Запуск программы с системным именем

//I load and call
typedef DWORD (WINAPI *PNtQueryInformationProcess)( HANDLE,PROCESSINFOCLASS, PVOID, ULONG, PULONG);
PNtQueryInformationProcess NtQueryInformationProcess;
 
HMODULE NtDllMod;
HMODULE kernelDllMod;
NtDllMod=LoadLibrary("ntdll.dll");
if (NtDllMod==NULL)
{
//Do error
}
//get NtQueryInformationProcess address from NTDLL
*NtQueryInformationProcess=(PNtQueryInformationProcess)GetProcAddress(NtDllMod,"NtQueryInformationProcess");
//if we failed
if (NtQueryInformationProcess==0)
{
//Do Error
 
}
 
UCHAR* m_pBuffer;   //Buffer for ProcessInformation
HANDLE hProcess;    //HANDLE for the process
ULONG retBytes=0;   //return bytes from ProcessQueryInfo
 
//Here we are going to open the process and read the memory to get the 
//process creation parameters inside the Process Environment Block
//the parameter we are wanting is the Process Name
 
//allocate a buffer for reading PROCESS_BASIC_INFORMATION memory of process
m_pBuffer=(UCHAR*)VirtualAlloc((void*)0x100000,sizeof(PROCESS_BASIC_INFORMATION),MEM_COMMIT,PAGE_READWRITE);
 
//Open the process for Reading
hProcess=OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE,(unsigned long)appProcessID);
    
//if we failed
if (hProcess==NULL)
{
//Do error
}
            
//calll ntqueryprocess to get the ProcessInformation
if (NtQueryInformationProcess(hProcess,ProcessBasicInformation,m_pBuffer,sizeof(PROCESS_BASIC_INFORMATION),&retBytes)!=0)
{
//Do error 
}
    
//cast buffer
PROCESS_BASIC_INFORMATION* pSysProcess=(PROCESS_BASIC_INFORMATION*)m_pBuffer;
 
PEB pProcPEB;
//read the process's memory to get the Process Environment Block's address
RetP=ReadProcessMemory(hProcess,pSysProcess->PebBaseAddress,&pProcPEB,sizeof(PEB),&retBytes);
    
RTL_USER_PROCESS_PARAMETERS pProcParam;
//read the process memory's parameter block
RetP=ReadProcessMemory(hProcess,pProcPEB.ProcessParameters,&pProcParam,sizeof(RTL_USER_PROCESS_PARAMETERS),&retBytes);
RTL_USER_PROCESS_PARAMETERS* pProcParam2=(RTL_USER_PROCESS_PARAMETERS*)pProcPEB.ProcessParameters;
 
 
 
//SNIP!
 
FreeLibrary(NtDllMod);

// use WinDbg "dt ntdll!_PEB" command and search for ProcessParameters offset to find the truth out
    DWORD ProcessParametersOffset = si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64 ? 0x20 : 0x10;
    DWORD CommandLineOffset = si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64 ? 0x70 : 0x40;