方法:
通过ZwQueryInformationProcess函数查询ImageFileName
支持的系统:XP以上操作系统
具体方法如下:
BOOL GetProcessPathNameByHandle(HANDLE ProcessHandle,char * path)
{DWORD ret;
ULONG lRet;
PUNICODE_STRING path_u;
WCHAR TempBuffer[1024];
ANSI_STRING name_a;
path_u = (PUNICODE_STRING)TempBuffer;
if(NULL != gSfDynamicFunctions.ZwQueryInformationProcess)
{
ret = gSfDynamicFunctions.ZwQueryInformationProcess(ProcessHandle, ProcessImageFileName,
path_u, sizeof(TempBuffer), &lRet);
}
else
{
return FALSE;
}
if (STATUS_SUCCESS == RtlUnicodeStringToAnsiString (&name_a, path_u, TRUE))
{
KdPrint (("Current GetProcessPathNameByHandle: %s\r\n",name_a.Buffer)) ;
strcpy(path,name_a.Buffer);
RtlFreeAnsiString(&name_a);
return TRUE;
}
return FALSE;
}
函数调用:
GetProcessPathNameByHandle(NtCurrentProcess(), spath);