NTSYSAPI
NTSTATUS
NTAPI
ZwQueryObject(
   IN HANDLE ObjectHandle,
   IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
   OUT PVOID ObjectInformation,
   IN ULONG ObjectInformationLength,
   OUT PULONG ReturnLength OPTIONAL
);

typedef enum _OBJECT_INFORMATION_CLASS {
   ObjectBasicInformation,//0 Y N
   ObjectNameInformation,//1 Y N
   ObjectTypeInformation,//2 Y N
   ObjectAllTypesInformation,//3 Y N
   ObjectHandleInformation //4 Y Y
} OBJECT_INFORMATION_CLASS;

typedef struct _OBJECT_NAME_INFORMATION {//Information Class 1
   UNICODE_STRING Name;
} OBJECT_NAME_INFORMATION,*POBJECT_NAME_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
ZwOpenProcess(
   OUT PHANDLE ProcessHandle,
   IN ACCESS_MASK DesiredAccess,
   IN POBJECT_ATTRIBUTES ObjectAttributes,
   IN PCLIENT_ID ClientId OPTIONAL
);

PROCESS_BASIC_INFORMATION pbi;
ULONG ulReturnLength;
NTSTATUS lNtStatus = NtQueryInformationProcess(hProcess,ProcessBasicInformation,&pbi,sizeof(pbi),&ulReturnLength);
if(lNtStatus == STATUS_SUCCESS && ulReturnLength == sizeof(pbi)) {
char buf[128];
PROCESS_ENVIRONMENT_BLOCK peb;
BOOL bResult = ReadProcessMemory(hProcess,pbi.PebBaseAddress,&peb,sizeof(peb),&ulReturnLength);
PROCESS_PARAMETRS pp;
bResult = ReadProcessMemory(hProcess,peb.pi,&pp,sizeof(pp),ulReturnLength);
	WCHAR sz_buf[_MAX_PATH];
bResult = ReadProcessMemory(hProcess,pp.CurrentDirectory.Buffer,sz_buf,sizeof(sz_buf),&ulReturnLength);
			bResult = ReadProcessMemory(hProcess,pp.ApplicationName.Buffer,sz_buf,sizeof(sz_buf),&ulReturnLength);
			bResult = ReadProcessMemory(hProcess,pp.CommandLine.Buffer,sz_buf,sizeof(sz_buf),&ulReturnLength);
			if (bResult == 0) {
				ERR
				goto exit;
			}

if (Create == TRUE)
 PsLookupProcessByProcessId(ProcessId, curproc);