Reply To: Hello. I have some question in Local host Monitor

Home Forums Discussions Support Portal Hello. I have some question in Local host Monitor Reply To: Hello. I have some question in Local host Monitor

#5687

Vadim Smirnov
Moderator

There is no proof and easy way to get full process path. This topic was discussed (in russian) in Windows Internals forum. Two ways were proposed (first is easier but second is more reliable):

I)
ZwQueryInformationProcess ( NtCurrentProcess(), ProcessBasicInformation, &ProcInfo, sizeof(ProcInfo), 0);

ProcInfo.PebBaseAddress->ProcessParameters->ApplicationName

II)
1. Get EPROCESS using IoGetCurrentProcess().
2. For NT 4.0 and 5.0 get SectionHandle using ObReferenceObjectByHandle() get SectionObject; for NT 5.1 just get SectionObject from EPROCESS.
3. From SectionObject get SegmentObject.
4. From SegmentObject get ControlArea.
5. From ControlArea get FilePointer (FileObjec pointert).
6. Using ObQueryNameString() get full path for the process.