-
Notifications
You must be signed in to change notification settings - Fork 5
/
GetProcessName_Method4.pas
73 lines (62 loc) · 1.98 KB
/
GetProcessName_Method4.pas
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
// Jean-Pierre LESUEUR (@DarkCoderSc)
function PhysicalToVirtualPath(APath : String) : String;
var i : integer;
ADrive : String;
ABuffer : array[0..MAX_PATH-1] of Char;
ACandidate : String;
begin
{$I-}
for I := 0 to 25 do begin
ADrive := Format('%s:', [Chr(Ord('A') + i)]);
///
if (QueryDosDevice(PWideChar(ADrive), ABuffer, MAX_PATH) = 0) then
continue;
ACandidate := String(ABuffer).ToLower();
if String(Copy(APath, 1, Length(ACandidate))).ToLower() = ACandidate then begin
Delete(APath, 1, Length(ACandidate));
result := Format('%s%s', [ADrive, APath]);
end;
end;
{$I+}
end;
function GetProcessImagePath(const AProcessId : Cardinal) : String;
// https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-getprocessimagefilenamew
var _GetProcessImageFileNameW : function(
hProcess : THandle;
lpImageFileName : LPWSTR;
nSize : DWORD
) : DWORD; stdcall;
hPsAPI : THandle;
hProc : THandle;
ALength : Cardinal;
AImagePath : String;
const PROCESS_QUERY_LIMITED_INFORMATION = $00001000;
begin
result := '';
///
hProc := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, AProcessId);
if (hProc = 0) then
Exit();
try
hPsAPI := LoadLibrary('psapi.dll');
if (hPsAPI = 0) then
Exit();
try
@_GetProcessImageFileNameW := GetProcAddress(hPsAPI, 'GetProcessImageFileNameW');
if NOT Assigned(_GetProcessImageFileNameW) then
Exit();
///
SetLength(AImagePath, MAX_PATH);
ALength := _GetProcessImageFileNameW(hProc, @AImagePath[1], MAX_PATH);
if (ALength > 0) then begin
SetLength(AImagePath, ALength);
///
result := PhysicalToVirtualPath(AImagePath);
end;
finally
FreeLibrary(hPsAPI);
end;
finally
CloseHandle(hProc);
end;
end;