I'm enumerating all processes. As you can see return code is ok, UniqueProcessId shows requested process id and PebBaseAddress not null, but system throws AV on reading it.

我在列举所有进程。正如您所看到的，返回代码是OK的，UniqueProcessID显示请求的进程id和PebBaseAddress不为空，但是系统在读取它时抛出AV。

This code works most of the time, but fail for some particular processes (they seem unrelated: iexplore.exe, vcpkgsrv.exe, rdpclip.exe, etc). Win10 22H2

此代码在大多数情况下都可以工作，但在某些特定进程中会失败(它们似乎无关：iexre.exe、vcpkgsrv.exe、rdpclip.exe等)。Win10 22H2

Here is code as text

以下是文本形式的代码

// using PROCESS_ALL_ACCESS nor MAXIMUM_ALLOWED doesn't help
AutoHandleNull hProcess{ ::OpenProcess(ProcessQueryRight/*PROCESS_QUERY_LIMITED_INFORMATION*/, FALSE, procEntry.th32ProcessID) };
if (hProcess)
{
    ::PROCESS_BASIC_INFORMATION pbi{};
    ULONG returnLength;
    const NTSTATUS st = pNtQueryInformationProcess(hProcess.get(), ProcessBasicInformation, &pbi, sizeof(pbi), &returnLength);
    if (NT_SUCCESS(st) && pbi.PebBaseAddress && pbi.PebBaseAddress->SessionId == sessionID)
    {
        return procEntry.th32ProcessID;
    }
}

PebBaseAddress is in address space of target process, so you need to use ReadProcessMemory. Beware that PEB contains pointers, so you need check target process mode and use PEB_X86/PEB_X64 accordingly. And if you are in WoW64 process there is some hoop jumps: Get command line string of 64-bit process from 32-bit process

PebBaseAddress在目标进程的地址空间中，因此需要使用ReadProcessMemory。注意，PEB包含指针，因此需要检查目标进程模式，并相应地使用PEB_X86/PEB_X64。如果你在WOW64进程中，会有一些跳跃：从32位进程中获取64位进程的命令行字符串