Get Process Name Method 2 GetMappedFilename
Bellow code demonstrate our to retrieve both current and target process full image path. This technique is very uncommon but works perfectly.
// Jean-Pierre LESUEUR (@DarkCoderSc)
function PhysicalToVirtualPath(APath : String) : String;
var i : integer;
ADrive : String;
ABuffer : array[0..MAX_PATH-1] of Char;
ACandidate : String;
begin
{$I-}
for I := 0 to 25 do begin
ADrive := Format('%s:', [Chr(Ord('A') + i)]);
///
if (QueryDosDevice(PWideChar(ADrive), ABuffer, MAX_PATH) = 0) then
continue;
ACandidate := String(ABuffer).ToLower();
if String(Copy(APath, 1, Length(ACandidate))).ToLower() = ACandidate then begin
Delete(APath, 1, Length(ACandidate));
result := Format('%s%s', [ADrive, APath]);
end;
end;
{$I+}
end;
And both examples require psapi.pas
. To avoid using psapi.pas
you could load GetMappedFilename()
API dynamically.
Current Process
// Jean-Pierre LESUEUR (@DarkCoderSc)
// ...
uses psAPI;
// ...
function GetCurrentProcessImagePath() : String;
var AFileName : Array[0..MAX_PATH -1] of Char;
begin
ZeroMemory(@AFileName, MAX_PATH);
///
GetMappedFileName(
GetCurrentProcess(),
Pointer(GetModuleHandle(nil)),
AFileName,
MAX_PATH
);
result := PhysicalToVirtualPath(UnicodeString(AFileName));
end;
Target Process
When it comes to use that technique for remote process you need to be a bit more tricky, this technique require code injection to retrieve target process hInstance
.
Then we can use normally GetMappedFileName()
and retrieve it full image path.
Notice, you can't use this technique from a 32bit to 64bit / 64bit to 32bit due to code injection (Some technique exists to bypass this restriction tho).
// Jean-Pierre LESUEUR (@DarkCoderSc)
// ...
uses psAPI;
// ...
function GetProcessImagePath(const AProcessId : Cardinal) : String;
var hProc : THandle;
pGetModuleHandle : Pointer;
AFlags : Cardinal;
AThreadId : Cardinal;
hThread : THandle;
hRemoteInstance : Cardinal;
AFileName : Array[0..MAX_PATH -1] of Char;
const PROCESS_QUERY_LIMITED_INFORMATION = $00001000;
begin
result := '';
///
{
Alternatively in the case of Kernel32.dll we could simply call GetModuleHandle('Kernel32.dll')
}
pGetModuleHandle := GetProcAddress(LoadLibrary('Kernel32.dll'), 'GetModuleHandleW');
///
if NOT Assigned(pGetModuleHandle) then
Exit();
AFlags := PROCESS_CREATE_THREAD or
PROCESS_QUERY_LIMITED_INFORMATION;
hProc := OpenProcess(AFlags, false, AProcessId);
if (hProc = 0) then
Exit();
try
hThread := CreateRemoteThread(
hProc,
nil,
0,
pGetModuleHandle,
Pointer(nil),
0,
AThreadId
);
if (hThread = 0) then
Exit();
try
WaitForSingleObject(hThread, INFINITE);
GetExitCodeThread(hThread, hRemoteInstance);
ZeroMemory(@AFileName, MAX_PATH);
///
GetMappedFileName(
hProc,
Pointer(hRemoteInstance),
AFileName,
MAX_PATH
);
result := PhysicalToVirtualPath(UnicodeString(AFileName));
finally
CloseHandle(hThread);
end;
finally
CloseHandle(hProc);
end;
end;
If you have another technique instead of using Code Injection to capture target process hInstance
I would love to know :)
Written the Nov. 23, 2020, 9:59 a.m. by Jean-Pierre LESUEUR
Updated: 1 month, 4 weeks ago.