How to get the path of a system file

Question

Is there a way to get the path of the system files like "wininit.exe" from processId? Below code doesn't work. Process.GetProcesses() also doesn't return anything logical. Please help me.

P.S. I'm trying to code my own task manager designed based on my needs.

    private static string GetMainModuleFilepath(int processId)
    {
        string wmiQueryString = "SELECT ProcessId, ExecutablePath FROM Win32_Process WHERE ProcessId = " + processId;
        using (var searcher = new ManagementObjectSearcher(wmiQueryString))
        {
            using (var results = searcher.Get())
            {
                ManagementObject mo = results.Cast<ManagementObject>().FirstOrDefault();
                if (mo != null)
                {
                    return (string)mo["ExecutablePath"];
                }
            }
        }
        return null;
    }

ConnorTJ · Answer 1 · 2021-10-08T14:40:19.513

0

You can use the Process.GetProcessById method and pass in the ProcessId.

Then you can use the MainModule.FileName property on the ProcessModule.

My full code can be seen below: (I have done this in a Console App for quicker writing)

static void Main(string[] args)
{
    while (true)
    {
        Console.WriteLine("Enter Process ID:");
        var processIdString = Console.ReadLine();
        var parsed = int.TryParse(processIdString, out var procId);
        if (parsed)
        {
            var path = GetMainModuleFilepath(procId);
            Console.WriteLine($"Found Path: {path}");
        }
        else
        {
            Console.WriteLine("Process Id must be a number!");
        }
    }
}

private static string GetMainModuleFilepath(int processId)
{
    var process = Process.GetProcessById(processId);
    if (process == null)
    {
        return string.Empty;
    }

    return process.MainModule?.FileName;
}

Which results in the following:

Note: If you are running this code in 32 bit application, you'll not be able to access 64-bit application paths, so you'd have to compile and run you app as 64-bit application (Project Properties → Build → Platform Target → x64).

edited Oct 08 '21 at 14:40

answered Oct 08 '21 at 14:26

ConnorTJ

396
2
12

thanks for the answer ConnorTJ. However, I still can't access the wininit.exe file for some reason even UAC is disabled completely, and my console app is running with admin privilages. Do you think it's possibe access system files by a chance? – csharpguru1991 Oct 09 '21 at 09:21
@csharpguru1991 are you getting any exceptions when using the code I have provided? E.g a `Win32Exception`? As according to the documentation: https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.process.mainmodule?view=net-5.0 the issue is that it's a 32 bit process trying to access the modules of a 64 bit process. – ConnorTJ Oct 11 '21 at 07:14
But when you're debugging through the code, please look into any exception messages you are getting and try to use them to troubleshoot the issue, e.g `Access Denied`, `Cannot enumerate modules`, etc... – ConnorTJ Oct 11 '21 at 07:21
if I run on x86: it says "Win32Exception: 'A 32 bit processes cannot access modules of a 64 bit process." but when I run on x64 it says "Access is denied". I switch it clicking on properties -> Build -> Platform Target -> x64 – csharpguru1991 Oct 16 '21 at 18:55
@csharpguru1991 if you try this answer does it work for you? If not, I believe you just might not be able to access the directory for specific processes https://stackoverflow.com/a/46004513/13108684 – ConnorTJ Oct 19 '21 at 08:41

How to get the path of a system file

1 Answers1