Jump to content

how to get the process comands line by process pid


Recommended Posts

Hello my friends
I have an inquiry after your permission
I found a function to get the special line commands for any operation
It requires the name of the process to be searched
I want to use it to know the process
Is this possible with this function
Here is the code

 

Func commandLineGet($proc, $strComputer=".")
dim $array[1]
local $ArrayNumber
local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & $strComputer & "\root\cimv2")
local $oProcessColl = $oWMI.ExecQuery("Select * from Win32_Process where Name= " & '"'& $Proc & '"')
local $Process
For $Process In $oProcessColl
$Process = $Process.Commandline
    ReDim $Array[UBound($Array)+1]
$ArrayNumber = UBound($Array)-1
$array[$ArrayNumber] = $Process
Next
$ArrayNumber = UBound($Array)-1
$array[0] = $ArrayNumber
return $array
EndFunc

Edited by nacerbaaziz
Link to comment
Share on other sites

i reTryed this but it not give me the command line switches

#RequireAdmin

#include <Array.au3>
#include <WinAPI.au3>
#include <WinAPIProc.au3>

Local $aAdjust, $aList = 0

; Enable "SeDebugPrivilege" privilege for obtain full access rights to another processes
Local $hToken = _WinAPI_OpenProcessToken(BitOR($TOKEN_ADJUST_PRIVILEGES, $TOKEN_QUERY))

_WinAPI_AdjustTokenPrivileges($hToken, $SE_DEBUG_NAME, $SE_PRIVILEGE_ENABLED, $aAdjust)

; Retrieve command-line arguments for all processes the system
If Not (@error Or @extended) Then
msgBox(64, "command line", _WinAPI_GetProcessCommandLine(9408))
EndIf

; Enable SeDebugPrivilege privilege by default
_WinAPI_AdjustTokenPrivileges($hToken, $aAdjust, 0, $aAdjust)
_WinAPI_CloseHandle($hToken)

 

where is the error please

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

×
×
  • Create New...