title: running process command line
body: <p>I am trying to get the command line of running processes in Windows using the code below:
  But I only get the command line of <code>IDman.exe</code> like this:</p>
  
  <ul>
  <li><code>C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot</code></li>
  </ul>
  
  <p>But I know there are many other processes with command lines.</p>
  
  <p>Give any idea what's wrong with my code.</p>
  
  <pre><code>PVOID GetPebAddress(HANDLE ProcessHandle )
  {
      _NtQueryInformationProcess NtQueryInformationProcess =
               (_NtQueryInformationProcess)GetProcAddress(
               GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess");
      PROCESS_BASIC_INFORMATION pbi;
  
      NtQueryInformationProcess(ProcessHandle, 0, &amp;pbi, sizeof(pbi), NULL);
  
     return pbi.PebBaseAddress;
  }
  
  void get_process_cmd_line(DWORD pID)
       {
  
         HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION |
                                       PROCESS_VM_READ |
                                       PROCESS_TERMINATE,
                                       FALSE, pID);
         PPEB ppeb = (PPEB) GetPebAddress(hProcess);
         PPEB ppebCopy = (PPEB)malloc(sizeof(PEB));
         BOOL result = ReadProcessMemory(hProcess,
                                         ppeb,
                                         ppebCopy,
                                         sizeof(PEB),
                                         NULL);
         if(!result){std::cout&lt;&lt;"Er. adress";return;}
         PRTL_USER_PROCESS_PARAMETERS pRtlProcParam = ppebCopy-&gt;ProcessParameters;
         PRTL_USER_PROCESS_PARAMETERS pRtlProcParamCopy =
            (PRTL_USER_PROCESS_PARAMETERS)malloc(sizeof(RTL_USER_PROCESS_PARAMETERS));
         result = ReadProcessMemory(hProcess,
                                    pRtlProcParam,
                                    pRtlProcParamCopy,
                                    sizeof(RTL_USER_PROCESS_PARAMETERS),
                                    NULL);
         if(!result){std::cout&lt;&lt;"Er. ";return;}
         PWSTR wBuffer = pRtlProcParamCopy-&gt;CommandLine.Buffer;
         USHORT len = pRtlProcParamCopy-&gt;CommandLine.Length;
         PWSTR wBufferCopy = (PWSTR)malloc(len);
         result = ReadProcessMemory(hProcess,
                                    wBuffer,
                                    wBufferCopy, 
                                    len,NULL);
         if(!result){std::cout&lt;&lt;"Er. cmdLine";return;}
         std::wcout&lt;&lt;wBufferCopy;
         return;
  }
  </code></pre>