Get parent process command line in 64 bit
C / C++ / MFC
1
Posts
1
Posters
0
Views
1
Watching
-
Can anybody provide me hint as how to get parent process command line in 64 bit. I used the NtQueryInformationProcess() in conjunction with date structures: typedef struct _PROCESS_BASIC_INFORMATION { PVOID Reserved1; PPEB PebBaseAddress; PVOID Reserved2[2]; ULONG_PTR UniqueProcessId; PVOID Reserved3; } PROCESS_BASIC_INFORMATION struct _PEB2 { DWORD dwFiller[4]; DWORD dwInfoBlockAddress; } PEB2; struct _INFOBLOCK { DWORD dwFiller[16]; WORD wLength; WORD wMaxLength; DWORD dwCmdLineAddress; } Block to retrieve parent process's command line info. Worked well in 32 bit application, but failed in 64 bit application. Any helps from you guys are greatly appreciated. Jack Rong