAKEINTRESOURCE() work?
  26. Name of process for active window in Windows 8/10
  27. Size of a directory [duplicate]
  28. Visual Studio 2013: CL.exe exited with code -1073741515
  29. C++: What’s the simplest way to read and write BMP files using C++ on Windows?
  30. How to create a process in C++ on Windows?

Leave a Comment