How to pass (multiple) arguments to CreateProcess winapi

I want to create a child process with CreateProcess() and pass some arguments to it, but I dont want to pass a string as argument, I want to pass a pointer to a memory, a value or more.
Here is my example,
Caller:

struct Arguments {
    void* ptr;
    int value;
} Arg;

Arg = { some_pointer, 1337 };

// I know that "(LPWSTR)&Arg" doesnt work, but thats effectively what I want.
CreateProcessW(L"...\\Injet x86.exe",
        (LPWSTR)&Arg, 0, 0, 0, 0, 0, 0, &si, &pi)

And than I try to get the result in the child process:

Child:

struct Arguments {
    void* ptr;
    int value;
};

// Yes, Im trying to not use default libs
void WINAPI WinMainCRTStartup()
{
    Sleep(10000);    // For debug
    Arguments* ptrArgs = (Arguments*)GetCommandLineW();
  
    // Do stuf
}

I know that this doesnt work, but what I want is to pass arguments to the child process, not a string, but variables/an adress so it can modify. All the examples I found used a string as argument, but I dont want to do that, how can I accomplish it?

The documented approach is to pass your desired data as a single string argument. That is what you are expected to do.

For example:

struct Arguments {
    void* ptr;
    int value;
} Arg;

Arg = { some_pointer, 1337 };

WCHAR szCmdLine[32];
swprintf(szCmdLine, L"%p %d", Arg.ptr, Arg.value);

CreateProcessW(L"<path to>\\Injet x86.exe", szCmdLine, ...);

struct Arguments {
    void* ptr;
    int value;
};

void WINAPI WinMainCRTStartup()
{
    Sleep(10000);    // For debug

    Arguments Arg;
    swscanf(GetCommandLineW(), L"%p %d", &Arg.ptr, &Arg.value);
  
    // Do stuff
}

However, there is also an undocumented approach (ie, use at your own risk!) to have CreateProcess() pass arbitrary bytes to the new process. This approach is described in this article ¹:

Undocumented CreateProcess

> Pass arbitrary data to a child process!
>
> The last undocumented trick is quite different to the previous ones so I thought I’d save it until last. The STARTUPINFO structure contains two members, lpReserved2 and cbReserved2 :
>
>
> WORD cbReserved2;
> LPBYTE lpReserved2;
>
>
> These two members provide a mechanism for passing arbitrary amounts of data from one process to another, without having to call VirtualAllocEx / WriteProcessMemory. The cbReserved2 member is a 16bit integer and specifies the size of the buffer pointed to by lpReserved2. This means that lpReserved2 can be as big as 65535 bytes.
>
> ...
>
> Should you wish to use lpReserved2 in your own programs (using CreateProcess instead of spawn / exec) you will need to be careful because the lpReserved2 buffer must be properly constructed. Failure to do so will result in the child processes crashing, or at the very least becoming unstable - the reason being that the child process is expecting to find lpReserved2 in a particular format.

For example:

struct Arguments {
    void* ptr;
    int value;
} Arg;

Arg = { some_pointer, 1337 };

BYTE buf[sizeof(DWORD) + sizeof(Arg)];
*(DWORD*)buf = 0;
memcpy(buf + sizeof(DWORD), &Arg, sizeof(Arg));

STARTUPINFO si = { sizeof(si) };
si.lpReserved2 = buf;
si.cbReserved2 = sizeof(buf);

CreateProcessW(L"<path to>\\Injet x86.exe", ... &si, ...);

struct Arguments {
    void* ptr;
    int value;
};

void WINAPI WinMainCRTStartup()
{
    Sleep(10000);    // For debug

    STARTUPINFO si = { sizeof(si) };
    GetStartupInfo(&si);

    Arguments* ptrArgs = (Arguments*) (si.lpReserved2 + sizeof(DWORD));

    // Do stuff
}

¹ Note, there is a caveat under Vista WOW64, which affects the format of the buffer passed via lpReserved2, as described in this discussion: GetStartupInfo problem under WOW64 on 64 bit Vista

A safer approach would be to have the parent process create a named pipe, or a listening socket, or a block of shared memory in a named file mapping, and then use the command-line string to pass that resource's identifier to the child process, which can then connect and read data from that resource as needed.

That being said, whatever approach you decide to take, know that any memory pointer you pass to the child process will not be valid in the context of the child process, only in the context of the parent process. The only valid use for such a pointer in the child process would be in a call to ReadProcessMemory() to read data from the parent process' memory, eg:

struct Arguments {
    void* ptr;
    int value;
};

void WINAPI WinMainCRTStartup()
{
    Sleep(10000);    // For debug

    Arguments Arg;
    // populate from parent as needed...

    DWORD dwProcessId = ...; // obtain from parent as needed
    HANDLE hParent = OpenProcess(PROCESS_VM_READ, FALSE, dwProcessId);
    if (hParent)
    {
        ReadProcessMemory(hParent, Arg.ptr, ...);
        CloseHandle(hParent);

        // Do stuff
    }
}

According to the Doc: CreateProcessW function （processthreadsapi.h）

> [in, out, optional] lpCommandLine
>
> The command line to be executed.
>
> The maximum length of this string is 32,767 characters, including the
> Unicode terminating null character.

This parameter only accepts a string, you couldn't pass a pointer to a memory, a value or more.