'    ' 获取进程工作目录
'Function Process_CurPath(进程ID as  Integer ) as String 
'32,64 互相兼容（32位可获取64位）
#Include Once "Inc/NtDef.bi"
    ' 获取进程工作目录
Function Process_CurPath(pid as Integer) as String
   Dim aa as Integer
   Dim sCmdLine as WString * MAX_PATH
   Dim hProcess as HANDLE = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, False, pid)
   If hProcess Then
      Dim Is64 as Integer
      If GetSys_Bits = 64 Then IsWow64Process(hProcess, @Is64) Else Is64 = 1
      If Len(aa) = 8 Or Len(aa) = 4 And Is64 <> 0 Then '自己是64 或 自己是32位目标也是32位的
         Dim pbi as PROCESS_BASIC_INFORMATION_32
         Dim peb as PROCESS_ENVIRONMENT_BLOCK_32
         Dim pps as PROCESS_PARAMETERS_32
         If NT_SUCCESS(NtQueryInformationProcess(hProcess, ProcessBasicInformation, @pbi, SizeOf(pbi), 0)) Then
            If NT_SUCCESS(NtReadVirtualMemory(hProcess, pbi.PebBaseAddress, @peb, SizeOf(peb), 0)) Then
               If NT_SUCCESS(NtReadVirtualMemory(hProcess, peb.ProcessParameters, @pps, SizeOf(pps), 0)) Then
                  sCmdLine = String(pps.CurrentDirectory.DosPath.MaximumLength, 0)
                  If NT_SUCCESS(NtReadVirtualMemory(hProcess, pps.CurrentDirectory.DosPath.Buffer, @sCmdLine, pps.CurrentDirectory.DosPath.MaximumLength, Null)) Then
                     Function = sCmdLine ' wStrToStr(StrPtr(sCmdLine),pps.CurrentDirectory.DosPath.MaximumLength)
                  EndIf
               EndIf
            EndIf
         EndIf
      Else '自己是32位，目标是64位的
         Dim NtHdr as HANDLE = GetModuleHandle("ntdll")
         If NtHdr Then
            Dim NtWow64QueryInformationProcess64 as Function(ProcessHandle as HANDLE, ProcessInformationClass as UINT, ProcessInformation as PVOID, ProcessInformationLength as ULong, ReturnLength as PULONG) as Integer
            Dim NtWow64ReadVirtualMemory64 as Function(ProcessHandle as HANDLE, BaseAddress as ULongInt, Buffer as PVOID, NumberOfBytesToRead as UINT64, NumberOfBytesReaded as PUINT64) as Integer
            
            NtWow64QueryInformationProcess64 = Cast(Any Ptr, GetProcAddress(NtHdr, "NtWow64QueryInformationProcess64"))
            NtWow64ReadVirtualMemory64 = Cast(Any Ptr, GetProcAddress(NtHdr, "NtWow64ReadVirtualMemory64"))
            Dim pbi as PROCESS_BASIC_INFORMATION_64
            Dim peb as PROCESS_ENVIRONMENT_BLOCK_64
            Dim pps as PROCESS_PARAMETERS_64
            
            If NT_SUCCESS(NtWow64QueryInformationProcess64(hProcess, ProcessBasicInformation, @pbi, SizeOf(pbi), 0)) Then
               If NT_SUCCESS(NtWow64ReadVirtualMemory64(hProcess, pbi.PebBaseAddress, @peb, SizeOf(peb), 0)) Then
                  If NT_SUCCESS(NtWow64ReadVirtualMemory64(hProcess, peb.ProcessParameters, @pps, SizeOf(pps), Null)) Then
                     sCmdLine = String(pps.CurrentDirectory.DosPath.MaximumLength, 0)
                     If NT_SUCCESS(NtWow64ReadVirtualMemory64(hProcess, pps.CurrentDirectory.DosPath.Buffer, @sCmdLine, pps.CurrentDirectory.DosPath.MaximumLength, Null)) Then
                        Function = sCmdLine ' wStrToStr(StrPtr(sCmdLine), pps.CurrentDirectory.DosPath.MaximumLength)
                     EndIf
                  EndIf
               EndIf
            EndIf
         EndIf
      End If
      CloseHandle(hProcess)
   EndIf
   
End Function
