determine comandline call of task

BrummelchenOctober 17, 2011 at 7:26 PM#

determine comandline call of task

with process explorer (sysinternals) i can see it, but how to with nsis?

eg task/name "explorer.exe" commandline: "explorer.exe /e c:\" started from: blah

WMIC from windows can list all processes but cannot handle wildcards.

cheers.

LoRd_MuldeROctober 17, 2011 at 10:31 PM#

Why does your NSIS installer need to obtain the command-line of another process?

BrummelchenOctober 18, 2011 at 6:27 PM#

i dont write installers, i code some other stuff for me.

with WMIC i need to use an array and filtering - not smart.

AndersOctober 18, 2011 at 7:41 PM#

Why is there no supported way to get the command line of another process?

BrummelchenOctober 18, 2011 at 8:03 PM#

ofc - or not ► http://www.autoitscript.com/forum/to...nning-process/

LoRd_MuldeROctober 18, 2011 at 8:45 PM#

For 32-bit processes running on x86 systems, the PEB is "generally" located at 0x7ffd6000. At an offset of 0x10 bytes from the start of the PEB, you will find the pointer to the RTL_USER_PROCESS_PARAMETERS structure. The pointer to the unicode string containing the command line is located at an offset of 0x040 from the start of the RTL_USER_PROCESS_PARAMETERS structure.

Having to dig in another process's memory to dump a data structure whose exact location is not officially documented and may be subject to change in future operating system versions sounds a bit "dubious" to me. The WMI method feels more credible to me...