Method TryGetNtImageName

TranslucentTB/windows/window.cpp:9–48

#include "win32.hpp"

std::optional<std::filesystem::path> Window::TryGetNtImageName(DWORD pid)
{
	static const auto NtQuerySystemInformation = []() noexcept -> PFN_NT_QUERY_SYSTEM_INFORMATION
	{
		const auto ntdll = GetModuleHandle(L"ntdll.dll");
		return ntdll ? reinterpret_cast<PFN_NT_QUERY_SYSTEM_INFORMATION>(GetProcAddress(ntdll, "NtQuerySystemInformation")) : nullptr;
	}();

	if (NtQuerySystemInformation)
	{
		SYSTEM_PROCESS_ID_INFORMATION pidInfo = {
#pragma warning(suppress: 4312) // intentional, the structure uses a pointer to store PIDs
			.ProcessId = reinterpret_cast<PVOID>(pid)
		};

		if (NtQuerySystemInformation(static_cast<SYSTEM_INFORMATION_CLASS>(SystemProcessIdInformation), &pidInfo, sizeof(pidInfo), nullptr) == STATUS_INFO_LENGTH_MISMATCH_UNDOC)
		{
			std::wstring buf;
			buf.resize_and_overwrite(pidInfo.ImageName.MaximumLength / 2, [&pidInfo](wchar_t* data, std::size_t count)
			{
				pidInfo.ImageName.Buffer = data;
				pidInfo.ImageName.MaximumLength = static_cast<USHORT>(count + 1) * 2;

				// hopefully the process didn't die midway through this lol
				if (NT_SUCCESS(NtQuerySystemInformation(static_cast<SYSTEM_INFORMATION_CLASS>(SystemProcessIdInformation), &pidInfo, sizeof(pidInfo), nullptr)))
				{
					return pidInfo.ImageName.Length / 2;
				}
				else
				{
					return 0;
				}
			});

			if (!buf.empty())
			{
				return std::move(buf);
			}
		}
	}

	return std::nullopt;
}