eprocess Fetch Process full path (XP)

Previous article take the path under XP too troublesome

Since it is stipulated in the XP system, why not hard-coded it.

All right, walk up ~ ~ ~

Pfile_object __declspec (naked) __stdcall _mmgetfileobjectforsection (PVOID section)
{
    __asm
	{
		push EBP;
		mov  EBP, esp;
		MOV  eax, DWORD ptr SS:[EBP + 0x08];
		MOV  eax, DWORD ptr ds:[eax + 0x14];
		MOV  eax, DWORD ptr ds:[eax];
		MOV  eax, DWORD ptr ds:[eax + 0x24];
		MOV  ESP, EBP;
		Pop  EBP;
		RET  0x04;
	}
}

NTSTATUS Psreferenceprocessfilepointer (in Peprocess Process, out PVOID *outfileobject)
{
	PVOID Sectionobject;

	if (sectionobject = * (pvoid*) ((PCHAR) Process + 0x138))
	{
		pfile_object fileobject;

		FileObject = _mmgetfileobjectforsection (sectionobject);
		*outfileobject = FileObject;
		Obreferenceobject (fileobject);
		return status_success;
	}
	return status_unsuccessful;
}

wrk+dbg