Delphi 获取进程命令行参数方法

野性酷女 2023-10-06 10:14 45阅读 0赞

适合D2007 x86版本

unit Unit1;
    
    interface
    
    uses
      Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
      Dialogs, StdCtrls;
    
    type
      TForm1 = class(TForm)
        Edit2: TEdit;
        Button1: TButton;
        Memo1: TMemo;
        procedure Button1Click(Sender: TObject);
      private
        { Private declarations }
      public
        { Public declarations }
      end;
    
    type
      USHORT = Word;
    
      UNICODE_STRING = packed record
        Length: USHORT;
        MaximumLength: USHORT;
        Buffer: PWideString;
      end;
    
      RTL_USER_PROCESS_PARAMETERS = packed record
        Reserved1: array[0..15] of Byte;
        Reserved2: array[0..9] of Pointer;
        ImagePathName: UNICODE_STRING;
        CommandLine: UNICODE_STRING;
      end;
    
      PRTL_USER_PROCESS_PARAMETERS = ^RTL_USER_PROCESS_PARAMETERS;
    
      PEB = packed record
        Reserved1: array[0..1] of Byte;
        BeingDebugged: ByteBool;
        Reserved2: Byte;
        Reserved3: array[0..1] of Pointer;
        Ldr: Pointer;
        ProcessParameters: PRTL_USER_PROCESS_PARAMETERS;
        Reserved4: array[0..103] of Byte;
        Reserved5: array[0..51] of Pointer;
      end;
    
      PPEB = ^PEB;
      PROCESS_BASIC_INFORMATION = packed record
        ExitStatus: DWORD;
        PebBaseAddress: PPEB;
        AffinityMask: DWORD;
        BasePriority: DWORD;
        uUniqueProcessId: ULong;
        uInheritedFromUniqueProcessId: ULong;
      end;
    
      TProcessBasicInformation = PROCESS_BASIC_INFORMATION;
    
    
    function NtQueryInformationProcess(ProcessHandle: THandle;ProcessInformationClass: Byte;ProcessInformation: Pointer;
                                       ProcessInformationLength: ULONG;ReturnLength: PULONG): DWORD; stdcall; external 'ntdll.dll';
    
    var
      Form1: TForm1;
    
    implementation
    
    {$R *.dfm}
    
    //only match x86 not support x64 bit application
    function GetProcessCmdLine(PID: Cardinal): string;
    const
      ProcessBasicInformation = 0;
    var
      h: THandle;
      pbi: TProcessBasicInformation;
      ret: Cardinal;
      r: Cardinal;
      ws: WideString;
      aPEB: PEB;
      ProcPar: RTL_USER_PROCESS_PARAMETERS;
    begin
      Result := '';
      if PID = 0 then   PID := GetCurrentProcessID;
      try
        h := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, PID);
        if h = 0 then  Exit;
        try
          ret := NtQueryInformationProcess(h, ProcessBasicInformation, @pbi, SizeOf(pbi), @r);
          if ret = 0 then
            repeat
              if (not ReadProcessMemory(h, pbi.PebBaseAddress, @aPEB, SizeOf(aPEB), r)) or (r <> SizeOf(aPEB)) then
                break;
              if (not ReadProcessMemory(h, aPEB.ProcessParameters, @ProcPar, SizeOf(ProcPar), r)) or (r <> SizeOf(ProcPar)) then
                break;
              SetLength(ws, ProcPar.CommandLine.Length div 2);
              if (not ReadProcessMemory(h, ProcPar.CommandLine.Buffer, PWideChar(ws), ProcPar.CommandLine.Length, r)) or (r <> ProcPar.CommandLine.Length) then
                break;
              Result := ws;
            until True;
        finally
          CloseHandle(h);
        end;
      finally
      end;
    end;
    
    function EnableDebugPriv: Boolean;  //提升进程权限为DEBUG权限
    var
      hToken: THandle;
      tp: TTokenPrivileges;
      rl: Cardinal;
    begin
      Result := false;
      OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY,hToken);
      if LookupPrivilegeValue(nil, 'SeDebugPrivilege', tp.Privileges[0].Luid) then
      begin
        tp.PrivilegeCount:=1;
        tp.Privileges[0].Attributes:= SE_PRIVILEGE_ENABLED;
        Result := AdjustTokenPrivileges(hToken, false, tp, SizeOf(tp), nil, rl);
      end;
    end;
    
    procedure TForm1.Button1Click(Sender: TObject);
    begin
      EnableDebugPriv;
      Memo1.Text:=GetProcessCmdLine(StrToInt(Edit2.Text));
    end;
    
    end.

