Re: Process image file path

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

In the WXP ntddk.h file there is an enum value, ProcessImageFileName.
Using this value with ZwQueryInformationProcess returns the path +
filename successfully.

The path? I'm really amazed.

XP SP2's Windows Firewall has the rules based on EXE pathname. To match the app
against these rules, IPNATHLP.DLL (which is the user-mode part of Windows
Firewall) uses good old psapi!GetModuleFileNameEx, which just reads the
target's PEB using ReadProcessMemory and gets the pathname string in the PEB's
child structure of RTL_USER_PROCESS_PARAMETERS.

I would be very much surprised that XP's kernel has a call to get the _Unicode
full pathname_ of the process's EXE.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@xxxxxxxxxxxxxxxx
http://www.storagecraft.com

.

Relevant Pages

  • Re: Process image file path
    ... XP SP2's Windows Firewall has the rules based on EXE pathname. ...
    (microsoft.public.development.device.drivers)
  • Re: Process image file path
    ... XP SP2's Windows Firewall has the rules based on EXE pathname. ... I did explore the PEB and it's memory structures briefly. ...
    (microsoft.public.development.device.drivers)
  • RPC Connection problems with XP Firewall, dispite proper exeptions
    ... So there seems to be a problem with DCOM or RPC over the Windows XP SP2 ... Windows Firewall: Allow local program exceptions ... If you enable this policy setting, Windows Firewall allows the computer to ... does not open TCP port 135 or 445. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Still cant connect to RWW or OWA remotely
    ... Advanced tab on both NICs. ... "Windows Firewall cannot run because another ... Windows WORKSTATION XP Pro - Domain Member ... Meridian.local Ethernet adapter Local Area Connection: ...
    (microsoft.public.windows.server.sbs)
  • Re: System Restore Keeping Only One Restore Point
    ... How many restore points are you keeping? ... use the built in Windows firewall... ... the Windows Firewall in XP does a ... router or] other edge protection like SeconfigXP and practise ...
    (microsoft.public.windowsxp.help_and_support)