title: Getting another process command line in Windows
body: <p>I am trying to get another process' command-line parameters (on WinXP 32bit).</p>
  <p>I do the following:</p>
  <pre><code>hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_TERMINATE, FALSE, ProcList.proc_id_as_numbers[i]);
  
  BytesNeeded = sizeof(PROCESS_BASIC_INFORMATION);
  ZwQueryInformationProcess(hProcess, ProcessBasicInformation, UserPool, sizeof(PROCESS_BASIC_INFORMATION), &amp;BytesNeeded);
  pbi = (PPROCESS_BASIC_INFORMATION)UserPool;
  
  BytesNeeded = sizeof(PEB);
  res = ZwReadVirtualMemory(hProcess, pbi-&gt;PebBaseAddress, UserPool, sizeof(PEB), &amp;BytesNeeded);
  /* zero value returned */
  peb = (PPEB)UserPool;
  
  BytesNeeded = sizeof(RTL_USER_PROCESS_PARAMETERS);
  res = ZwReadVirtualMemory(hProcess, peb-&gt;ProcessParameters, UserPool, sizeof(RTL_USER_PROCESS_PARAMETERS), &amp;BytesNeeded);
  ProcParam = (PRTL_USER_PROCESS_PARAMETERS)UserPool;
  </code></pre>
  <p>After the first call, <code>pbi.UniqueProcessID</code> is correct.</p>
  <p>But, after calling <code>ZwReadVirtualMemory()</code>, I get the command-line for my process, not the requested one.</p>
  <p>I also used <code>ReadProcessMemory()</code> &amp; <code>NtQueryInformationProcess()</code>, but get the same result.</p>
  <p>Can anybody help?</p>
  <p>On <a href="http://forum.sysinternals.com/get-commandline-of-running-processes_topic6510_page1.html" rel="nofollow noreferrer">this forum thread</a>, it is said that this code works. Unfortunately, I do not have access to post on that forum to ask them.</p>