Delphi 获取进程路径及命令行参数, 但有的进程获取时会报错,不知为啥
type
PVOID64 = UINT64; _UNICODE_STRING = packed record
Length : USHORT;
MaximumLength : USHORT;
Buffer : PWideChar;
end;
UNICODE_STRING = _UNICODE_STRING;
PUNICODE_STRING =^_UNICODE_STRING; _UNICODE_STRING64 = packed record
Length : USHORT;
MaximumLength : USHORT;
Fill : DWORD;
Buffer : PVOID64;
end;
UNICODE_STRING64 = _UNICODE_STRING64;
PUNICODE_STRING64 =^_UNICODE_STRING64; __PEB = packed record
Filler : array [..] of DWORD;
ProcessParameters : DWORD;
end; __PEB64 = packed record
Filler : array [..] of PVOID64;
ProcessParameters : PVOID64;
end; _CURDIR = packed record
DosPath : UNICODE_STRING;
Handle : THANDLE;
end; _CURDIR64 = packed record
DosPath : UNICODE_STRING64;
Handle : PVOID64;
end; _RTL_USER_PROCESS_PARAMETERS = packed record
MaximumLength :DWORD;
Length :DWORD;
Flags :DWORD;
DebugFlags :DWORD;
ConsoleHandle :THandle;
ConsoleFlags :DWORD;
StandardInput :THandle;
StandardOutput :THandle;
StandardError :THandle;
//////////////////////////
DosPath :UNICODE_STRING; //CurrentDirectory
Handle :THANDLE;
//////////////////////////
DllPath :UNICODE_STRING;
ImagePathName :UNICODE_STRING;
CmdLine :UNICODE_STRING;
end; _RTL_USER_PROCESS_PARAMETERS64 = record
MaximumLength :DWORD;
Length :DWORD;
Flags :DWORD;
DebugFlags :DWORD;
ConsoleHandle :PVOID64;
ConsoleFlags :DWORD;
StandardInput :PVOID64;
StandardOutput :PVOID64;
StandardError :PVOID64;
//////////////////////////
CurrentDirectory:_CURDIR64;
//////////////////////////
DllPath :UNICODE_STRING64;
ImagePathName :UNICODE_STRING64;
CmdLine :UNICODE_STRING64;
end; _PROCESS_BASIC_INFORMATION = packed record
Reserved1 :PVOID;
PebBaseAddress :PVOID;
Reserved2 :Array [..] of PVOID;
UniqueProcessId :PVOID;
Reserved3 :PVOID;
end;
PROCESS_BASIC_INFORMATION =_PROCESS_BASIC_INFORMATION;
PPROCESS_BASIC_INFORMATION =^_PROCESS_BASIC_INFORMATION; _PROCESS_BASIC_INFORMATION64 = packed record
Reserved1 :PVOID64;
PebBaseAddress :PVOID64;
Reserved2 :Array [..] of PVOID64;
UniqueProcessId :PVOID64;
Reserved3 :PVOID64;
end;
PROCESS_BASIC_INFORMATION64 =_PROCESS_BASIC_INFORMATION64;
PPROCESS_BASIC_INFORMATION64 =^_PROCESS_BASIC_INFORMATION64; TNtQueryInformationProcess = function(a:THANDLE;b:UINT;c:PVOID;d:ULONG;e:PULONG):LONG; stdcall;
TNtReadVirtualMemory = function(ProcessHandle:THANDLE; BaseAddress:PVOID; Buffer:PVOID; NumberOfBytesToRead:ULONG; NumberOfBytesReaded:PULONG):LONG; stdcall;
TNtReadVirtualMemory64 = function(ProcessHandle:THANDLE; BaseAddress:PVOID64; Buffer:PVOID; NumberOfBytesToRead:UINT64; NumberOfBytesReaded:PUINT64):LONG; stdcall;
TISWOW64PROCESS = function(hProcess:THANDLE; var Wow64Process:BOOL):BOOL; stdcall; function GetProcessImagePathAndCmdLine(hProcess:THandle; var ImagePath:string; var CmdLine:string):Boolean; implementation function GetProcessImagePathAndCmdLine32(hProcess:THandle; var ImagePath:string; var CmdLine:string):Boolean;
var
pbi : PROCESS_BASIC_INFORMATION;
pfnNtQueryInformationProcess : TNtQueryInformationProcess;
pfnNtReadVirtualMemory : TNtReadVirtualMemory;
dwSize:DWORD;
size:SIZE_T;
iReturn:Integer;
pAddrPEB:PVOID;
PEB:__PEB;
stBlock:_RTL_USER_PROCESS_PARAMETERS;
PathBuffer : PByte;
begin
Result := False;
@pfnNtQueryInformationProcess := GetProcAddress(GetModuleHandle('ntdll.dll'),'NtQueryInformationProcess');
@pfnNtReadVirtualMemory := GetProcAddress(GetModuleHandle('ntdll.dll'),'NtReadVirtualMemory'); if ( Assigned(pfnNtQueryInformationProcess) ) then
begin
pAddrPEB := nil;
iReturn := pfnNtQueryInformationProcess(hProcess,,@pbi,sizeof(pbi),@dwSize);
pAddrPEB := pbi.PebBaseAddress;
// NtQueryInformationProcess returns a negative value if it fails
if (iReturn >= ) then
begin
// . Find the Process Environment Block
size := dwSize;
if ( ERROR_SUCCESS <> pfnNtReadVirtualMemory(hProcess, pAddrPEB, @PEB, sizeof(PEB), PULONG(@size)) ) then
begin
// Call GetLastError() if you need to know why
Exit;
end;
// . From this PEB, get the address of the block containing
// a pointer to the CmdLine
if ( ERROR_SUCCESS <> pfnNtReadVirtualMemory(hProcess, PVOID(PEB.ProcessParameters), @stBlock, sizeof(stBlock), PULONG(@size))) then
