' 获取进程文件路径
'Function Process_GetPath(进程ID) as String
#Include Once "Inc/NtDef.bi"
' 获取进程文件路径
Function Process_GetPath(pid as Integer) as String
   Dim aa as Integer
   
   Dim hProcess as HANDLE = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, False, pid)
   If hProcess Then
      Dim Is64 as Integer
      If GetSys_Bits = 64 Then IsWow64Process(hProcess, Cast(Any Ptr, @Is64)) Else Is64 = 1
      If Len(aa) = 8 Or Len(aa) = 4 And Is64 <> 0 Then '自己是64 或 自己是32位目标也是32位的
         Dim FilePath as ZString * MAX_PATH
         GetModuleFileNameEx(hProcess, Null, @FilePath, MAX_PATH)
         Function = FilePath
      Else
         Dim NtHdr as HANDLE = GetModuleHandle("ntdll")
         If NtHdr Then
            Dim NtWow64QueryInformationProcess64 as Function(ProcessHandle as HANDLE, ProcessInformationClass as UINT, ProcessInformation as PVOID, ProcessInformationLength as ULong, ReturnLength as PULONG) as Integer
            Dim NtWow64ReadVirtualMemory64 as Function(ProcessHandle as HANDLE, BaseAddress as ULongInt, Buffer as PVOID, NumberOfBytesToRead as UINT64, NumberOfBytesReaded as PUINT64) as Integer
            NtWow64QueryInformationProcess64 = Cast(Any Ptr, GetProcAddress(NtHdr, "NtWow64QueryInformationProcess64"))
            NtWow64ReadVirtualMemory64 = Cast(Any Ptr, GetProcAddress(NtHdr, "NtWow64ReadVirtualMemory64"))
            Dim pbi as PROCESS_BASIC_INFORMATION_64
            Dim peb as PROCESS_ENVIRONMENT_BLOCK_64
            Dim pps as PROCESS_PARAMETERS_64
            Dim sCmdLine as WString * MAX_PATH
            If NT_SUCCESS(NtWow64QueryInformationProcess64(hProcess, ProcessBasicInformation, @pbi, SizeOf(pbi), 0)) Then
               If NT_SUCCESS(NtWow64ReadVirtualMemory64(hProcess, pbi.PebBaseAddress, @peb, SizeOf(peb), 0)) Then
                  If NT_SUCCESS(NtWow64ReadVirtualMemory64(hProcess, peb.ProcessParameters, @pps, SizeOf(pps), Null)) Then
                     'sCmdLine=String(pps.ImagePathName.MaximumLength,0)
                     If NT_SUCCESS(NtWow64ReadVirtualMemory64(hProcess, pps.ImagePathName.Buffer, @sCmdLine, pps.ImagePathName.MaximumLength, Null)) Then
                        Function = sCmdLine '  wStrToStr(Cast(WString Ptr, StrPtr(sCmdLine)), pps.ImagePathName.MaximumLength/2)
                     EndIf
                  EndIf
               EndIf
            EndIf
         EndIf
         
      EndIf
      CloseHandle(hProcess)
   EndIf
End Function