typedef struct
{
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

typedef struct
{
    ULONG          AllocationSize;
    ULONG          ActualSize;
    ULONG          Flags;
    ULONG          Unknown1;
    UNICODE_STRING Unknown2;
    HANDLE         InputHandle;
    HANDLE         OutputHandle;
    HANDLE         ErrorHandle;
    UNICODE_STRING CurrentDirectory;
    HANDLE         CurrentDirectoryHandle;
    UNICODE_STRING SearchPaths;
    UNICODE_STRING ApplicationName;
    UNICODE_STRING CommandLine;
    PVOID          EnvironmentBlock;
    ULONG          Unknown[9];
    UNICODE_STRING Unknown3;
    UNICODE_STRING Unknown4;
    UNICODE_STRING Unknown5;
    UNICODE_STRING Unknown6;
} PROCESS_PARAMETERS;

typedef struct
{
    DWORD ExitStatus;
    PEB*  PebBaseAddress;
    DWORD AffinityMask;
    DWORD BasePriority;
    ULONG UniqueProcessId;
    ULONG InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION;

static PBYTE NtQueryProcessParameters( HANDLE _hProc, PROCESS_PARAMETERS* pProcParam )
{
    ASSERT( IsNtSys() );
        // Retrieve information
    PROCESS_BASIC_INFORMATION pbi = {0};
    LONG status = NtQueryInformationProcess( _hProc, ProcBasicInfo,    &pbi, sizeof(pbi), 0 );
//    if(!status) return FALSE;

    if(!pbi.PebBaseAddress) return FALSE;

    PEB Peb={0};
    DWORD dwDummy = 0;
    BOOL bRet = ::ReadProcessMemory( _hProc, pbi.PebBaseAddress, &Peb, 
        sizeof(Peb), &dwDummy);
    if( !bRet ) return 0;
    
    bRet = ::ReadProcessMemory( _hProc,    Peb.ProcessParameters, pProcParam,
        sizeof(PROCESS_PARAMETERS), &dwDummy );
    
    if( !bRet )
    {// just started
        return 0;
    }
    
    return (PBYTE)Peb.ProcessParameters;
}

        PROCESS_PARAMETERS ProcParam = {0};
        PBYTE pParam=0;
        if( (pParam=NtQueryProcessParameters( _hProc, &ProcParam ))==0 )
        {
            return FALSE;//just started, try later
        }

        UNICODE_STRING* pUnicode = &ProcParam.CommandLine; 

        DWORD dwSize = pUnicode->Length;
        WCHAR wInBuf[MAX_PATH*8]=L"";

        if(dwSize>0)
        {
            DWORD dwDummy=0;
            PBYTE pSrcBuf = (PBYTE)pUnicode->Buffer;
            
            if( pSrcBuf<pParam )
            { /*в случае указания CREATE_SUSPENDED, в .Buffer лежит _смещение_ относительно начала ProcessParameters, 
                а не адрес строки. проверяем, что адрес строки не меньше адреса параметров и правим его если нужно.*/
                pSrcBuf = pParam+(int)pSrcBuf;
                ASSERT( IsInRange( (int)pSrcBuf, 0, 0x40000 ) );
            }
            
            if(!::ReadProcessMemory( _hProc, pSrcBuf, wInBuf, dwSize, &dwDummy ))
            {// we started new process, can't complete call
                ASSERT(0);
                return FALSE;
            }
            USES_CONVERSION;
            lstrcpyn( _pszBuf, W2T(wInBuf), 1020 );// обрезаем
        }