Get full path from a PID

[Carl Woodward]

Dear all,

Anyone know how to get the full path from a process ID?

TIA,

Carl

[Alex Blekhman]

"Carl Woodward" <carl@do_not_SPAM_me_ok.com> wrote in message
news:903sor$l7p$1...@uranium.btinternet.com...

> Dear all,
>
> Anyone know how to get the full path from a process ID?
>

I only know how to do it PSAPI. Call CreateToolhelp32Snapshot with
TH32CS_SNAPPROCESS flag. Then, enumerate processes with
Process32First/ProcessNext until you'll find your PID.

[Carl Woodward]

Alex,

> I only know how to do it PSAPI. Call CreateToolhelp32Snapshot with
> TH32CS_SNAPPROCESS flag. Then, enumerate processes with
> Process32First/ProcessNext until you'll find your PID.

Thats what I'm already doing. You get the executable name, e.g.
"cdplayer.exe" from the PROCESSENTRY32 structure but no path. I'd really
like to able get c:\\winnt\cdplayer.exe or whatever the full path is. Cheers
for replying though! I appreciate it! Anyone else got any ideas?

Thanks,

Carl

[Luc Kumps]

What OS are we talking about?

Luc

"Carl Woodward" <carl@do_not_SPAM_me_ok.com> wrote in message
news:903sor$l7p$1...@uranium.btinternet.com...

[dv...@hotmail.com]

Hi.

If you're talking about Win9x/Me, then
PROCESSENTRY32 structure has a member " char szExeFile[MAX_PATH] ".
This is exactly what you need.
I use this member to retrieve the process name :-).

In Win 2k/NT you should use EnumProcessModules and then
GetModuleFileNameEx from psapi.dll.

Thanks

Dan
dv...@hotmail.com, CA

In article <906pff$cks$1...@uranium.btinternet.com>,

Sent via Deja.com http://www.deja.com/
Before you buy.

[Carl Woodward]

> If you're talking about Win9x/Me, then
> PROCESSENTRY32 structure has a member " char szExeFile[MAX_PATH] ".
> This is exactly what you need.
> I use this member to retrieve the process name :-).

Yep, I know. That is what I have been using. Unfortunately, in my original
post I asked if anyone knew how to get the full path not just the process
name. cdplayer.exe fpr example isn't quite what I need. I need the full path
like c:\windows\cdplayer.exe. Again though, cheers for taking the trouble to
reply! I'm looking for either some kind of API which could find cdplayer.exe
for me (I'd rather not enumerate each drive on my machine...but if I have to
I will!) but if possible some routine which I could call which would
translate the processID module name into the full path. Any ideas?

Thanks,

Carl

[Luc Kumps]

What OS?

Luc

"Carl Woodward" <carl@do_not_SPAM_me_ok.com> wrote in message
news:903sor$l7p$1...@uranium.btinternet.com...

> Anyone know how to get the full path from a process ID?

[Carl Woodward]

Sorry Luc! Missed your post on the bottom there! The OS I'm currently using
is Win2000. It would be nice if I had a solution for 98/ME aswell though.
Sounds like you have an answer...

Cheers,

Carl

[Anthony Graham]

try this (I may not define everything, but you can find it all in the MSDN
docs).

first get a processentry32 (pe32) then do:

BOOL bGotModule = FALSE;
MODULEENTRY32 me32 = {0};
PINFO pi = {0};
bGotModule = GetProcessModule(pe32.th32ProcessID,
pe32.th32ModuleID, &me32, sizeof(MODULEENTRY32));
if (bGotModule)
{
MessageBox(NULL,me32.szExePath,"Process Full Path",MB_OK);
}

k, bye!

- Anthony

"Carl Woodward" <carl@do_not_SPAM_me_ok.com> wrote in message

news:909026$lil$1...@uranium.btinternet.com...

[Luc Kumps]

Antony Graham just answered it, I think...

Luc

"Carl Woodward" <carl@do_not_SPAM_me_ok.com> wrote in message

news:909jps$4ld$1...@neptunium.btinternet.com...

[Carl Woodward]

Thanks! That should do the trick! Just for reference though,
GetProcessModule is not an API call. It is a 'demo' function in the
ToolHelp32 docs. Had me confused for a minute there...!

Carl

[Carl Woodward]

> Antony Graham just answered it, I think...
>
> Luc

Indeed he has. Cheers for your help.

Carl

[Frank Ostrowski]

>Thanks! That should do the trick! Just for reference though,
>GetProcessModule is not an API call. It is a 'demo' function in the
>ToolHelp32 docs. Had me confused for a minute there...!

ToolHelp32 is support by Win95+, and WinNT5 (=Win2000), but WinNT
(3.51 and 4.0) have to use psapi.dll (which does not work on Win95+).

[dv...@hotmail.com]

Hi Carl.

What I meant is that I use the member szExeFile[MAX_PATH],
which ALREADY contains the path, to retrieve the process name.

Here is a part of my code:

pe32.dwSize = sizeof(PROCESSENTRY32); // must be filled out before use
if (pProcess32First(hProcessSnap, &pe32))
{
do
{
...
// print the full path
MessageBox(NULL, pe32.szExeFile, "", MB_OK);

// copy to my own structure
lstrcpy(pTask->szExeFile, pe32.szExeFile);

// retrieve process name
...