效果如下图：

![20200602155847484.png][]

![20200602155544386.png][]

**以下代码适合X64位进程（32位兼容）编译环境XE2**

function GetProcessCmdLine64(PID: Cardinal): string;
    var
      pbi : PROCESS_BASIC_INFORMATION64;
      pfnNtQueryInformationProcess : TNtQueryInformationProcess;
      pfnNtReadVirtualMemory : TNtReadVirtualMemory64;
      dwSize:DWORD;
      size:UINT64;
      iReturn:Integer;
      pAddrPEB:PVOID64;
      PEB:__PEB64;
      stBlock:_RTL_USER_PROCESS_PARAMETERS64;
      PathBuffer : PByte;
      hProcess:Cardinal;
      CmdLine:string;
    begin
      Result := '';
      @pfnNtQueryInformationProcess := GetProcAddress(GetModuleHandle('ntdll.dll'),'NtWow64QueryInformationProcess64');
      @pfnNtReadVirtualMemory := GetProcAddress(GetModuleHandle('ntdll.dll'),'NtWow64ReadVirtualMemory64');
    
      hProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, PID);
    
      if ( Assigned(pfnNtQueryInformationProcess) ) then
      begin
        pAddrPEB := 0;
        iReturn := pfnNtQueryInformationProcess(hProcess,0,@pbi,sizeof(pbi),PULONG(@dwSize));
        pAddrPEB := pbi.PebBaseAddress;
        // NtQueryInformationProcess returns a negative value if it fails
        if (iReturn >= 0) then
        begin
          // 1. Find the Process Environment Block
          size := dwSize;
          if ( ERROR_SUCCESS <> pfnNtReadVirtualMemory(hProcess, pAddrPEB, @PEB, sizeof(PEB), PUINT64(@size)) ) then
          begin
            // Call GetLastError() if you need to know why
            Exit;
          end;
          // 2. From this PEB, get the address of the block containing
          // a pointer to the CmdLine
          if ( ERROR_SUCCESS <> pfnNtReadVirtualMemory(hProcess, PEB.ProcessParameters, @stBlock, sizeof(stBlock), PUINT64(@size))) then
          begin
            // Call GetLastError() if you need to know why
            Exit;
          end;
     {     // 3. Get the ImagePathName
          PathBuffer := GetMemory(stBlock.ImagePathName.MaximumLength);
          FillChar(PathBuffer^,stBlock.ImagePathName.MaximumLength,0);
          if ( ERROR_SUCCESS = pfnNtReadVirtualMemory(hProcess, stBlock.ImagePathName.Buffer, PVOID(PathBuffer), stBlock.ImagePathName.Length*sizeof(Char), PUINT64(@size))) then
          begin    // Call GetLastError() if you need to know why
            SetString(ImagePath,PChar(PathBuffer),stBlock.ImagePathName.Length div 2);
            Result := True;   }
          end;
          // 4. Get the CmdLine
         // FreeMemory(PathBuffer);
          PathBuffer := GetMemory(stBlock.CmdLine.MaximumLength);
          FillChar(PathBuffer^,stBlock.CmdLine.MaximumLength,0);
          if ( ERROR_SUCCESS = pfnNtReadVirtualMemory(hProcess, stBlock.CmdLine.Buffer, PVOID(PathBuffer), stBlock.CmdLine.Length*sizeof(Char), PUINT64(@size))) then
          begin    // Call GetLastError() if you need to know why
            SetString(CmdLine,PChar(PathBuffer),stBlock.CmdLine.Length div 2);
            Result := CmdLine;
          end;
          FreeMemory(PathBuffer);
        end;
      end;

效果：

![2020060216243914.png][]

![20200602162502628.png][]

[20200602155847484.png]: https://img-blog.csdnimg.cn/20200602155847484.png
[20200602155544386.png]: https://img-blog.csdnimg.cn/20200602155544386.png
[2020060216243914.png]: https://img-blog.csdnimg.cn/2020060216243914.png
[20200602162502628.png]: https://img-blog.csdnimg.cn/20200602162502628.png