Obtain the path of the system process in NT

Program description

A custom function is used to grant the specified permissions to the process. In this example, SE_DEBUG_NAME ):

BOOL EnablePrivilege (HANDLE hToken, LPCSTR szPrivName)
{
TOKEN_PRIVILEGES tkp;
LookupPrivilegeValue (NULL, szPrivName, & tkp. Privileges [0]. Luid); // modify process Permissions
Tkp. PrivilegeCount = 1;
Tkp. Privileges [0]. Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges (hToken, FALSE, & tkp, sizeof tkp, NULL, NULL); // notifies the system of modifying process Permissions
Return (GetLastError () = ERROR_SUCCESS ));
}

Use the OpenProcessToken function to obtain the access token handle of the process in this example. Then, call this function to open the path of the target process as in the original text. We can see that this method has successfully obtained the system process.Csrss.exe.

Practice

/*
* ShowProcessPath 2.0
* Copyright (C) 2005 Zhao Chunsheng
* 2005.09.02
* Http://timw.yeah.net
* Http://timw.126.com
* This program applies to: WinNT
* The Code passed the test on Win2000P + SP4 + VC6 + SP6
*/

# Include <stdio. h>
# Include <windows. h>
# Include "PSAPI. H"
# Pragma comment (lib, "PSAPI. LIB ")

// User-Defined Function: grant the specified privilege. It is used to enhance the program permission.
BOOL EnablePrivilege (HANDLE hToken, LPCSTR szPrivName );

Int main (void)
{
DWORD processid [1024], needed, processcount, I;
HANDLE hProcess;
HMODULE hModule;
Char path [MAX_PATH] = "", temp [256];
HANDLE hToken;
Printf ("ShowProcessPath 2.0 with [Process Status API] \ n ");
If (OpenProcessToken (GetCurrentProcess (), TOKEN_ADJUST_PRIVILEGES, & hToken ))
{
If (EnablePrivilege (hToken, SE_DEBUG_NAME ))
{
EnumProcesses (processid, sizeof (processid), & needed );
Processcount = needed/sizeof (DWORD );
For (I = 0; I <processcount; I ++)
{
HProcess = OpenProcess (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, processid [I]);
If (hProcess)
{
EnumProcessModules (hProcess, & hModule, sizeof (hModule), & needed );
GetModuleFileNameEx (hProcess, hModule, path, sizeof (path ));
Getmediapathname (path, path, 256 );
Itoa (processid [I], temp, 10 );
Printf ("% s --- % s \ n", path, temp );
}
Else
Printf ("Failed !!! \ N ");
}
}
}
CloseHandle (hProcess );
CloseHandle (hModule );
Itoa (processcount, temp, 10 );
Printf ("\ nProcess Count: % s \ n", temp );
Return 0;
}

BOOL EnablePrivilege (HANDLE hToken, LPCSTR szPrivName)
{
TOKEN_PRIVILEGES tkp;
LookupPrivilegeValue (NULL, szPrivName, & tkp. Privileges [0]. Luid); // modify process Permissions
Tkp. PrivilegeCount = 1;
Tkp. Privileges [0]. Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges (hToken, FALSE, & tkp, sizeof tkp, NULL, NULL); // notifies the system of modifying process Permissions
Return (GetLastError () = ERROR_SUCCESS ));
}

The above code is successfully tested in Win2000P + SP4 + VC6 + SP6.