How to get a system's process path from PID in a 64-bit system?

Question

As the title says I want to find a system's process path from PID. I have seen several threads like this: get the full path from a PID using delphi and googled a lot.

I have tried many functions but all are working only for 32-bit processes.

Is there any way to find the path of a 64-bit process using the PID??

Answer 1

type
  TQueryFullProcessImageNameW = function(AProcess: THANDLE; AFlags: DWORD;
    AFileName: PWideChar; var ASize: DWORD): BOOL; stdcall;
  TGetModuleFileNameExW = function(AProcess: THANDLE; AModule: HMODULE;
    AFilename: PWideChar; ASize: DWORD): DWORD; stdcall;

function IsWindows200OrLater: Boolean;
begin
  Result := Win32MajorVersion >= 5;
end;

function IsWindowsVistaOrLater: Boolean;
begin
  Result := Win32MajorVersion >= 6;
end;

var
  PsapiLib: HMODULE;
  GetModuleFileNameExW: TGetModuleFileNameExW;

procedure DonePsapiLib;
begin
  if PsapiLib = 0 then Exit;
  FreeLibrary(PsapiLib);
  PsapiLib := 0;
  @GetModuleFileNameExW := nil;
end;

procedure InitPsapiLib;
begin
  if PsapiLib <> 0 then Exit;
  PsapiLib := LoadLibrary('psapi.dll');
  if PsapiLib = 0 then RaiseLastOSError;
  @GetModuleFileNameExW := GetProcAddress(PsapiLib, 'GetModuleFileNameExW');
  if not Assigned(GetModuleFileNameExW) then
    try
      RaiseLastOSError;
    except
      DonePsapiLib;
      raise;
    end;
end;

function GetFileNameByProcessID(AProcessID: DWORD): UnicodeString;
const
  PROCESS_QUERY_LIMITED_INFORMATION = $00001000; //Vista and above
var
  HProcess: THandle;
  Lib: HMODULE;
  QueryFullProcessImageNameW: TQueryFullProcessImageNameW;
  S: DWORD;
begin
  if IsWindowsVistaOrLater then
    begin
      Lib := GetModuleHandle('kernel32.dll');
      if Lib = 0 then RaiseLastOSError;
      @QueryFullProcessImageNameW := GetProcAddress(Lib, 'QueryFullProcessImageNameW');
      if not Assigned(QueryFullProcessImageNameW) then RaiseLastOSError;
      HProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, AProcessID);
      if HProcess = 0 then RaiseLastOSError;
      try
        S := MAX_PATH;
        SetLength(Result, S + 1);
        while not QueryFullProcessImageNameW(HProcess, 0, PWideChar(Result), S) and (GetLastError = ERROR_INSUFFICIENT_BUFFER) do
          begin
            S := S * 2;
            SetLength(Result, S + 1);
          end;
        SetLength(Result, S);
        Inc(S);
        if not QueryFullProcessImageNameW(HProcess, 0, PWideChar(Result), S) then
          RaiseLastOSError;
      finally
        CloseHandle(HProcess);
      end;
    end
  else
    if IsWindows200OrLater then
      begin
        InitPsapiLib;
        HProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, AProcessID);
        if HProcess = 0 then RaiseLastOSError;
        try
          S := MAX_PATH;
          SetLength(Result, S + 1);
          if GetModuleFileNameExW(HProcess, 0, PWideChar(Result), S) = 0 then
            RaiseLastOSError;
          Result := PWideChar(Result);
        finally
          CloseHandle(HProcess);
        end;
      end;
end;


initialization
  PsapiLib := 0;

finalization
  DonePsapiLib;

Example of usage:

procedure EnumProcesses(AStrings: TStrings);
var Snapshot: THandle;
    Entry: TProcessEntry32;
    Found: Boolean;
    Count: Integer;
begin
    Snapshot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (Snapshot = INVALID_HANDLE_VALUE) or (Snapshot = 0) then Exit;
    try
      ZeroMemory(@Entry, SizeOf(Entry));
      Entry.dwSize := SizeOf(Entry);
      if Process32First(Snapshot, Entry) then
        repeat
          try
            AStrings.Add(GetFileNameByProcessID(Entry.th32ProcessID));
          except
            AStrings.Add('System process #' + IntToStr(Entry.th32ProcessID));
          end;
          ZeroMemory(@Entry, SizeOf(Entry));
          Entry.dwSize := SizeOf(Entry);
        until not Process32Next(Snapshot, Entry);
    finally
      CloseHandle(Snapshot)
    end;
end;

procedure TForm11.FormCreate(Sender: TObject);
begin
  EnumProcesses(ListBox1.Items);
end;

Result (32 bit sample app on Win64 where Explorer is 64 bit app):

Answer 2

There are no Win32 functions that let you do that from inside the 32 bit emulator (WOW64). You should execute your code in a 64 bit process. Nope, that's not true. Denis proves me wrong. The function you need is QueryFullProcessImageName.

Alternatively you can use WMI. Specifically Win32_Process. Some sample code here: http://theroadtodelphi.wordpress.com/2011/11/06

Borrowing from @RRUZ's example code, here's a short program that prints the PID and executable name for the running processes that can be enumerated using WMI.

{$APPTYPE CONSOLE}

uses
  Variants, ComObj, ActiveX;

const
  wbemFlagForwardOnly = $00000020;
var
  FSWbemLocator : OLEVariant;
  FWMIService   : OLEVariant;
  FWbemObjectSet: OLEVariant;
  FWbemObject   : OLEVariant;
  oEnum         : IEnumVariant;
  iValue        : LongWord;
begin
  CoInitialize(nil);
  FSWbemLocator := CreateOleObject('WbemScripting.SWbemLocator');
  FWMIService := FSWbemLocator.ConnectServer('localhost', 'root\CIMV2', '', '');
  FWbemObjectSet:= FWMIService.ExecQuery('SELECT ExecutablePath, ProcessId FROM Win32_Process','WQL',wbemFlagForwardOnly);
  oEnum := IUnknown(FWbemObjectSet._NewEnum) as IEnumVariant;
  while oEnum.Next(1, FWbemObject, iValue) = 0 do
  begin
    if not VarIsNull(FWbemObject.ExecutablePath) then
      Writeln(string(FWbemObject.ProcessId) + ': ' + string(FWbemObject.ExecutablePath));
    FWbemObject:=Unassigned; //avoid memory leak in oEnum.Next
  end;
end.

Answer 3

Seems that it doesn't matter the language, so in C# you could use WMI to get the processes (including 64 bit).

using System.Management;

var wmiQueryString = "SELECT ProcessId, ExecutablePath, CommandLine FROM Win32_Process";
using (var searcher = new ManagementObjectSearcher(wmiQueryString))
using (var results = searcher.Get())
{
    var query = results.Cast<ManagementObject>();
    foreach (var obj in query)
    {
        var filePath = obj.GetPropertyValue("ExecutablePath").Dump();   
    } 
}

You will have to reference System.Management.dll