1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:

typedef struct _RTL_USER_PROCESS_PARAMETERS {
  ULONG                   MaximumLength;
  ULONG                   Length;
  ULONG                   Flags;
  ULONG                   DebugFlags;
  PVOID                   ConsoleHandle;
  ULONG                   ConsoleFlags;
  HANDLE                  StdInputHandle;
  HANDLE                  StdOutputHandle;
  HANDLE                  StdErrorHandle;
  UNICODE_STRING          CurrentDirectoryPath;
  HANDLE                  CurrentDirectoryHandle;
  UNICODE_STRING          DllPath;
  UNICODE_STRING          ImagePathName;
  UNICODE_STRING          CommandLine;
  PVOID                   Environment;
  ULONG                   StartingPositionLeft;
  ULONG                   StartingPositionTop;
  ULONG                   Width;
  ULONG                   Height;
  ULONG                   CharWidth;
  ULONG                   CharHeight;
  ULONG                   ConsoleTextAttributes;
  ULONG                   WindowFlags;
  ULONG                   ShowWindowFlags;
  UNICODE_STRING          WindowTitle;
  UNICODE_STRING          DesktopName;
  UNICODE_STRING          ShellInfo;
  UNICODE_STRING          RuntimeData;
  RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;					

1:
2:
3:
4:
5:
6:

typedef struct _RTL_DRIVE_LETTER_CURDIR {
  USHORT                  Flags;
  USHORT                  Length;
  ULONG                   TimeStamp;
  UNICODE_STRING          DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;					

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:

function GetProcessCmdLine(ProcessId: DWORD): String;
var
  ProcessHandle: THandle;
  MBI: TMemoryBasicInformation;
  Buffer: Pointer;
  SystemInfo: TSystemInfo;
  Size: DWORD;
  BytesRead: DWORD;
  Position: PByte;
begin

  FillChar(SystemInfo, SizeOf(TSystemInfo), 0);
  GetSystemInfo(SystemInfo);
  GetMem(Buffer, SystemInfo.dwPageSize);
  try
    ProcessHandle := OpenProcess(PROCESS_VM_READ or PROCESS_QUERY_INFORMATION, False, ProcessId);
    if ProcessHandle <> 0 then
    begin
      Size := SizeOf(TMemoryBasicInformation);
      FillChar(MBI, Size, 0);
      if VirtualQueryEx(ProcessHandle, Pointer($00020000), MBI, Size) = Size then
      begin
        if ReadProcessMemory(ProcessHandle, MBI.BaseAddress, Buffer, SystemInfo.dwPageSize, BytesRead) then
        begin
          Position := Buffer;
          Inc(Position, $498);
          Inc(Position, (Length(PWideChar(Position)) + 2) * SizeOf(WideChar));
          Inc(Position, (Length(PWideChar(Position)) + 2) * SizeOf(WideChar));
          Result := PWideChar(Position);
        end else
          RaiseLastOSError;
      end else
        RaiseLastOSError;
    end else
      RaiseLastOSError;
  finally
    FreeMem(Buffer);
  end;

end;					

1:
2:

Inc(Position, (Length(PWideChar(Position)) + 1) * SizeOf(WideChar));
Inc(Position, (Length(PWideChar(Position)) + 5) * SizeOf(WideChar));					

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:

function GetProcessCmdLine(ProcessId: DWORD): String;
var
  ProcessHandle: THandle;
  MBI: TMemoryBasicInformation;
  Buffer: Pointer;
  SystemInfo: TSystemInfo;
  Size: DWORD;
  CmdLine: WideString;
  LengthCmdLine: Word;
  PosCmdLine: Pointer;
begin

  Result := '';
  FillChar(SystemInfo, SizeOf(TSystemInfo), 0);
  GetSystemInfo(SystemInfo);
  GetMem(Buffer, SystemInfo.dwPageSize);
  try
    ProcessHandle := OpenProcess(PROCESS_VM_READ or PROCESS_QUERY_INFORMATION, False, ProcessId);
    if ProcessHandle <> 0 then
    begin
      Size := SizeOf(TMemoryBasicInformation);
      FillChar(MBI, Size, 0);
      if VirtualQueryEx(ProcessHandle, Pointer($00020000), MBI, Size) = Size then
        if ReadProcessMemory(ProcessHandle, MBI.BaseAddress, Buffer, SystemInfo.dwPageSize, DWORD(nil^)) then
        begin
          LengthCmdLine := PWord(Longint(Buffer) + $42)^;
          if LengthCmdLine < (MAX_PATH * 2) then
          begin
            SetLength(CmdLine, LengthCmdLine);
            PosCmdLine := Pointer(PLongint(Longint(Buffer) + $44)^);
            if ReadProcessMemory(ProcessHandle, PosCmdLine, PWideChar(CmdLine), LengthCmdLine, DWORD(nil^)) then
              Result := Trim(Copy(CmdLine, 1, Pos(#0, CmdLine) - 1));
          end;
        end;
      CloseHandle(ProcessHandle);
    end;
  finally
    FreeMem(Buffer);
  end;

end;