Get Process Name via NtQueryInformationProcess

This code snippet demonstrates how to retrieve the full image path of a running process using the NtQueryInformationProcess function in conjunction with the QueryDosDevice function to obtain a regular file path. These functions allow you to retrieve the full path of the executable file associated with a specific process. The NtQueryInformationProcess function provides the path in a device namespace format, and the QueryDosDevice function can be used to convert it to a regular file path.

Process System Information

Code Section

July 5, 2023, 12:16 p.m. | By Jean-Pierre LESUEUR