获取进程路径

最新推荐文章于 2022-11-02 22:16:02 发布

vizee

最新推荐文章于 2022-11-02 22:16:02 发布

阅读量862

点赞数

分类专栏： Windows PureCode

本文链接：https://blog.csdn.net/Vizee/article/details/8579736

版权

该代码段展示了如何使用NtQueryInformationProcess和NtReadVirtualMemory等内核API从进程句柄获取Windows进程的完整路径。这种方法适用于具有PROCESS_QUERY_INFORMATION和PROCESS_VM_READ权限的进程。

摘要由CSDN通过智能技术生成

//获取进程路径,理论上至少支持XP;进程句柄需要PROCESS_QUERY_INFORMATION和PROCESS_VM_READ权限...实现方法和GetModuleFileNameEx类似....

//DESP: get process image path
BOOL process_get_path(HANDLE hProcess, LPTSTR szImagePath, DWORD dwSize)
{
	NTSTATUS ntStatus;
	ULONG uLength;
	DWORD dwBufferSize;
	LPWSTR pBuffer;
	UNICODE_STRING usImagePath;
	PROCESS_BASIC_INFORMATION BasicInformation;
	PRTL_USER_PROCESS_PARAMETERS pProcessParameters;

	//DO: query PEB address
	ntStatus = NtQueryInformationProcess(
		hProcess,
		ProcessBasicInformation,
		&BasicInformation,
		sizeof(PROCESS_BASIC_INFORMATION),
		&uLength);

	if(!NT_SUCCESS(ntStatus))
		return FALSE;

	//DO: read ProcessParameters pointer
	ntStatus = NtReadVirtualMemory(
		hProcess,
		&BasicInformation.PebBaseAddress->ProcessParameters,
		&pProcessParameters,
		sizeof(PRTL_USER_PROCESS_PARAMETERS),
		&uLength);

	if(NT_SUCCESS(ntStatus)) {
		//DO: read ImagePathName UNICODE_STRING
		ntStatus = NtReadVi