Getting the Exe name of a Process when u have the ID

[DarkSide]

How can I get the name of the Exe when I have the ID to the process? I think I need to use GetModuleFileNameEx() but I dont know what they mean by a module for the second parameter.

[prog_tom]

I think you have to use GetModule(NULL) for the 2nd parameter.

[DarkSide]

but its not for my application its for another application.

[MathImagics]

The method for determining an exe name from a window handle ( which your requirement is related to) is now fairly well-known.

For general application (i.e. cross-platform) you need to use 2 different methods, the "NT" method and the "non-NT" method.

I've posted elsewhere a VB function that does the job, you can find it here: http://www.vbforums.com/showthread.p...hreadid=186545

If you can't find a C version anywhere, this will probably give you enough to go on ....

you'll see that it first maps the window handle to a Process Id, so your entry point will be the ExePathFromProcessId function


Dr Memory

[DarkSide]

i tried to get urs to work but i think i keep gettin NULL for the handle to the process so it returns the path to my app. here is the code i am usin please point out any errors or problems.

	char tmpStr[100] = {0};

	for(int i = 0; i <= 100; i++)
	{
		tmpStr[0] = 0;

		long hProcess, hModule;

		unsigned long *bReturned;

		//hInst = GetWindowWord(hWnd, GWW_HINSTANCE)

		hProcess = (long)OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0, processes[i]);
		
		EnumProcessModules((void *)hProcess, (HINSTANCE *)hModule, 4, bReturned);

		//GetModuleFileNameEx((void *)hProcess, (HINSTANCE)hModule, tmpStr, 100);

		GetModuleFileName((HINSTANCE)hProcess, tmpStr, 100);

		sprintf(tmpString2, "%s\n%s\n%d", tmpString2, tmpStr, processes[i]);
	}

[MathImagics]

I can't see any obvious errors, but then again I don't use Visual C.

But I assume you've got a debugging mode more or less like VB, so I think you should find the exact first point where it goes wrong.

Firstly, is your ProcessId kosher? If not, why not?

Then, are you getting a process handle back from OpenProcess? If not, why not?

The problems must be related to argument-type-matching, cos the VB code I use in various tools and it works fine on both NT and non-NT platforms.

BTW, once you have the Process handle, I think you will still need to get the module handle - I'm fairly sure there is a very good reason why I call GetModuleFileNameEx, and not GetModuleFileName - I just can't remember what it is! I haven't had to change any of it in years!

Anyway - identify the FIRST error, only then can we nail it!

Dr Memory

[DarkSide]

well it would be nice to see an example of how someone else did it in C++.

[CornedBee]

Don't cast the process id to HINSTANCE. There is a reason for the EnumProcessModules call.

A process in windows is an application you started. A process contains one or more execution threads, zero or more windows and one or more MODULES. A module is any executable file loaded by the process: the primary is the exe of the app. Each DLL, OCX etc. loaded by the app is another module. Therefore you need to find the primary module and call GetModuleFileNameEx on this module. GetModuleFileName ONLY WORKS FOR YOUR PROCESS!

Look at this:

HANDLE hProcess = valid process handle;
HMODULE *arhm = NULL;
DWORD dwBytes;
EnumProcessModules(hProcess, NULL, 0, &dwBytes);
arhm = new HMODULE[dwBytes/sizeof(HMODULE)];
EnumProcessModules(hProcess, arhm, dwBytes, &dwBytes);
TCHAR fn[MAX_PATH];
for(int i = 0; i < dwBytes/sizeof(HMODULE); i++) {
  GetModuleFileNameEx(hProcess, arhm[i], fn, MAX_PATH);
  if(0 == _tcsicmp(_T(".exe"), _tcsstr(fn, _T("."))))
    break;
}
// fn is now the full name of the first exe module found in the process.

[MathImagics]

Thanks, CornedBee

I knew there was a reason I used GetModuleFileNameEx ....

... and, like I said, it's been a few years since I cobbled my code together, so I'd forgotten that the EnumProcessModules function was really returning an array of module handles, and that I was just asking for the first one, assuming it would be the primary module....

SO why didn't Dark Side's code work? I thought casting was just something you did to satisfy procedure call type-checking... wasn't he doing the same thing in his call that I was doing in my VB call (ie. pretending a single Long was a 1-element Array of Longs?)

Dr Memory

[CornedBee]

Yes, that's what casting is. But when you cast without thinking, you might forget that there is a REASON for type-checking. In this case it is that HMODULE/HINSTANCE means something different than HANDLE (to a process). Handles are basically addresses of some windows information or table indices, so they don't make any sense in a different context.

[MathImagics]

Roger that, CornedBee!!

Now don't go thinking that I would ever take such liberties with the language ...

I'd hate to think I was being typecast as a frivolous type-caster!!!!!!

Anyway, I think we've just about put this thread to bed - and DarkSide has enough to go on with ....


Cheers!

Dr Memory

[CornedBee]

Never thought that

Person CornedBee, MathImagics;
CornedBee.Bash(misinterpret_cast<CARELESS_TYPECASTER>(MathImagics));

[MathImagics]