@rtype: int @return: Filename of the process main module. This method does it's best to retrieve the filename. However sometimes this is not possible, so C{None} may be returned instead.
(self)
| 934 | return self.get_peb().ImageBaseAddress |
| 935 | |
| 936 | def get_image_name(self): |
| 937 | """ |
| 938 | @rtype: int |
| 939 | @return: Filename of the process main module. |
| 940 | |
| 941 | This method does it's best to retrieve the filename. |
| 942 | However sometimes this is not possible, so C{None} may |
| 943 | be returned instead. |
| 944 | """ |
| 945 | |
| 946 | # Method 1: Module.fileName |
| 947 | # It's cached if the filename was already found by the other methods, |
| 948 | # if it came with the corresponding debug event, or it was found by the |
| 949 | # toolhelp API. |
| 950 | mainModule = None |
| 951 | try: |
| 952 | mainModule = self.get_main_module() |
| 953 | name = mainModule.fileName |
| 954 | if not name: |
| 955 | name = None |
| 956 | except (KeyError, AttributeError, WindowsError): |
| 957 | ## traceback.print_exc() # XXX DEBUG |
| 958 | name = None |
| 959 | |
| 960 | # Method 2: QueryFullProcessImageName() |
| 961 | # Not implemented until Windows Vista. |
| 962 | if not name: |
| 963 | try: |
| 964 | hProcess = self.get_handle(win32.PROCESS_QUERY_LIMITED_INFORMATION) |
| 965 | name = win32.QueryFullProcessImageName(hProcess) |
| 966 | except (AttributeError, WindowsError): |
| 967 | ## traceback.print_exc() # XXX DEBUG |
| 968 | name = None |
| 969 | |
| 970 | # Method 3: GetProcessImageFileName() |
| 971 | # |
| 972 | # Not implemented until Windows XP. |
| 973 | # For more info see: |
| 974 | # https://voidnish.wordpress.com/2005/06/20/getprocessimagefilenamequerydosdevice-trivia/ |
| 975 | if not name: |
| 976 | try: |
| 977 | hProcess = self.get_handle(win32.PROCESS_QUERY_INFORMATION) |
| 978 | name = win32.GetProcessImageFileName(hProcess) |
| 979 | if name: |
| 980 | name = PathOperations.native_to_win32_pathname(name) |
| 981 | else: |
| 982 | name = None |
| 983 | except (AttributeError, WindowsError): |
| 984 | ## traceback.print_exc() # XXX DEBUG |
| 985 | if not name: |
| 986 | name = None |
| 987 | |
| 988 | # Method 4: GetModuleFileNameEx() |
| 989 | # Not implemented until Windows 2000. |
| 990 | # |
| 991 | # May be spoofed by malware, since this information resides |
| 992 | # in usermode space (see http://www.ragestorm.net/blogs/?p=163). |
| 993 | if not name: |
no test coverage detected