As the title says I want to find a system's process path from PID. I have seen several threads like this: get the full path from a PID using delphi and googled a lot.
I have tried many functions but all are working only for 32-bit processes.
Is there any way to find the path of a 64-bit process using the PID??
type
TQueryFullProcessImageNameW = function(AProcess: THANDLE; AFlags: DWORD;
AFileName: PWideChar; var ASize: DWORD): BOOL; stdcall;
TGetModuleFileNameExW = function(AProcess: THANDLE; AModule: HMODULE;
AFilename: PWideChar; ASize: DWORD): DWORD; stdcall;
function IsWindows200OrLater: Boolean;
begin
Result := Win32MajorVersion >= 5;
end;
function IsWindowsVistaOrLater: Boolean;
begin
Result := Win32MajorVersion >= 6;
end;
var
PsapiLib: HMODULE;
GetModuleFileNameExW: TGetModuleFileNameExW;
procedure DonePsapiLib;
begin
if PsapiLib = 0 then Exit;
FreeLibrary(PsapiLib);
PsapiLib := 0;
@GetModuleFileNameExW := nil;
end;
procedure InitPsapiLib;
begin
if PsapiLib <> 0 then Exit;
PsapiLib := LoadLibrary('psapi.dll');
if PsapiLib = 0 then RaiseLastOSError;
@GetModuleFileNameExW := GetProcAddress(PsapiLib, 'GetModuleFileNameExW');
if not Assigned(GetModuleFileNameExW) then
try
RaiseLastOSError;
except
DonePsapiLib;
raise;
end;
end;
function GetFileNameByProcessID(AProcessID: DWORD): UnicodeString;
const
PROCESS_QUERY_LIMITED_INFORMATION = $00001000; //Vista and above
var
HProcess: THandle;
Lib: HMODULE;
QueryFullProcessImageNameW: TQueryFullProcessImageNameW;
S: DWORD;
begin
if IsWindowsVistaOrLater then
begin
Lib := GetModuleHandle('kernel32.dll');
if Lib = 0 then RaiseLastOSError;
@QueryFullProcessImageNameW := GetProcAddress(Lib, 'QueryFullProcessImageNameW');
if not Assigned(QueryFullProcessImageNameW) then RaiseLastOSError;
HProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, AProcessID);
if HProcess = 0 then RaiseLastOSError;
try
S := MAX_PATH;
SetLength(Result, S + 1);
while not QueryFullProcessImageNameW(HProcess, 0, PWideChar(Result), S) and (GetLastError = ERROR_INSUFFICIENT_BUFFER) do
begin
S := S * 2;
SetLength(Result, S + 1);
end;
SetLength(Result, S);
Inc(S);
if not QueryFullProcessImageNameW(HProcess, 0, PWideChar(Result), S) then
RaiseLastOSError;
finally
CloseHandle(HProcess);
end;
end
else
if IsWindows200OrLater then
begin
InitPsapiLib;
HProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, AProcessID);
if HProcess = 0 then RaiseLastOSError;
try
S := MAX_PATH;
SetLength(Result, S + 1);
if GetModuleFileNameExW(HProcess, 0, PWideChar(Result), S) = 0 then
RaiseLastOSError;
Result := PWideChar(Result);
finally
CloseHandle(HProcess);
end;
end;
end;
initialization
PsapiLib := 0;
finalization
DonePsapiLib;
Example of usage:
procedure EnumProcesses(AStrings: TStrings);
var Snapshot: THandle;
Entry: TProcessEntry32;
Found: Boolean;
Count: Integer;
begin
Snapshot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (Snapshot = INVALID_HANDLE_VALUE) or (Snapshot = 0) then Exit;
try
ZeroMemory(@Entry, SizeOf(Entry));
Entry.dwSize := SizeOf(Entry);
if Process32First(Snapshot, Entry) then
repeat
try
AStrings.Add(GetFileNameByProcessID(Entry.th32ProcessID));
except
AStrings.Add('System process #' + IntToStr(Entry.th32ProcessID));
end;
ZeroMemory(@Entry, SizeOf(Entry));
Entry.dwSize := SizeOf(Entry);
until not Process32Next(Snapshot, Entry);
finally
CloseHandle(Snapshot)
end;
end;
procedure TForm11.FormCreate(Sender: TObject);
begin
EnumProcesses(ListBox1.Items);
end;
Result (32 bit sample app on Win64 where Explorer is 64 bit app):
There are no Win32 functions that let you do that from inside the 32 bit emulator (WOW64). You should execute your code in a 64 bit process. Nope, that's not true. Denis proves me wrong. The function you need is QueryFullProcessImageName.
Alternatively you can use WMI. Specifically Win32_Process. Some sample code here: http://theroadtodelphi.wordpress.com/2011/11/06
Borrowing from @RRUZ's example code, here's a short program that prints the PID and executable name for the running processes that can be enumerated using WMI.
{$APPTYPE CONSOLE}
uses
Variants, ComObj, ActiveX;
const
wbemFlagForwardOnly = $00000020;
var
FSWbemLocator : OLEVariant;
FWMIService : OLEVariant;
FWbemObjectSet: OLEVariant;
FWbemObject : OLEVariant;
oEnum : IEnumVariant;
iValue : LongWord;
begin
CoInitialize(nil);
FSWbemLocator := CreateOleObject('WbemScripting.SWbemLocator');
FWMIService := FSWbemLocator.ConnectServer('localhost', 'root\CIMV2', '', '');
FWbemObjectSet:= FWMIService.ExecQuery('SELECT ExecutablePath, ProcessId FROM Win32_Process','WQL',wbemFlagForwardOnly);
oEnum := IUnknown(FWbemObjectSet._NewEnum) as IEnumVariant;
while oEnum.Next(1, FWbemObject, iValue) = 0 do
begin
if not VarIsNull(FWbemObject.ExecutablePath) then
Writeln(string(FWbemObject.ProcessId) + ': ' + string(FWbemObject.ExecutablePath));
FWbemObject:=Unassigned; //avoid memory leak in oEnum.Next
end;
end.
Seems that it doesn't matter the language, so in C# you could use WMI to get the processes (including 64 bit).
using System.Management;
var wmiQueryString = "SELECT ProcessId, ExecutablePath, CommandLine FROM Win32_Process";
using (var searcher = new ManagementObjectSearcher(wmiQueryString))
using (var results = searcher.Get())
{
var query = results.Cast<ManagementObject>();
foreach (var obj in query)
{
var filePath = obj.GetPropertyValue("ExecutablePath").Dump();
}
}
You will have to reference System.Management.dll
