Public Function getprocesspath (byval dwprocessid as long) as string
Dim ntstatus as long
Dim objbasic as process_basic_information
Dim objflink as long
Dim objpeb as long, objldr as long
Dim objbaseaddress as long
Dim bytname (260*2-1) as byte
Dim strmodulename as string, objname as long
Dim objcid as client_id
Dim objoa as object_attributes
Dim I as integer
Dim hprocess as long
Objoa. Length = Len (objoa)
Objcid. uniqueprocess = dwprocessid
Ntstatus = ntopenprocess (hprocess, process_query_information or process_vm_read, objoa, objcid)
If hprocess = 0 then
Hprocess = gethandlebyprocessid (dwprocessid)
If hprocess = 0 then
Getprocesspath = ""
Exit Function
End if
End if
Dim lngret as long, lngreturn as long
Ntstatus = ntqueryinformationprocess (hprocess, processbasicinformation, varptr (objbasic), Len (objbasic), byval 0 &)
If (nt_success (ntstatus) then
Objpeb = objbasic. pebbaseaddress
Lngret = readprocessmemory (hprocess, byval objpeb + & HC, objldr, 4, byval 0 &)
Lngret = readprocessmemory (hprocess, byval objldr + & HC, objflink, 4, byval 0 &)
Lngret = readprocessmemory (hprocess, byval objflink + & H18, objbaseaddress, 4, byval 0 &)
If objbaseaddress> 0 then
Lngret = readprocessmemory (hprocess, byval objflink + & H28, objname, 4, byval 0 &)
Lngret = readprocessmemory (hprocess, byval objname, bytname (0), 260*2, byval 0 &)
If error_partial_copy = lngret then
Start:
I = I + 1
If error_partial_copy = readprocessmemory (hprocess, byval objname, bytname (0), 260*2-I, byval 0 &) then
Goto start
End if
End if
Strmodulename = bytname
Strmodulename = left (strmodulename & CHR (0), instr (strmodulename & CHR (0), CHR (0)-1)
Getprocesspath = strmodulename
End if
End if
Ntclose hprocess
End Function
Here, objbaseaddress. This is what you want.