Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Development
  New Posts New Posts RSS Feed - get command-line of running processes
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

get command-line of running processes
 Post Reply Post Reply Page  12>
Author
Message
  Topic Search Topic Search  Topic Options Topic Options
supersonic View Drop Down
Newbie
Newbie


Joined: 22 June 2006
Location: Lebanon
Status: Offline
Points: 6 		Post Options Post Options   Thanks (0) Thanks(0)   Quote supersonic Quote  Post ReplyReply Direct Link To This Post Topic: get command-line of running processes
    Posted: 22 June 2006 at 10:39am
Hello,

I'm trying to write a command line utility that outputs the list of running processes and the command line (including command-line arguments) that was used to launch them.

Any ideas on how to get to that info from windows?

So far, using PSAPI from the windows platform sdk provides only the path of the executable but not the command line parameters.

I know that info is somehow obtainable because process explorer shows it when you open a process' properties. Any ideas on how process explorer gets that info?

Thank you.
Back to Top
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Status: Offline
Points: 4753 		Post Options Post Options   Thanks (0) Thanks(0)   Quote EP_X0FF Quote  Post ReplyReply Direct Link To This Post Posted: 22 June 2006 at 10:42am
Use PEB->PROCESS_PARAMETERS 

            PPEB peb = NULL;

            PPROCESS_PARAMETERS proc_params = NULL;

            PVOID UserPool = (PVOID)LocalAlloc(LPTR, 8192);

            rc = _ZwReadVirtualMemory(

                       hProcess, 

                       ProcessInfo->PebBaseAddress,  

                       UserPool, 

                       sizeof(PEB), 

                       NULL);

            LocalFree(ProcessInfo);



            peb = (PPEB)UserPool;

            rc = _ZwReadVirtualMemory(

                       hProcess,

                      peb->ProcessParameters,

                       UserPool,

                       sizeof(PROCESS_PARAMETERS),

                       NULL);



proc_params = (PPROCESS_PARAMETERS)UserPool;

            

            ULONG uSize = 0;

            LPVOID pBaseAddress = NULL;

            switch (uFlags)

            {

                 case  0: //process command line

                      {

                            uSize  = proc_params->CommandLine.Length;

                            pBaseAddress  = proc_params->CommandLine.Buffer;

                            break;
 
                       }

                 case  1: //process image file name

                      {

                            uSize  = proc_params->ImagePathName.Length;

                            pBaseAddress  = proc_params->ImagePathName.Buffer;                      

                            break;
 
                       }

                 case  2: //process current directory

                      {

                            uSize  = proc_params->CurrentDirectory.DosPath.Length;

                            pBaseAddress  = proc_params->CurrentDirectory.DosPath.Buffer;                      

                            break;
 
                       }

            }

                 

            if ((uSize > cb) || (uSize <= 0))

            {

                 _ZwClose(hProcess);
 
                 LocalFree(UserPool);
 
                 return  4;//memory buffer too small or nothing found

            }

            rc = _ZwReadVirtualMemory(

                       hProcess, 

                       pBaseAddress, 

                       Buffer, 

                       uSize, 

                       NULL);

            _ZwClose(hProcess);

            LocalFree(UserPool);

If you need headers, visit http://www.rkunhooker.narod.ru, see ntnative.h
Back to Top
supersonic View Drop Down
Newbie
Newbie


Joined: 22 June 2006
Location: Lebanon
Status: Offline
Points: 6 		Post Options Post Options   Thanks (0) Thanks(0)   Quote supersonic Quote  Post ReplyReply Direct Link To This Post Posted: 23 June 2006 at 4:20am
Thanks for the code snippet.
I think this is exactly what I need.

can I have more info on _ZwReadVirtualMemory ?

and

how do I obtain ProcessInfo->PebBaseAddress (ie. what windows API function can fill the ProcessInfo struct) ?

Thank you.
Back to Top
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Status: Offline
Points: 4753 		Post Options Post Options   Thanks (0) Thanks(0)   Quote EP_X0FF Quote  Post ReplyReply Direct Link To This Post Posted: 23 June 2006 at 4:25am
Quote
ZwReadVirtualMemory reads virtual memory in the user mode address range of
another process.

NTSYSAPI
NTSTATUS
NTAPI
ZwReadVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG BufferLength,
OUT PULONG ReturnLength OPTIONAL
);

Parameters

ProcessHandle
A handle of a process object, representing the process from which the virtual memory
should be read.The handle must grant PROCESS_VM_READ access

BaseAddress
The base address of the virtual memory to read.

Buffer
Points to a caller-allocated buffer or variable that receives the contents of the virtual
memory.

BufferLength
Specifies the size in bytes of Buffer and the number of bytes of virtual memory to
read.

ReturnLength
Optionally points to a variable that receives the number of bytes actually returned to
Buffer if the call was successful. If this information is not needed, ReturnLength may
be a null pointer.

