This one possible technique (through QueryFullProcessImageNameW
) to get process image path from it id.
This example support Windows Vista to latest Windows version (Actually Windows 10)
I will cover other example progressively and compatible with Windows XP and below.
// Jean-Pierre LESUEUR (@DarkCoderSc)
//...
uses Windows, SysUtils;
//...
function GetProcessName(AProcessID : Cardinal) : String;
var hProc : THandle;
ALength : DWORD;
hDLL : THandle;
QueryFullProcessImageNameW : function(
AProcess: THANDLE;
AFlags: DWORD;
AFileName: PWideChar;
var ASize: DWORD): BOOL; stdcall;
const PROCESS_QUERY_LIMITED_INFORMATION = $00001000;
begin
result := '';
///
if (TOSVersion.Major < 6) then
Exit();
///
QueryFullProcessImageNameW := nil;
hDLL := LoadLibrary('kernel32.dll');
if hDLL = 0 then
Exit();
try
@QueryFullProcessImageNameW := GetProcAddress(hDLL, 'QueryFullProcessImageNameW');
///
if Assigned(QueryFullProcessImageNameW) then begin
hProc := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, AProcessID);
if hProc = 0 then exit;
try
ALength := (MAX_PATH * 2);
SetLength(result, ALength);
if NOT QueryFullProcessImageNameW(hProc, 0, @result[1], ALength) then
Exit();
SetLength(result, ALength); // Get rid of extra junk
finally
CloseHandle(hProc);
end;
end;
finally
FreeLibrary(hDLL);
end;
end;
Read more...
Bellow code demonstrate our to retrieve both current and target process full image path. This technique is very uncommon but works perfectly.
// Jean-Pierre LESUEUR (@DarkCoderSc)
function PhysicalToVirtualPath(APath : String) : String;
var i : integer;
ADrive : String;
ABuffer : array[0..MAX_PATH-1] of Char;
ACandidate : String;
begin
{$I-}
for I := 0 to 25 do begin
ADrive := Format('%s:', [Chr(Ord('A') + i)]);
///
if (QueryDosDevice(PWideChar(ADrive), ABuffer, MAX_PATH) = 0) then
continue;
ACandidate := String(ABuffer).ToLower();
if String(Copy(APath, 1, Length(ACandidate))).ToLower() = ACandidate then begin
Delete(APath, 1, Length(ACandidate));
result := Format('%s%s', [ADrive, APath]);
end;
end;
{$I+}
end;
Read more...
Yet another technique to get the full image path of a target process using the NtQueryInformationProcess
API documented Here
This technique from 32bit to 64bit / 64bit to 32bit.
// Jean-Pierre LESUEUR (@DarkCoderSc)
function PhysicalToVirtualPath(APath : String) : String;
var i : integer;
ADrive : String;
ABuffer : array[0..MAX_PATH-1] of Char;
ACandidate : String;
begin
{$I-}
for I := 0 to 25 do begin
ADrive := Format('%s:', [Chr(Ord('A') + i)]);
///
if (QueryDosDevice(PWideChar(ADrive), ABuffer, MAX_PATH) = 0) then
continue;
ACandidate := String(ABuffer).ToLower();
if String(Copy(APath, 1, Length(ACandidate))).ToLower() = ACandidate then begin
Delete(APath, 1, Length(ACandidate));
result := Format('%s%s', [ADrive, APath]);
end;
end;
{$I+}
end;
function GetProcessImagePath(const AProcessId : Cardinal) : String;
type PUnicodeString = ^TUnicodeString;
TUnicodeString = record
Length : USHORT;
MaximumLength : USHORT;
Buffer : PWideChar;
end;
// https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess
var _NtQueryInformationProcess : function(
ProcessHandle : THandle;
ProcessInformationClass : DWORD;
ProcessInformation : Pointer;
ProcessInformationLength : ULONG;
ReturnLength : PULONG
) : LongInt; stdcall;
hNTDLL : THandle;
hProc : THandle;
ALength : ULONG;
pImagePath : PUnicodeString;
const PROCESS_QUERY_LIMITED_INFORMATION = $00001000;
ProcessImageFileName = 27;
begin
hProc := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, AProcessId);
if (hProc = 0) then
Exit();
try
hNTDLL := LoadLibrary('NTDLL.DLL');
if (hNTDLL = 0) then
Exit();
try
@_NtQueryInformationProcess := GetProcAddress(hNTDLL, 'NtQueryInformationProcess');
if NOT Assigned(_NtQueryInformationProcess) then
Exit();
///
ALength := (MAX_PATH + SizeOf(TUnicodeString)); // Should be enough :)
GetMem(pImagePath, ALength);
try
if (_NtQueryInformationProcess(hProc, ProcessImageFileName, pImagePath, ALength, @ALength) <> 0) then
Exit();
///
result := PhysicalToVirtualPath(String(pImagePath^.Buffer));
finally
FreeMem(pImagePath, ALength);
end;
finally
FreeLibrary(hNTDLL);
end;
finally
CloseHandle(hProc);
end;
end;
Read more...
This time we will use a quite well known API to get the full process image path GetProcessImageFileName
documented here.
Nothing very complex and this technique works from 32bit to 64bit / 64bit to 32bit processes.
// Jean-Pierre LESUEUR (@DarkCoderSc)
function PhysicalToVirtualPath(APath : String) : String;
var i : integer;
ADrive : String;
ABuffer : array[0..MAX_PATH-1] of Char;
ACandidate : String;
begin
{$I-}
for I := 0 to 25 do begin
ADrive := Format('%s:', [Chr(Ord('A') + i)]);
///
if (QueryDosDevice(PWideChar(ADrive), ABuffer, MAX_PATH) = 0) then
continue;
ACandidate := String(ABuffer).ToLower();
if String(Copy(APath, 1, Length(ACandidate))).ToLower() = ACandidate then begin
Delete(APath, 1, Length(ACandidate));
result := Format('%s%s', [ADrive, APath]);
end;
end;
{$I+}
end;
function GetProcessImagePath(const AProcessId : Cardinal) : String;
// https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-getprocessimagefilenamew
var _GetProcessImageFileNameW : function(
hProcess : THandle;
lpImageFileName : LPWSTR;
nSize : DWORD
) : DWORD; stdcall;
hPsAPI : THandle;
hProc : THandle;
ALength : Cardinal;
AImagePath : String;
const PROCESS_QUERY_LIMITED_INFORMATION = $00001000;
begin
result := '';
///
hProc := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, AProcessId);
if (hProc = 0) then
Exit();
try
hPsAPI := LoadLibrary('psapi.dll');
if (hPsAPI = 0) then
Exit();
try
@_GetProcessImageFileNameW := GetProcAddress(hPsAPI, 'GetProcessImageFileNameW');
if NOT Assigned(_GetProcessImageFileNameW) then
Exit();
///
SetLength(AImagePath, MAX_PATH);
ALength := _GetProcessImageFileNameW(hProc, @AImagePath[1], MAX_PATH);
if (ALength > 0) then begin
SetLength(AImagePath, ALength);
///
result := PhysicalToVirtualPath(AImagePath);
end;
finally
FreeLibrary(hPsAPI);
end;
finally
CloseHandle(hProc);
end;
end;
I have few other methods in mind, I will post them in a near future so stay tuned :)
Read more...