[VB6, twinBASIC] Getting the full path of all processes when not elevated

[wqweto]

While I agree those are better first line options, the thread exists because those are not possible, on Windows 10/11 at least, on a SYSTEM process when your app isn't elevated. For both of those, you need to open a handle to the process, and even PROCESS_QUERY_LIMITED_INFORMATION errors with 'access denied' for SYSTEM processes when you're not elevated.

I was wondering if using SetPrivilege SE_DEBUG_NAME, True call as implemented in this post might grant enough priviledges on your SYSTEM owned process.

I was hoisting some of the linked trick's implementation for my embeded console project when reimplementing tab-completion I needed cmd.exe current directory and it turned out pretty short procedure:

Private Function pvGetCurrentDir(ByVal hProcess As Long) As String
    Const ProcessBasicInformation           As Long = 0
    Const sizeof_PBI                        As Long = 6 * 4
    Const offsetof_ProcessParameters        As Long = &H10
    Const offsetof_CurrentDirectory         As Long = &H24
    Const sizeof_UNICODESTRING              As Long = 2 * 4
    Dim lPtr            As Long
    Dim aTemp(0 To 5)   As Long
    Dim sBuffer         As String
    
    If NtQueryInformationProcess(hProcess, ProcessBasicInformation, aTemp(0), sizeof_PBI, 0) < 0 Then
        GoTo QH
    End If
    If ReadProcessMemory(hProcess, aTemp(1) + offsetof_ProcessParameters, lPtr, 4, 0) = 0 Then
        GoTo QH
    End If
    If ReadProcessMemory(hProcess, lPtr + offsetof_CurrentDirectory, aTemp(0), sizeof_UNICODESTRING, 0) = 0 Then
        GoTo QH
    End If
    sBuffer = String$((aTemp(0) And &HFFFF&) \ 2, 0)
    If ReadProcessMemory(hProcess, aTemp(1), ByVal StrPtr(sBuffer), LenB(sBuffer), 0) = 0 Then
        GoTo QH
    End If
    pvGetCurrentDir = sBuffer
QH:
End Function

Thankfully in my case child cmd.exe process is always spawned w/ same parent VB6 process bitness so no x64 checks needed here.

cheers,
</wqw>