windows proccess.Cmdline() fails on Protected processes ex: (anti cheat protected) due to memory read but NtQueryInformationProcess works.

[Ahm3dRN]

Describe the bug
I was working on a League of Legends LCU client which reads the credentials from the Game Client
but once in game with the game client closed if you try to get the cmdline from the game it will result an error
because the PEB memory read is blocked by Vanguard. meanwhile Process hacker/system informer had the command line data with no issues and it wasn't even in admin mode or anything. checked their github
and found out about NtQueryInformationProcess + ProcessCommandLineInformation. this is however a windows 8.1+ undocumented class.

Riot Vanguard is a kernel-level anti-cheat developed by Riot Games.

To Reproduce

	procs, err := process.Processes()
	if err != nil {
		return nil, err
	}
	for _, p := range procs {
		name, _ := p.Name()
		if name != "LeagueClient.exe" {
			continue
		}
		cmdline, err := p.Cmdline() // Fails to read memory because LeagueClient.exe is protected
		if err != nil {
			log.Printf("Err reading League Process: %s", err)
			continue
		}
		return parseClientCmdline(cmdline, p.Pid)
	}
	return nil, errors.New("league client is not running")

result:

2026/07/30 01:22:51 Err reading League Process: could not get CommandLine: cannot read process PEB

Expected behavior
On windows 8.1+ we can use the NtQueryInformationProcess ProcessCommandLineInformation
with only PROCESS_QUERY_LIMITED_INFORMATION
to obtain the command line without having to touch the memory.
it's also implemented in Python Psutil and System informer

Environment (please complete the following information):

• Windows: Windows [Version 10.0.19045.7548] (this should work on 8.1+ tho

Additional context
I've already implemented and tested a fix for this and I'm willing to open a PR.
I'm really not so good with opening issues/PRs so please if anything is missing or needs addtional details/fixes/tests please let me know and I'll be more than happy to do so.

there is also a possible optimization to my code since my current implementation does 2 system calls (to obtain the size first) which may be possible to accomplish in one call in the same manner the systeminformer phlib does.

Drafted A PR #2127