CODEWITHSUNDEEP
c#winapi
Tsury
Tsury

Reputation: 739

Find the assembly name of a process who's file has been renamed

I have a file, MyProcess.exe. I run it, and then while it is still running, rename it to old_MyProcess.exe.

I'm going over all of the process with the MyProcess.exe name, find it but process.Modules[0].FileName returns MyProcess.exe and not old_MyProcess.

I noticed that in Task Manager, if you add the 'Image path name' column you can see the old_MyProcess.exe, but both the win32 calls GetModuleFileNameEx and GetImagePathName returned MyProcess.exe.

Upvotes: 3

Views: 296

Answers (1)

Hans Passant
Hans Passant

Reputation: 941545

Poking around Taskmgr.exe with Dumpbin.exe /imports to see what winapi functions it uses, I see a good match in QueryFullProcessImageName(). Windows v6.0 and up required (Vista or later).

Turns out that guess was correct :)

Upvotes: 3

Related Questions