Retrieve the full image file name for a process. @param ProcessId - The process to get the name of. @param ProcessImageFileName - PUNICODE_STRING to fill with the image file name of the process. */
| 432 | @param ProcessImageFileName - PUNICODE_STRING to fill with the image file name of the process. |
| 433 | */ |
| 434 | BOOLEAN |
| 435 | ImageHistoryFilter::GetProcessImageFileName ( |
| 436 | _In_ HANDLE ProcessId, |
| 437 | _Inout_ PUNICODE_STRING* ImageFileName |
| 438 | ) |
| 439 | { |
| 440 | NTSTATUS status; |
| 441 | PEPROCESS processObject; |
| 442 | HANDLE processHandle; |
| 443 | ULONG returnLength; |
| 444 | |
| 445 | processHandle = NULL; |
| 446 | *ImageFileName = NULL; |
| 447 | returnLength = 0; |
| 448 | |
| 449 | // |
| 450 | // Before we can open a handle to the process, we need its PEPROCESS object. |
| 451 | // |
| 452 | status = PsLookupProcessByProcessId(ProcessId, &processObject); |
| 453 | if (NT_SUCCESS(status) == FALSE) |
| 454 | { |
| 455 | DBGPRINT("ImageHistoryFilter!GetProcessImageFileName: Failed to find process object with status 0x%X.", status); |
| 456 | goto Exit; |
| 457 | } |
| 458 | |
| 459 | // |
| 460 | // Open a handle to the process. |
| 461 | // |
| 462 | status = ObOpenObjectByPointer(processObject, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, GENERIC_ALL, *PsProcessType, KernelMode, &processHandle); |
| 463 | if (NT_SUCCESS(status) == FALSE) |
| 464 | { |
| 465 | DBGPRINT("ImageHistoryFilter!GetProcessImageFileName: Failed to open handle to process with status 0x%X.", status); |
| 466 | goto Exit; |
| 467 | } |
| 468 | |
| 469 | // |
| 470 | // Query for the size of the UNICODE_STRING. |
| 471 | // |
| 472 | status = NtQueryInformationProcess(processHandle, ProcessImageFileName, NULL, 0, &returnLength); |
| 473 | if (status != STATUS_INFO_LENGTH_MISMATCH && status != STATUS_BUFFER_TOO_SMALL && status != STATUS_BUFFER_OVERFLOW) |
| 474 | { |
| 475 | DBGPRINT("ImageHistoryFilter!GetProcessImageFileName: Failed to query size of process ImageFileName with status 0x%X.", status); |
| 476 | goto Exit; |
| 477 | } |
| 478 | |
| 479 | // |
| 480 | // Allocate the necessary space. |
| 481 | // |
| 482 | *ImageFileName = RCAST<PUNICODE_STRING>(ExAllocatePoolWithTag(PagedPool, returnLength, IMAGE_NAME_TAG)); |
| 483 | if (*ImageFileName == NULL) |
| 484 | { |
| 485 | DBGPRINT("ImageHistoryFilter!GetProcessImageFileName: Failed to allocate space for process ImageFileName."); |
| 486 | goto Exit; |
| 487 | } |
| 488 | |
| 489 | // |
| 490 | // Query the image file name. |
| 491 | // |
nothing calls this directly
no test coverage detected