String result = "?";
PROCESS_BASIC_INFORMATION pbi = null;
pbi = new PROCESS_BASIC_INFORMATION();
IntByReference returnLength = new IntByReference();
HANDLE hProcess = _processInformation.hProcess;
int pbiSize = pbi.size(); // x64 = 48 bytes, x32 = 24
int ret = Ntdll.INSTANCE.ZwQueryInformationProcess(hProcess, (byte) 0, pbi.getPointer(), pbiSize, returnLength);
if (ret == 0)
{
pbi.read();
if (pbi.PebBaseAddress != null)
{
PEB peb = new PEB();
// System.out.println(""+1);
if (readVirtualMemoryToStructure(pbi.PebBaseAddress, peb))
if (peb.ProcessParameters != null)
{
RTL_USER_PROCESS_PARAMETERS userParams = new RTL_USER_PROCESS_PARAMETERS();
int userParamsSize = userParams.size(); //x32 = 784, x64 = 1264
// System.out.println(""+2);
if (readVirtualMemoryToStructure(peb.ProcessParameters, userParams))
{
// System.out.println("MaximumLength "+userParams.CommandLine.MaximumLength);
if (userParams.CommandLine.MaximumLength > 0)
{
Memory stringBuffer = new Memory(userParams.CommandLine.MaximumLength);
// System.out.println(""+3);
if (readVirtualMemoryToMemory(userParams.CommandLine.Buffer, stringBuffer))
result = stringBuffer.getString(0, true);
}
if (userParams.CurrentDirectoryPath.MaximumLength > 0)
{
Memory stringBuffer = new Memory(userParams.CurrentDirectoryPath.MaximumLength);
if (readVirtualMemoryToMemory(userParams.CurrentDirectoryPath.Buffer, stringBuffer))
_workingDir = stringBuffer.getString(0, true);
}
if (userParams.WindowTitle.MaximumLength > 0)
{
Memory stringBuffer = new Memory(userParams.WindowTitle.MaximumLength);
if (readVirtualMemoryToMemory(userParams.WindowTitle.Buffer, stringBuffer))
_title = stringBuffer.getString(0, true);
}
if (userParams.Environment != null)
{
// get size of environment strings
MEMORY_BASIC_INFORMATION memInfo = new MEMORY_BASIC_INFORMATION();
int memInfoSize = memInfo.size(); //x64 = 48, x32 = 28
int bytesRead = MyKernel32.INSTANCE.VirtualQueryEx(hProcess.getPointer(), userParams.Environment, memInfo.getPointer(),
memInfoSize);
memInfo.read();
if (bytesRead == 0)
{
_logger.warning("error getting environment in VirtualQueryEx " + Native.getLastError());