'---------------------------------------------------------------------------------------
' Module      : mReadCommandLine
' DateTime    : 26/12/2007 22:48
' Author      : Me and some others :D
' Mail        : cobein27@hotmail.com
' Purpose     : Read command line parameters from an external proc
' Requirements: None
'---------------------------------------------------------------------------------------
Option Explicit
 
Private Type OBJECT_ATTRIBUTES
    Length As Long
    RootDirectory As Long
    ObjectName As Long
    Attributes As Long
    SecurityDescriptor As Long
    SecurityQualityOfService As Long
End Type
 
Private Type CLIENT_ID
    UniqueProcess As Long
    UniqueThread  As Long
End Type
 
Private Type PROCESSENTRY32
  dwSize As Long
  cntUsage As Long
  th32ProcessID As Long
  th32DefaultHeapID As Long
  th32ModuleID As Long
  cntThreads As Long
  th32ParentProcessID As Long
  pcPriClassBase As Long
  dwFlags As Long
  szExeFile As String * 260
End Type
 
Private Declare Function NtOpenProcess Lib "NTDLL.DLL" (ByRef ProcessHandle As Long, ByVal AccessMask As Long, ByRef ObjectAttributes As OBJECT_ATTRIBUTES, ByRef ClientID As CLIENT_ID) As Long
Private Declare Function NtClose Lib "NTDLL.DLL" (ByVal ObjectHandle As Long) As Long
Private Declare Sub CopyMemory Lib "kernel32.dll" Alias "RtlMoveMemory" (ByRef Destination As Any, ByRef Source As Any, ByVal Length As Long)
Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function Process32Next Lib "Kernel32" (ByVal hSnapShot As Long, lppe As PROCESSENTRY32) As Long
Private Declare Function Process32First Lib "Kernel32" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
Private Declare Function CreateToolhelp32Snapshot Lib "Kernel32" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
Private Const TH32CS_SNAPPROCESS = &H2
 
Public Function ProcessCommandLine(ByVal lProcessId As Long) As String
    Dim tCLIENT_ID              As CLIENT_ID
    Dim tOBJECT_ATTRIBUTES      As OBJECT_ATTRIBUTES
    Dim lRet                    As Long
    Dim sData                   As String
    Dim lProcess                As Long
    Dim lAddress                As Long
    Dim lRead                   As Long
 
    tOBJECT_ATTRIBUTES.Length = Len(tOBJECT_ATTRIBUTES)
    tCLIENT_ID.UniqueProcess = lProcessId
 
    lRet = NtOpenProcess(lProcess, &H10, tOBJECT_ATTRIBUTES, tCLIENT_ID)
    If lProcess = 0 Then Exit Function
 
    lAddress = GetProcAddress(GetModuleHandle("kernel32"), "GetCommandLineA")
 
    Call CopyMemory(lAddress, ByVal lAddress + 1, &H4)
 
    If ReadProcessMemory(lProcess, ByVal lAddress, lAddress, 4, lRead) Then
        sData = String(260, vbNullChar)
        If ReadProcessMemory(lProcess, ByVal lAddress, ByVal sData, 260, lRead) Then
            ProcessCommandLine = Left(sData, InStr(sData, vbNullChar) - 1)
        End If
    End If
 
    Call NtClose(lProcess)
 
End Function
 
 
Public Function ObtenerPID(ByVal sEXE As String) As Long
    Dim bCopied As Long, lSnapShot As Long
    Dim sName As String
    Dim tPE As PROCESSENTRY32
 
    lSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
    If lSnapShot < 0 Then Exit Function
    tPE.dwSize = Len(tPE)
    bCopied = Process32First(lSnapShot, tPE)
    Do While bCopied
        sName = Left$(tPE.szExeFile, InStr(tPE.szExeFile, Chr(0)) - 1)
        sName = Mid(sName, InStrRev(sName, "\") + 1)
        If InStr(sName, Chr(0)) Then
          sName = Left(sName, InStr(sName, Chr(0)) - 1)
        End If
        bCopied = Process32Next(lSnapShot, tPE)
        If StrComp(sEXE, sName, vbTextCompare) = 0 Then
          ObtenerPID = tPE.th32ProcessID
          Exit Do
        End If
    Loop
End Function
 

MsgBox ProcessCommandLine(ObtenerPID("calc.exe"))