'获取进程文件（带文件夹）
'GetProFile(进程ID) as String '
'可以用 AfxGetPathFromWindowHandle(窗口号) 或取，
Declare Function ZwQueryInformationProcess  Lib  "Ntdll.dll" Alias "ZwQueryInformationProcess" (ByVal ProcessHandle as UInteger  ,ByVal ProcessInformationClass as UInteger, ByVal ProcessInformation as UInteger,ByVal ProcessInformationLength as UInteger, ByRef ReturnLength as UInteger) as Integer   
       
Function GetProFile(ByVal hProcess as ULong) as String '
   Dim a as String
   If hProcess = 0 Then Exit Function
   a = GetProcessPathByProcessID(hProcess)
   If Len(a) = 0 Then
      a = GetProcessPathByProcessID2(hProcess)
   End If
   '此虽然好，但获取的盘符，是数字的，要转换时，遇到有USB盘和虚拟盘时会发生错位，所以，只有读不到时，才使用，读不到的一般在C盘，所以很少可能会出错
   Function = a
End Function
Function GetProcessPathByProcessID(pid as ULong) as String  '取进程程序，是梦工厂做的，还行，效率普通
   Dim cbNeeded as Long
   Dim szBuf(1 To 250) as UInteger
   Dim ret as WINBOOL
   Dim szPathName as ZString * 512
   Dim nSize as Long
   Dim hProcess as HANDLE
   hProcess = OpenProcess(&H400 Or &H10, 0, pid)
   If hProcess <> 0 Then
      ret = EnumProcessModules(hProcess, @szBuf(1), 250, @cbNeeded)
      If ret <> 0 Then
         nSize = 512
         ret = GetModuleFileNameExA(hProcess, szBuf(1), @szPathName, nSize)
         Function = szPathName
      End If
   End If
   ret = CloseHandle(hProcess)
   
   
End Function
Function GetProcessPathByProcessID2(ByVal hProcess as ULong) as String '效率级高，又能获取系统的和被保护的
   
   Dim I as Long, St as Long, L as Long
   
   Dim a as String, pid as HANDLE
   
   pid = OpenProcess(&H1F0FFF, False, hProcess)
   If pid <> 0 Then
      St = ZwQueryInformationProcess(pid, 27, 0, 0, L)
      
      If St = &HC0000004 Then
         a = String(L, Chr(0))
         St = ZwQueryInformationProcess(pid, 27, StrPtr(a), L, 0)
         If St = 0 Then
            a = wStrToStr(StrPtr(a), L)
            I = InStr(a, "\Device")
            If I > 0 Then a = Mid(a, I)
            I = Val(Mid(a, 23, 1))
            a = FF_Replace(a, "\Device\HarddiskVolume" & I, Chr(66 + I) & ":")
            Function = a
         End If
      End If
      
      CloseHandle pid
   End If
   
   
End Function