} while (pProcess32Next(hProcessSnap, &pe32));
}

Thanks,

Dan
dv...@hotmail.com, CA

In article <909026$lil$1...@uranium.btinternet.com>,

"Carl Woodward" <carl@do_not_SPAM_me_ok.com> wrote:
> > If you're talking about Win9x/Me, then
> > PROCESSENTRY32 structure has a member " char szExeFile[MAX_PATH] ".
> > This is exactly what you need.
> > I use this member to retrieve the process name :-).
>
> Yep, I know. That is what I have been using. Unfortunately, in my
original
> post I asked if anyone knew how to get the full path not just the
process
> name. cdplayer.exe fpr example isn't quite what I need. I need the
full path
> like c:\windows\cdplayer.exe. Again though, cheers for taking the
trouble to
> reply! I'm looking for either some kind of API which could find
cdplayer.exe
> for me (I'd rather not enumerate each drive on my machine...but if I
have to
> I will!) but if possible some routine which I could call which would
> translate the processID module name into the full path. Any ideas?
>
> Thanks,
>
> Carl
>
>

[Anthony Graham]

Glad to help!

- Anthony

"Carl Woodward" <carl@do_not_SPAM_me_ok.com> wrote in message

news:90ar1o$fs7$1...@plutonium.btinternet.com...

> Thanks! That should do the trick! Just for reference though,
> GetProcessModule is not an API call. It is a 'demo' function in the
> ToolHelp32 docs. Had me confused for a minute there...!
>

> Carl

[Carl Woodward]

> What I meant is that I use the member szExeFile[MAX_PATH],
> which ALREADY contains the path, to retrieve the process name.

No it doesn't...not on Windows2000 anyway. In Windows 2000 it contains the
name of the executable and doesn't have the path. It is true for 9x/ME but
not for Windows 2000. That was the problem, I needed a solution to work
across all the platforms (excluding NT4 ofcourse). As it turns out the first
module for a given process ID is always (it seems) the full path to the
process executable.

Below is a snipet of code from the app. I'm not doing anything out of the
ordinary or unusual, I just dont get paths under windows 2000.

Cheers,

Carl

<CODE>
//
// Open this process's access token
//
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES,
&hToken))
{
//
// Modify the "Debug" privilege
//
TOKEN_PRIVILEGES tp;

tp.PrivilegeCount = 1;
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);

CloseHandle(hToken);
}

hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);

pe32.dwSize = sizeof (PROCESSENTRY32);
if (Process32First(hSnapshot,&pe32))

do
{
TCHAR szFilePath[MAX_PATH];

tvItem.mask = TVIF_TEXT | TVIF_IMAGE | TVIF_SELECTEDIMAGE | TVIF_CHILDREN
| TVIF_PARAM;

//
// Get the process's full path
//
me32.dwSize = sizeof(MODULEENTRY32);
hModules = CreateToolhelp32Snapshot(TH32CS_SNAPALL, pe32.th32ProcessID);

tvItem.cChildren = Module32First(hModules, &me32);
strcpy (szFilePath, me32.szExePath);
CloseHandle(hModules);

//
// Get the icon
//
SHGetFileInfo((LPCTSTR)szFilePath, 0, &sfi, sizeof (SHFILEINFO),
SHGFI_DISPLAYNAME | SHGFI_ICON);

tvItem.cchTextMax = lstrlen(pe32.szExeFile);
tvItem.pszText = &pe32.szExeFile[0];
tvItem.iImage = sfi.iIcon;
tvItem.iSelectedImage = sfi.iIcon;

tvInsert.hParent = TVI_ROOT;
tvInsert.hInsertAfter = TVI_LAST;
tvInsert.itemex = tvItem;

TreeView_InsertItem(hwndTV, &tvInsert);

} while (Process32Next(hSnapshot, &pe32));

<END CODE>

[dv...@hotmail.com]

Ok, I see.

As I wrote in Message 4, I use another way in Win NT/2000 (psapi.dll):

HMODULE hModules[1024];
DWORD count;
char cModuleName[MAX_PATH];
int y;

if( EnumProcessModules(hProcess, hModules, sizeof(hModules), &count))
{
for ( y = 0; y < (count / sizeof(HMODULE)); y++ )
{
// Get the full path to the module's file.
if ( GetModuleFileNameEx( hProcess, hModules[y], cModuleName,
sizeof(cModuleName)))
{
// Copy the path.
lstrcpy(pTaskCopy[i].szExeFile, cModuleName);
break;
}
}
}
else
{
GetLastError();
}

BTW. What path does your implementation give for

smss.exe
csrss.exe
winlogon.exe ?

Thanks

Dan
dv...@hotmail.com, CA

In article <90dj6e$ibu$1...@neptunium.btinternet.com>,

[Carl Woodward]

Dan,

> BTW. What path does your implementation give for
>
> smss.exe

\SystemRoot\System32\smss.exe
> csrss.exe
\??\C:\WINNT\system32\csrss.exe
> winlogon.exe ?
\??\C:\WINNT\system32\winlogon.exe

Varied!

Carl

[dv...@my-deja.com]

Hi Carl.

The same strange results I had for Win2k/NT with psapi.dll method.

Do you have any explanation?

Thanks

Dan
dv...@hotmail.com, CA

In article <90e7rs$mlh$1...@uranium.btinternet.com>,