Skip to content

Instantly share code, notes, and snippets.

@tyranid
Created June 2, 2018 16:43
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tyranid/53245dfcd18bdce2d562fc1dcb9b4703 to your computer and use it in GitHub Desktop.
Save tyranid/53245dfcd18bdce2d562fc1dcb9b4703 to your computer and use it in GitHub Desktop.
<?xml version="1.0" encoding="utf-8" ?>
<Types>
<Type>
<Name>System.Diagnostics.Process</Name>
<Members>
<ScriptProperty>
<Name>CommandLine</Name>
<GetScriptBlock>
$src = @"
using Microsoft.Win32.SafeHandles;
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;
public class CommandLine
{
const int ProcessCommandLineInformation = 60;
[StructLayout(LayoutKind.Sequential)]
class CommandLineString
{
public ushort Length;
public ushort MaximumLength;
public IntPtr Buffer;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 32*1024)]
public byte[] Data;
public CommandLineString()
{
Data = new byte[32 * 1024];
MaximumLength = (ushort) Data.Length;
}
public override string ToString()
{
return Encoding.Unicode.GetString(Data, 0, Length);
}
}
[DllImport("ntdll.dll")]
static extern int NtQueryInformationProcess(
SafeProcessHandle ProcessHandle,
int ProcessInformationClass,
[In, Out] CommandLineString ProcessInformation,
int ProcessInformationLength,
out int ReturnLength
);
const int QueryLimitedInformation = 0x1000;
[DllImport("kernel32.dll", SetLastError = true)]
static extern SafeProcessHandle OpenProcess(
int dwDesiredAccess,
bool bInheritHandle,
int dwProcessId
);
public static string Get(Process process)
{
using (var handle = OpenProcess(QueryLimitedInformation, false, process.Id))
{
if (handle.IsInvalid)
{
return string.Empty;
}
int return_length;
CommandLineString str = new CommandLineString();
int status = NtQueryInformationProcess(handle, ProcessCommandLineInformation, str, Marshal.SizeOf(str), out return_length);
if (status == 0)
{
return str.ToString();
}
return string.Empty;
}
}
}
"@
Add-Type -TypeDefinition $src | Out-Null
[CommandLine]::Get($this)
</GetScriptBlock>
</ScriptProperty>
</Members>
</Type>
</Types>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment