program GetCommandLineExDemo;
{$APPTYPE CONSOLE}

uses
  JwaWinBase, JwaNative, JwaWinNt, JwaWinType, JwaPSAPI, JwaNtStatus;

type
  PROCESS_BASIC_INFORMATION = packed record
    ExitStatus: DWORD;
    PebBaseAddress: Pointer;
    AffinityMask: DWORD;
    BasePriority: DWORD;
    UniqueProcessId: DWORD;
    InheritedUniquePID:DWORD;
  end;

// Funktioniert nur für Windows NT basierte Systeme
function GetCommandLineEx(PID : DWORD) : widestring;
var
  ProcessHandle : THandle;
  ProcessBasicInfo : PROCESS_BASIC_INFORMATION;
  PEB : _PEB_W2K;
  ProcessParameters : RTL_USER_PROCESS_PARAMETERS;
  ReturnLength : DWORD;
  CommandLine : PWideChar;
begin
  result := '';
  ProcessHandle := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, false, PID);
  if ProcessHandle <> 0 then
    begin
      // Schritt 1: Wir holen uns die PROCESS_BASIC_INFORMATION um den PEB zu lokalisieren
      if (NtQueryInformationProcess(ProcessHandle, ProcessBasicInformation, @ProcessBasicInfo, SizeOf(ProcessBasicInfo), @ReturnLength) = STATUS_SUCCESS) and (ReturnLength = SizeOf(ProcessBasicInfo)) then
        // Schritt 2: Wir lesen den PEB aus
        if ReadProcessMemory(ProcessHandle, ProcessBasicInfo.PebBaseAddress, @PEB, SizeOf(PEB), @ReturnLength) and (ReturnLength = SizeOf(PEB)) then
          // Schritt 3: Wir lesen die ProcessParameters aus
          if ReadProcessMemory(ProcessHandle, PEB.ProcessParameters, @ProcessParameters, SizeOf(ProcessParameters), @ReturnLength) and (ReturnLength = SizeOf(ProcessParameters)) then
            begin
              // Schritt 4: Wir lesen die Command Line aus
              GetMem(CommandLine, (ProcessParameters.CommandLine.Length + 1) * 2);
              if ReadProcessMemory(ProcessHandle, ProcessParameters.CommandLine.Buffer, CommandLine, ProcessParameters.CommandLine.Length * 2, @ReturnLength) then
                result := WideString(CommandLine);
              FreeMem(CommandLine);
            end;
      CloseHandle(ProcessHandle);
    end;
end;

var
  PIDs : array[0..1000] of DWORD;
  Needed : DWORD;
  i : Integer;
begin
  EnumProcesses(@PIDs[0], 1001, Needed);
  for i := 0 to (Needed div 4) - 1 do
    writeln(PIDs[i], ' --> ', GetCommandLineEx(PIDs[i]));
  readln;
end.