[Help]Getting Location of a running process.

nathanael890 · 2010-09-20T09:57:37.000Z

Can I ask if there is a code how to get the location of the running process. As an example, I want to locate Task manager So If Task manager runs, I can get where is the location of it.

as long as you know the handle, And if you are trying to get the file location of a running process then GetModuleFileName API function should work.

Code:

Declare Function GetModuleFileName Lib "kernel32" Alias "GetModuleFileNameA" (ByVal hModule As Long, ByVal lpFileName As String, ByVal nSize As Long) As Long

Originally Posted by MSDN

· hModule
Identifies the module whose executable filename is being requested. If this parameter is NULL, GetModuleFileName returns the path for the file used to create the calling process.

· lpFilename
Points to a buffer that is filled in with the path and filename of the given module.

· nSize
Specifies the length, in characters, of the lpFilename buffer. If the length of the path and filename exceeds this limit, the string is truncated.

Return Values
If the function succeeds, the return value is the length, in characters, of the string copied to the buffer.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Yea it looks easier with that Nextgen, i talked about Module32first/next because i know it has a struct which contains a field / member with the path of the module

Originally Posted by MSDN

Members
dwSize

The size of the structure, in bytes. Before calling the Module32First function, set this member to sizeof(MODULEENTRY32). If you do not initialize dwSize, Module32First fails.
th32ModuleID

This member is no longer used, and is always set to one.
th32ProcessID

The identifier of the process whose modules are to be examined.
GlblcntUsage

The load count of the module, which is not generally meaningful, and usually equal to 0xFFFF.
ProccntUsage

The load count of the module (same as GlblcntUsage), which is not generally meaningful, and usually equal to 0xFFFF.
modBaseAddr

The base address of the module in the context of the owning process.
modBaseSize

The size of the module, in bytes.
hModule

A handle to the module in the context of the owning process.
szModule

The module name.
szExePath

The module path.

but yea u'r right

[Help]Getting Location of a running process.

Post a Reply

Similar Threads

Tags for this Thread