Windows驱动获得当前进程全路径的方法

方法：

通过ZwQueryInformationProcess函数查询ImageFileName

支持的系统：XP以上操作系统

具体方法如下：

BOOL GetProcessPathNameByHandle(HANDLE ProcessHandle,char * path)

{

DWORD ret;

ULONG lRet;

PUNICODE_STRING path_u;

WCHAR TempBuffer[1024];

ANSI_STRING name_a;

path_u = (PUNICODE_STRING)TempBuffer;

if(NULL != gSfDynamicFunctions.ZwQueryInformationProcess)

{

ret = gSfDynamicFunctions.ZwQueryInformationProcess(ProcessHandle, ProcessImageFileName,

path_u, sizeof(TempBuffer), &lRet);

}

else

{

return FALSE;

}

if (STATUS_SUCCESS == RtlUnicodeStringToAnsiString (&name_a, path_u, TRUE))

{

KdPrint (("Current GetProcessPathNameByHandle: %s\r\n",name_a.Buffer)) ;

strcpy(path,name_a.Buffer);

RtlFreeAnsiString(&name_a);

return TRUE;

}

return FALSE;

}

函数调用：

GetProcessPathNameByHandle(NtCurrentProcess(), spath);