過去の回答はもっとスマートな方法かもしれませんが、、
#module
#uselib "kernel32"
#func OpenProcess "OpenProcess" int, int, int
#func CloseHandle "CloseHandle" int
#func ReadProcessMemory "ReadProcessMemory" int, int, sptr, int, int
#uselib "ntdll"
#func NtQueryInformationProcess "NtQueryInformationProcess" int, int, sptr, int, sptr
#uselib "psapi"
#func EnumProcesses "EnumProcesses" sptr, int, sptr
#func EnumProcessModules "EnumProcessModules" int, sptr, int, sptr
#func GetModuleFileNameEx "GetModuleFileNameExA" int, int, sptr, int
#define PROCESS_QUERY_INFORMATION 0x400
#define PROCESS_VM_READ 0x10
#defcfunc Get_CommandLine str prm
dim lpidProcess, 0x400
dim cb
dim cbNeeded
dim lphModule
dim hProcess
sdim lpFilename, 0x100
dim ProcParamsAddress
dim BlockAddress, 2
dim _PROCESS_BASIC_INFORMATION, 6
dim ReturnLength
sdim CommandLineBuf
EnumProcesses varptr(lpidProcess), 0x1000, varptr(cbNeeded)
cb = cbNeeded
dim lpidProcess, cb / 4
EnumProcesses varptr(lpidProcess), cb, varptr(cbNeeded)
repeat cb / 4
OpenProcess PROCESS_QUERY_INFORMATION|PROCESS_VM_READ, 0, lpidProcess(cnt)
hProcess = stat
if hProcess {
EnumProcessModules hProcess, varptr(lphModule), 4, varptr(cbNeeded)
if stat {
GetModuleFileNameEx hProcess, lphModule, varptr(lpFilename), 0x100
if getpath (lpFilename, 8) == prm {
//PebBaseAddressの取得
NtQueryInformationProcess hProcess, 0, varptr(_PROCESS_BASIC_INFORMATION), 0x18, varptr(ReturnLength)
if stat = 0 {
//ベースアドレスの取得
ReadProcessMemory hProcess, _PROCESS_BASIC_INFORMATION(1) + 0x10, varptr(ProcParamsAddress), 4, 0
//CommandLineデータ開始アドレスの取得
ReadProcessMemory hProcess, ProcParamsAddress + 0x44, varptr(BlockAddress(0)), 4, 0
//同上終端取得
ReadProcessMemory hProcess, ProcParamsAddress + 0x74, varptr(BlockAddress(1)), 4, 0
sdim CommandLineBlock, BlockAddress(1) - BlockAddress(0)
ReadProcessMemory hProcess, BlockAddress(0), varptr(CommandLineBlock), BlockAddress(1) - BlockAddress(0), 0
CommandLineBuf = cnvwtos (CommandLineBlock)
CloseHandle hProcess
break
}
}
}
}
CloseHandle hProcess
loop
return CommandLineBuf
#global
exec "notepad /W"
mes Get_CommandLine ("notepad.exe")
mes Get_CommandLine ("hsp3.exe")
参考記事
http://www5.plala.or.jp/softworld/api_ReadProcessMemory.htm
http://webcache.googleusercontent.com/search?q=cache:jde8Gl7FOmYJ:wj32.org/wp/2009/01/24/howto-get-the-command-line-of-processes/
http://forum.sysinternals.com/cross-process-environment-vars_topic629.html
http://msdn.microsoft.com/ja-jp/library/windows/desktop/ms684280%28v=vs.85%29.aspx