begin
// Call GetLastError() if you need to know why
Exit;
end;
// . Get the ImagePathName
if (stBlock.ImagePathName.MaximumLength <= ) then
begin
PathBuffer := GetMemory(stBlock.ImagePathName.MaximumLength);
FillChar(PathBuffer^,stBlock.ImagePathName.MaximumLength,);
if (stBlock.ImagePathName.MaximumLength <= ) and ( ERROR_SUCCESS = pfnNtReadVirtualMemory(hProcess, PVOID(stBlock.ImagePathName.Buffer), PVOID(PathBuffer), stBlock.ImagePathName.Length*sizeof(Char), PULONG(@size))) then
begin // Call GetLastError() if you need to know why
SetString(ImagePath,PChar(PathBuffer),stBlock.ImagePathName.Length div );
Result := True;
end;
FreeMemory(PathBuffer);
end;
// . Get the CmdLine
if (stBlock.CmdLine.MaximumLength <= ) then
begin
PathBuffer := GetMemory(stBlock.CmdLine.MaximumLength);
FillChar(PathBuffer^,stBlock.CmdLine.MaximumLength,);
if ( ERROR_SUCCESS = pfnNtReadVirtualMemory(hProcess, PVOID(stBlock.CmdLine.Buffer), PVOID(PathBuffer), stBlock.CmdLine.Length*sizeof(Char), PULONG(@size))) then
begin // Call GetLastError() if you need to know why
SetString(CmdLine,PChar(PathBuffer),stBlock.CmdLine.Length div );
Result := True;
end;
FreeMemory(PathBuffer);
end;
end;
end;
end; function GetProcessImagePathAndCmdLine64(hProcess:THandle; var ImagePath:string; var CmdLine:string):Boolean;
var
pbi : PROCESS_BASIC_INFORMATION64;
pfnNtQueryInformationProcess : TNtQueryInformationProcess;
pfnNtReadVirtualMemory : TNtReadVirtualMemory64;
dwSize:DWORD;
size:UINT64;
iReturn:Integer;
pAddrPEB:PVOID64;
PEB:__PEB64;
stBlock:_RTL_USER_PROCESS_PARAMETERS64;
PathBuffer : PByte;
begin
Result := False;
@pfnNtQueryInformationProcess := GetProcAddress(GetModuleHandle('ntdll.dll'),'NtWow64QueryInformationProcess64');
@pfnNtReadVirtualMemory := GetProcAddress(GetModuleHandle('ntdll.dll'),'NtWow64ReadVirtualMemory64'); if ( Assigned(pfnNtQueryInformationProcess) ) then
begin
pAddrPEB := ;
iReturn := pfnNtQueryInformationProcess(hProcess,,@pbi,sizeof(pbi),PULONG(@dwSize));
pAddrPEB := pbi.PebBaseAddress;
// NtQueryInformationProcess returns a negative value if it fails
if (iReturn >= ) then
begin
// . Find the Process Environment Block
size := dwSize;
if ( ERROR_SUCCESS <> pfnNtReadVirtualMemory(hProcess, pAddrPEB, @PEB, sizeof(PEB), PUINT64(@size)) ) then
begin
// Call GetLastError() if you need to know why
Exit;
end;
// . From this PEB, get the address of the block containing
// a pointer to the CmdLine
if ( ERROR_SUCCESS <> pfnNtReadVirtualMemory(hProcess, PEB.ProcessParameters, @stBlock, sizeof(stBlock), PUINT64(@size))) then
begin
// Call GetLastError() if you need to know why
Exit;
end;
// . Get the ImagePathName
PathBuffer := GetMemory(stBlock.ImagePathName.MaximumLength);
FillChar(PathBuffer^,stBlock.ImagePathName.MaximumLength,);
if ( ERROR_SUCCESS = pfnNtReadVirtualMemory(hProcess, stBlock.ImagePathName.Buffer, PVOID(PathBuffer), stBlock.ImagePathName.Length*sizeof(Char), PUINT64(@size))) then
begin // Call GetLastError() if you need to know why
SetString(ImagePath,PChar(PathBuffer),stBlock.ImagePathName.Length div );
Result := True;
end;
// . Get the CmdLine
FreeMemory(PathBuffer);
PathBuffer := GetMemory(stBlock.CmdLine.MaximumLength);
FillChar(PathBuffer^,stBlock.CmdLine.MaximumLength,);
if ( ERROR_SUCCESS = pfnNtReadVirtualMemory(hProcess, stBlock.CmdLine.Buffer, PVOID(PathBuffer), stBlock.CmdLine.Length*sizeof(Char), PUINT64(@size))) then
begin // Call GetLastError() if you need to know why
SetString(CmdLine,PChar(PathBuffer),stBlock.CmdLine.Length div );
Result := True;
end;
FreeMemory(PathBuffer);
end;
end;
end; function GetProcessImagePathAndCmdLine(hProcess:THandle; var ImagePath:string; var CmdLine:string):Boolean;
var
fn:TISWOW64PROCESS;
begin
Result := False;
try
fn := GetProcAddress(GetModuleHandle('kernel32'),'IsWow64Process');
if Assigned(fn) then
begin
Result := GetProcessImagePathAndCmdLine64(hProcess,ImagePath,CmdLine);
end else
begin
Result := GetProcessImagePathAndCmdLine32(hProcess,ImagePath,CmdLine);
end;
Except
end;
end;