[RESOLVED] How to get full path of running process?

[Lauriux1]

Hello!
I need some hlep, I want to get full path of running process. I have heard that it is possible to do that using GetModuleFileNameEx, maybe someone could show me an example how to do that?

[Xiphias3]

Put this in a Form

Option Explicit
 
Private Declare Function GetModuleFileName Lib "kernel32.dll" Alias "GetModuleFileNameA" (ByVal hModule As Long, ByVal lpFileName As String, ByVal nSize As Long) As Long
Private Const MAX_PATH As Long = 260
 
Private Sub Form_Load()
    Dim szBuff As String, lRet As Long
    
    szBuff = Space(MAX_PATH)
    lRet = GetModuleFileName(0, szBuff, MAX_PATH)
    szBuff = Left(szBuff, lRet)
    Call MsgBox("Process Path: " + szBuff, vbOKOnly Or vbInformation, "Process Path")
    Call Unload(Me)
End Sub

[Lauriux1]

Thanks, Xiphias3, but I was talking about a external process that's why I have mentioned GetModuleFileNameEx.

[Xiphias3]

Oh, my bad. Lemme type it up.

EDIT:
Just so you know, you can also use the szExeFile member of the PROCESSENTRY32 structure.

Option Explicit
 
Private Declare Function OpenProcess Lib "KERNEL32.dll" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function CloseHandle Lib "KERNEL32.dll" (ByVal hObject As Long) As Long
Private Declare Function GetModuleFileNameEx Lib "psapi.dll" Alias "GetModuleFileNameExA" (ByVal hProcess As Long, ByVal hModule As Long, ByVal lpFilename As String, ByVal nSize As Long) As Long
Private Declare Function Process32First Lib "KERNEL32.dll" (ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Private Declare Function Process32Next Lib "KERNEL32.dll" (ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Private Declare Function CreateToolhelp32Snapshot Lib "KERNEL32.dll" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
 
Private Const TH32CS_SNAPPROCESS As Long = &H2
Private Const MAX_PATH As Long = 260
Private Const PROCESS_QUERY_INFORMATION As Long = (&H400)
Private Const PROCESS_VM_READ As Long = (&H10)
 
Private Type PROCESSENTRY32
    dwSize As Long
    cntUsage As Long
    th32ProcessID As Long
    th32DefaultHeapID As Long
    th32ModuleID As Long
    cntThreads As Long
    th32ParentProcessID As Long
    pcPriClassBase As Long
    dwFlags As Long
    szExeFile As String * MAX_PATH
End Type
 
Private Sub Form_Load()
    Dim lRet As Long, tPE As PROCESSENTRY32, szBuff As String, hProcSnapShot As Long, hProc As Long, _
        lCntChars As Long, bOK As Boolean
    
    hProcSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
    If (hProcSnapShot) Then
        tPE.dwSize = Len(tPE)
        lRet = Process32First(hProcSnapShot, tPE)
        Do While (lRet)
            bOK = False
            hProc = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, 0, tPE.th32ProcessID)
            If (hProc) Then
                szBuff = Space(MAX_PATH)
                lCntChars = GetModuleFileNameEx(hProc, 0, szBuff, MAX_PATH)
                If (lCntChars) Then
                    szBuff = Left(szBuff, lCntChars)
                    bOK = True
                End If
                Call CloseHandle(hProc)
            End If
            
            If (bOK) Then
                Debug.Print "PID: " & tPE.th32ProcessID & " (" + szBuff + ")"
            Else
                Debug.Print "Unable to get path for process with ID " & tPE.th32ProcessID
            End If
            
            lRet = Process32Next(hProcSnapShot, tPE)
        Loop
    End If
    Call CloseHandle(hProcSnapShot)
    Call Unload(Me)
End Sub

[Xiphias3]

*added some code*

[FireXtol]

Good times.

Public Const PROCESS_QUERY_INFORMATION As Long = (&H400)
Public Const PROCESS_VM_READ As Long = (&H10)
 
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Public Declare Function EnumProcesses Lib "psapi.dll" (ByRef lpidProcess As Long, ByVal cb As Long, ByRef cbNeeded As Long) As Long
Public Declare Function EnumProcessModules Lib "psapi.dll" (ByVal hProcess As Long, ByRef lphModule As Long, ByVal cb As Long, ByRef lpcbNeeded As Long) As Long
Public Declare Function GetModuleFileNameEx Lib "psapi.dll" Alias "GetModuleFileNameExA" (ByVal hProcess As Long, ByVal hModule As Long, ByVal lpFilename As String, ByVal nSize As Long) As Long
 
Private Sub PrintProc(ProcessID As Long)
Dim hProc As Long, hMod As Long, cbNeeded As Long
Dim strBuff As String, lRet As Long
strBuff = Space(260)
 
hProc = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, 0, ProcessID)
If hProc <> 0 Then
  If EnumProcessModules(hProc, hMod, 4&, cbNeeded) Then
    lRet = GetModuleFileNameEx(hProc, hMod, strBuff, 260)
    strBuff = Left$(strBuff, lRet)
    Debug.Print ProcessID & " " & strBuff
  End If
  CloseHandle hProc
End If
End Sub
 
Public Function GetProcess()
Dim aProcess(1023) As Long, cbNeeded As Long, cProcess As Long, I As Long
EnumProcesses ByVal VarPtr(aProcess(0)), 1024 * 4, cbNeeded
cProcess = cbNeeded / 4
For I = 0 To cProcess
  PrintProc aProcess(I)
Next I
End Function

[Xiphias3]

Oh, you just added the CloseHandle().

[FireXtol]

Oh, you just added the CloseHandle().

Seemed like a good idea.

[Lauriux1]

Thanks, mates!

Resolved!

[HackerVlad]

Thanks, Xiphias3, but I was talking about a external process that's why I have mentioned GetModuleFileNameEx.

GetModuleFileNameEx is a good function that returns a truthful result, the correct full path to the process, but it only works for 32-bit processes. Therefore, it is best to use other functions as well. Here, in detail, on how to get the full path to processes, I have written a whole module for this.: https://www.vbforums.com/showthread....ons-of-Windows