CODEWITHSUNDEEP
delphiwinapidelphi-7
user1979304
user1979304

Reputation: 91

GetModuleFileNameEx of Thread ID?

I am trying to get the file path of a thread id. I was hoping that this will work..but it doesn't

NtOpenThread(@hProc, THREAD_ALL_ACCESS, @ObjAttr, @ClientID) ;
        pBuf := AllocMem(MAX_PATH);
        GetModuleFileNameEx(hProc, 0, pBuf, MAX_PATH);

Any idea how it is done ?

Upvotes: 1

Views: 961

Answers (1)

Rob Kennedy
Rob Kennedy

Reputation: 163317

GetModuleFileNameEx requires a process handle, not a thread handle, which explains why your code doesn't work. There are two main ways to get a process handle. The first is from CreateProcess, but that's no good unless you're the one starting the process, and if you're doing that, you don't need GetModuleFileNameEx in the first place.

The second way to get a process handle is from OpenProcess. That requires a process ID. You can get a thread's process ID with GetProcessIdOfThread, which takes a thread handle. You already know how to get a thread handle from a thread ID with NtOpenThread, although the usual function is plain old OpenThread.

If your Windows version doesn't support GetProcessIdOfThread, you can go another route with Thread32First and Thread32Next. Call CreateToolhelp32Snapshot, and then walk the thread list. Look for an entry where th32ThreadID equals the thread ID you're interested in. When you find it, th32OwnerProcessID will hold the corresponding process ID. Call OpenProcess and proceed as above.

Also note that you should not have to request ALL_ACCESS permissions when opening threads or processes, and attempting to do so may cause your program to fail. Request only the minimum permissions you need to accomplish your task. Requesting all access is the lazy way when you don't know what you need, but it will only work when your program already has administrative privileges. Instead, spend the time to figure out what permissions you really need.

Upvotes: 6

Related Questions