可以使用 WMI 获取指定进程的输入命令行。

代码示例:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
bool SelectQuerySQL(LPCWSTR SQL, LPCWSTR Key, OUT char* outBuf, IN size_t bufSize)
{
HRESULT hRes;

CoUninitialize();
hRes = CoInitializeEx(0, COINIT_MULTITHREADED);
if (FAILED(hRes))
{
return false;
}
hRes = CoInitializeSecurity(0, -1, 0, 0, RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, 0, EOAC_NONE, 0);
if (FAILED(hRes))
{
CoUninitialize();
return false;
}
IWbemLocator* pLoc = NULL;
hRes = CoCreateInstance(CLSID_WbemLocator, 0, CLSCTX_INPROC_SERVER, IID_IWbemLocator, reinterpret_cast<LPVOID*>(&pLoc));
if (FAILED(hRes))
{
CoUninitialize();
return false;
}
IWbemServices* pSvc = NULL;
hRes = pLoc->ConnectServer(_bstr_t(L"ROOT\\CIMV2"), 0, 0, 0, 0, 0, 0, &pSvc);
if (FAILED(hRes))
{
pLoc->Release();
CoUninitialize();
return false;
}
hRes = CoSetProxyBlanket(pSvc, RPC_C_AUTHN_WINNT, RPC_C_AUTHZ_NONE, NULL, RPC_C_AUTHN_LEVEL_CALL, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_NONE);
if (FAILED(hRes))
{
pSvc->Release();
pLoc->Release();
CoUninitialize();
return false;
}

IEnumWbemClassObject* pEnumerator = NULL;
// 执行WSQL语句
hRes = pSvc->ExecQuery(bstr_t("WQL"), bstr_t(SQL), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator);
if (FAILED(hRes))
{
pSvc->Release();
pLoc->Release();
CoUninitialize();
return false;
}

IWbemClassObject* pclsObj;
ULONG uReturn = 0;
while (pEnumerator)
{
HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn);
if (0 == uReturn)
{
break;
}
VARIANT vtProp;
hr = pclsObj->Get(Key, 0, &vtProp, 0, 0);
wcstombs_s(NULL, outBuf, bufSize, vtProp.bstrVal, bufSize);
VariantClear(&vtProp);
pclsObj->Release();
}
pSvc->Release();
pLoc->Release();
pEnumerator->Release();
CoUninitialize();
return true;
}

使用方法:

1
2
3
std::string commandLine;
commandLine.resize(1024);
SelectQuerySQL(std::format(L"SELECT CommandLine FROM Win32_Process WHERE ProcessId = {}", pid).c_str(), L"CommandLine", commandLine.data(), commandLine.size());