Reply To: Hello. I have some question in Local host Monitor

Home › Forums › Discussions › Support › Hello. I have some question in Local host Monitor › Reply To: Hello. I have some question in Local host Monitor

January 24, 2005 at 1:33 pm #5687
Vadim Smirnov
Keymaster

    There is no proof and easy way to get full process path. This topic was discussed (in russian) in Windows Internals forum. Two ways were proposed (first is easier but second is more reliable):

    I)
    ZwQueryInformationProcess ( NtCurrentProcess(), ProcessBasicInformation, &ProcInfo, sizeof(ProcInfo), 0);

    ProcInfo.PebBaseAddress->ProcessParameters->ApplicationName

    II)
    1. Get EPROCESS using IoGetCurrentProcess().
    2. For NT 4.0 and 5.0 get SectionHandle using ObReferenceObjectByHandle() get SectionObject; for NT 5.1 just get SectionObject from EPROCESS.
    3. From SectionObject get SegmentObject.
    4. From SegmentObject get ControlArea.
    5. From ControlArea get FilePointer (FileObjec pointert).
    6. Using ObQueryNameString() get full path for the process.