Get Process Name via GetMappedFileName - Snippet

This code snippet demonstrates how to retrieve the full image path of a running process using the GetMappedFileName function in conjunction with the QueryDosDevice function to obtain a regular file path. These functions allow you to retrieve the full path of the executable file associated with a specific process. The GetMappedFileName function provides the path in a device namespace format, and the QueryDosDevice function can be used to convert it to a regular file path.

Code Section

                                // Jean-Pierre LESUEUR (@DarkCoderSc)

// ...
uses psAPI;
// ...

function PhysicalToVirtualPath(APath : String) : String;
var i          : integer;
    ADrive     : String;
    ABuffer    : array[0..MAX_PATH-1] of Char;
    ACandidate : String;
begin
  {$I-}
  for I := 0 to 25 do begin
    ADrive := Format('%s:', [Chr(Ord('A') + i)]);
    ///

    if (QueryDosDevice(PWideChar(ADrive), ABuffer, MAX_PATH) = 0) then
      continue;

    ACandidate := String(ABuffer).ToLower();

    if String(Copy(APath, 1, Length(ACandidate))).ToLower() = ACandidate then begin
      Delete(APath, 1, Length(ACandidate));

      result := Format('%s%s', [ADrive, APath]);
    end;
  end;
  {$I+}
end;

function GetCurrentProcessImagePath() : String;
var AFileName : Array[0..MAX_PATH -1] of Char;
begin
    ZeroMemory(@AFileName, MAX_PATH);
    ///

    GetMappedFileName(
                          GetCurrentProcess(),
                          Pointer(GetModuleHandle(nil)),
                          AFileName,
                          MAX_PATH
    );

    result := PhysicalToVirtualPath(UnicodeString(AFileName));
end;

July 5, 2023, 12:07 p.m. | By Jean-Pierre LESUEUR