Skip to content

Instantly share code, notes, and snippets.

Created June 2, 2018 16:43
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?
<?xml version="1.0" encoding="utf-8" ?>
$src = @"
using Microsoft.Win32.SafeHandles;
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;
public class CommandLine
const int ProcessCommandLineInformation = 60;
class CommandLineString
public ushort Length;
public ushort MaximumLength;
public IntPtr Buffer;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 32*1024)]
public byte[] Data;
public CommandLineString()
Data = new byte[32 * 1024];
MaximumLength = (ushort) Data.Length;
public override string ToString()
return Encoding.Unicode.GetString(Data, 0, Length);
static extern int NtQueryInformationProcess(
SafeProcessHandle ProcessHandle,
int ProcessInformationClass,
[In, Out] CommandLineString ProcessInformation,
int ProcessInformationLength,
out int ReturnLength
const int QueryLimitedInformation = 0x1000;
[DllImport("kernel32.dll", SetLastError = true)]
static extern SafeProcessHandle OpenProcess(
int dwDesiredAccess,
bool bInheritHandle,
int dwProcessId
public static string Get(Process process)
using (var handle = OpenProcess(QueryLimitedInformation, false, process.Id))
if (handle.IsInvalid)
return string.Empty;
int return_length;
CommandLineString str = new CommandLineString();
int status = NtQueryInformationProcess(handle, ProcessCommandLineInformation, str, Marshal.SizeOf(str), out return_length);
if (status == 0)
return str.ToString();
return string.Empty;
Add-Type -TypeDefinition $src | Out-Null
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment