Hello all,
I am trying to get the executable name in a pre op ObRegisterCallback. Getting the PID is no problem but can’t figure out how to get the fully qualified path of executable. Is it possible to get the process executable fully qualified path name from a PID?
Thank you,
Peter
You have a process pointer in the object callback. So you can use PsReferenceProcessFilePointer to get a file object pointer for a process image file and query the file object path in a usual way.
I believe that a more common approach is to register a process creation and termination notification callback where an image file object is provided in PS_CREATE_NOTIFY_INFO and manage a simple map of PID to file name.