How to get the name of the process your dll was injected into

Question

I have a DLL written in C++. I want it so on inject it detects the process of what it was injected inside. Ie it gets the process name. How could this be done?

Answer 1

You can use GetModuleFileName().

Calling it with its hModule parameter set to NULL will give you the name of the file used to create the process.

Since your DLL is running in the context of the process that loaded the DLL, it should give you the appropriate file name.

Answer 2

To get the filename from the path returned by GetModuleFileName() here are 2 methods:

Using char arrays and _splitpath()

HMODULE hExe = GetModuleHandle(NULL);
char fullPath[MAX_PATH]{ 0 };
char fname[MAX_PATH] = { 0 };
char ext[MAX_PATH] = { 0 };
char procName[MAX_PATH] = { 0 };
GetModuleFileName(hExe, fullPath, MAX_PATH);
_splitpath(fullPath, 0, 0, fname, ext);
strcpy(procName, fname);
strcat(procName, ext);

Using std::filesystem

#include <filesystem>
namespace fs = std::experimental::filesystem;
HMODULE hExe = GetModuleHandle(NULL);
WCHAR fullPath[MAX_PATH]{ 0 };
GetModuleFileName(hExe, fullPath, MAX_PATH);
fs::path path(fullPath);
fs::path filename = path.filename();

Both work well with injected DLLs or from any process.