private static string GetCommandLineCore(IntPtr hProcess)
{
int targetProcessBitness = GetProcessBitness(hProcess);
if (targetProcessBitness == 64 && !System.Environment.Is64BitProcess)
{
throw new Win32Exception(
"The current process should run in 64 bit mode to be able to get the environment of another 64 bit process.");
}
var pPeb = targetProcessBitness == 64 ? GetPeb64(hProcess) : GetPeb32(hProcess);
//dt -r ntdll!PEB for offset values of the PEB
var offset = targetProcessBitness == 64 ? 0x20 : 0x10;
var unicodeStringOffset = targetProcessBitness == 64 ? 0x70 : 0x40;
IntPtr ptr;
if (!TryReadIntPtr(hProcess, pPeb + offset, out ptr))
{
throw new Win32Exception("Unable to read PEB.");
}
int commandLineLength;
IntPtr commandLineBuffer;
if ((targetProcessBitness == 64 && System.Environment.Is64BitProcess) ||
(targetProcessBitness == 32 && !System.Environment.Is64BitProcess))
{
//we running same bitness as the target process, use native UNICODE_STRING
var unicodeString = new ProcessNativeMethods.UNICODE_STRING();
if (!ProcessNativeMethods.ReadProcessMemory(hProcess, ptr + unicodeStringOffset, ref unicodeString, new IntPtr(Marshal.SizeOf(unicodeString)), IntPtr.Zero))
{
throw new Win32Exception(String.Format("Unable to read command line, win32 error {0}", Marshal.GetLastWin32Error()));
}
commandLineLength = unicodeString.Length;
commandLineBuffer = unicodeString.Buffer;
}
else
{
//we are running 64 but target process is 32, use UNICODE_STRING_32
var unicodeString = new ProcessNativeMethods.UNICODE_STRING_32();
if (!ProcessNativeMethods.ReadProcessMemory(hProcess, ptr + unicodeStringOffset, ref unicodeString, new IntPtr(Marshal.SizeOf(unicodeString)), IntPtr.Zero))
{
throw new Win32Exception(String.Format("Unable to read command line, win32 error {0}", Marshal.GetLastWin32Error()));
}
commandLineLength = unicodeString.Length;
commandLineBuffer = new IntPtr(unicodeString.Buffer);
}
var bytes = new byte[commandLineLength];
if (!ProcessNativeMethods.ReadProcessMemory(hProcess, commandLineBuffer, bytes, new IntPtr(commandLineLength), IntPtr.Zero))
{
throw new Win32Exception(String.Format("Unable to read command line, win32 error {0}", Marshal.GetLastWin32Error()));
}
return(Encoding.Unicode.GetString(bytes));
}
private static string GetCommandLineCore(IntPtr hProcess)
{
int targetProcessBitness = GetProcessBitness(hProcess);
if (targetProcessBitness == 64 && !System.Environment.Is64BitProcess)
{
throw new Win32Exception(
"The current process should run in 64 bit mode to be able to get the environment of another 64 bit process.");
}
var pPeb = targetProcessBitness == 64 ? GetPeb64(hProcess) : GetPeb32(hProcess);
//dt -r ntdll!PEB for offset values of the PEB
var offset = targetProcessBitness == 64 ? 0x20 : 0x10;
var unicodeStringOffset = targetProcessBitness == 64 ? 0x70 : 0x40;
IntPtr ptr;
if (!TryReadIntPtr(hProcess, pPeb + offset, out ptr))
{
throw new Win32Exception("Unable to read PEB.");
}
int commandLineLength;
IntPtr commandLineBuffer;
if ((targetProcessBitness == 64 && System.Environment.Is64BitProcess) ||
(targetProcessBitness == 32 && !System.Environment.Is64BitProcess))
{
//we running same bitness as the target process, use native UNICODE_STRING
var unicodeString = new ProcessNativeMethods.UNICODE_STRING();
if (!ProcessNativeMethods.ReadProcessMemory(hProcess, ptr + unicodeStringOffset, ref unicodeString, new IntPtr(Marshal.SizeOf(unicodeString)), IntPtr.Zero))
{
throw new Win32Exception(String.Format("Unable to read command line, win32 error {0}", Marshal.GetLastWin32Error()));
}
commandLineLength = unicodeString.Length;
commandLineBuffer = unicodeString.Buffer;
}
else
{
//we are running 64 but target process is 32, use UNICODE_STRING_32
var unicodeString = new ProcessNativeMethods.UNICODE_STRING_32();
if (!ProcessNativeMethods.ReadProcessMemory(hProcess, ptr + unicodeStringOffset, ref unicodeString, new IntPtr(Marshal.SizeOf(unicodeString)), IntPtr.Zero))
{
throw new Win32Exception(String.Format("Unable to read command line, win32 error {0}", Marshal.GetLastWin32Error()));
}
commandLineLength = unicodeString.Length;
commandLineBuffer = new IntPtr(unicodeString.Buffer);
}
var bytes = new byte[commandLineLength];
if (!ProcessNativeMethods.ReadProcessMemory(hProcess, commandLineBuffer, bytes, new IntPtr(commandLineLength), IntPtr.Zero))
{
throw new Win32Exception(String.Format("Unable to read command line, win32 error {0}", Marshal.GetLastWin32Error()));
}
return Encoding.Unicode.GetString(bytes);
}
