I’ve been working on this for a few days and have finally got it doing what it is supposed to do, so thought I would post it here in case it helps someone else out. Basically this VB.NET code will get the command line for an external process, even if your application did not start that process (which is the limitation you have if you try using Process.StartInfo). This gets the full command line that was used to start the process so it includes the path to the executable and any command line arguments / parameters specified.
Archives For readprocessmemory
I recently needed to get the command line arguments that an external process was started with (one that was not started by my application, svchost.exe to be specific) and found that the only way I could get this information was with Windows APIs. The API in question just returned pointers that references locations in the memory of the external process (which meant I could not use the .NET Marshal methods as they would treat the pointers as references to my own process’s memory – thanks to wj32 for helping me understand that) so I had to use the Windows API ReadProcessMemory. I will be posting my full example of how to get the command line parameters for an external process soon but for now I thought I would just post this .NET class I wrote that makes reading process memory a bit easier as it does all of the API work for you.