Return Value
Returns STATUS_SUCCESS or an error

This is similar to ReadProcessMemory

About second question - use ZwQueryInformationProcess to get PEB base address
Quote
ZwQueryInformationProcess retrieves information about a process object.
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationProcess(
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength OPTIONAL
);

Parameters

ProcessHandle
A handle to a process object.The handle must grant PROCESS_QUERY_INFORMATION
access. Some information classes also require PROCESS_VM_READ access.

ProcessInformationClass
Specifies the type of process information to be queried.The permitted values are
drawn from the enumeration PROCESSINFOCLASS, described in the following section.

ProcessInformation
Points to a caller-allocated buffer or variable that receives the requested process information.

ProcessInformationLength
Specifies the size in bytes of ProcessInformation, which the caller should set according
to the given ProcessInformationClass.

ReturnLength
Optionally points to a variable that receives the number of bytes actually returned to
ProcessInformation if the call was successful. If this information is not needed,
ReturnLength may be a null pointer.

Return Value
Returns STATUS_SUCCESS or an error status, such as STATUS_ACCESS_DENIED,
STATUS_INVALID_HANDLE, STATUS_INVALID_INFO_CLASS, STATUS_INFO_LENGTH_MISMATCH, or
STATUS_NOT_SUPPORTED.

Related Win32 Functions
GetProcessAffinityMask, GetProcessPriorityBoost, GetProcessWorkingSetSize,
GetProcessTimes, GetExitCodeProcess, SetErrorMode.
Back to Top
<DNY> View Drop Down
Senior Member
Senior Member
Avatar

Joined: 19 June 2006
Location: Germany
Status: Offline
Points: 402 		Post Options Post Options   Thanks (0) Thanks(0)   Quote <DNY> Quote  Post ReplyReply Direct Link To This Post Posted: 23 June 2006 at 4:34am
@supersonic

goto www.reactos.com, grad the headers u need
< DNY >
Back to Top
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Status: Offline
Points: 4753 		Post Options Post Options   Thanks (0) Thanks(0)   Quote EP_X0FF Quote  Post ReplyReply Direct Link To This Post Posted: 23 June 2006 at 7:26am
@supersonic: I assume this code will work with 32bit Windows?
Back to Top
supersonic View Drop Down
Newbie
Newbie


Joined: 22 June 2006
Location: Lebanon
Status: Offline
Points: 6 		Post Options Post Options   Thanks (0) Thanks(0)   Quote supersonic Quote  Post ReplyReply Direct Link To This Post Posted: 23 June 2006 at 8:16am
yes, 32-bit windows.
actually, WinXp and Win2k3 server 32-bit.

btw, i still can't get to the function ZwQueryInformationProcess.

i've downloaded the source of reactos as suggested by <DNY> and tried to include the headers but it did not work.

should I import the function directly from ntdll.dll using GetProcAddress ?

Thanks.
Back to Top
MP_ART View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Status: Offline
Points: 947 		Post Options Post Options   Thanks (0) Thanks(0)   Quote MP_ART Quote  Post ReplyReply Direct Link To This Post Posted: 23 June 2006 at 8:29am
Originally posted by supersonic supersonic wrote:

should I import the function directly from ntdll.dll using GetProcAddress ?

Yes. 


typedef NTSTATUS (__stdcall *PZWQUERYSYSTEMINFORMATION)(

    IN SYSTEM_INFORMATION_CLASS  SystemInformationClass,

    OUT PVOID  SystemInformation,

    IN ULONG  Length,

    OUT PULONG  ReturnLength

);



PZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL;



void main()

{

  ZwQuerySystemInformation = (PZWQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle( "ntdll.dll"), "ZwQuerySystemInformation");



...

Back to Top
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Status: Offline
Points: 4753 		Post Options Post Options   Thanks (0) Thanks(0)   Quote EP_X0FF Quote  Post ReplyReply Direct Link To This Post Posted: 23 June 2006 at 9:12am
You cant simply include reactos headers, better to write prototypes by own handle, or ctrl+c MP_ART code.
Back to Top
<DNY> View Drop Down
Senior Member
Senior Member
Avatar

Joined: 19 June 2006
Location: Germany
Status: Offline
Points: 402 		Post Options Post Options   Thanks (0) Thanks(0)   Quote <DNY> Quote  Post ReplyReply Direct Link To This Post Posted: 23 June 2006 at 9:27am
Originally posted by supersonic supersonic wrote:

yes, 32-bit windows.
actually, WinXp and Win2k3 server 32-bit.

btw, i still can't get to the function ZwQueryInformationProcess.

i've downloaded the source of reactos as suggested by <DNY> and tried to include the headers but it did not work.

should I import the function directly from ntdll.dll using GetProcAddress ?

Thanks.

not inclyde!,use prototypes,structs,as ep suggestd
< DNY >
Back to Top
 Post Reply Post Reply Page  12>
  Share Topic   

Forum Jump Forum Permissions View Drop Down