ProcessImageFileNameWin32

---

Result
       X:\xxx.exe
Note
       The calling application must free the memory call free function
Minimum supported client
       Windows Vista

NTSTATUS GetProcessPath(
    IN  HANDLE          UniqueProcessId,
    OUT PUNICODE_STRING*    ProcessPath )
{
    NTSTATUS Status = STATUS_SUCCESS;
    PVOID Buffer = NULL;
    HANDLE hProcess = NULL;
    ULONG NeedSize = 0;
    CLIENT_ID ci = { 0 };
    OBJECT_ATTRIBUTES oa = { 0 };

    ci.UniqueProcess = UniqueProcessId;
    oa.Length = sizeof( oa );

    Status = NtOpenProcess( &hProcess, PROCESS_QUERY_LIMITED_INFORMATION, &oa, &ci );
    if ( ! hProcess )
        return Status;

    Status = NtQueryInformationProcess( hProcess, ProcessImageFileNameWin32, NULL, 0, &NeedSize );
    if ( ! NeedSize )
        return Status;

    Buffer = malloc( NeedSize );
    memset( Buffer, 0, NeedSize );
    Status = NtQueryInformationProcess( hProcess, ProcessImageFileNameWin32, Buffer, NeedSize, NULL );

    CloseHandle( hProcess );
    *ProcessPath = ( PUNICODE_STRING )Buffer;

    return Status;
}