ProcessImageFileNameWin32

---

Result
       X:\xxx.exe
Note
       The calling application must free the memory call free function
Minimum supported client
       Windows Vista

NTSTATUS GetProcessPath(    IN  HANDLE          UniqueProcessId,    OUT PUNICODE_STRING*    ProcessPath ){    NTSTATUS Status = STATUS_SUCCESS;    PVOID Buffer = NULL;    HANDLE hProcess = NULL;    ULONG NeedSize = 0;    CLIENT_ID ci = { 0 };    OBJECT_ATTRIBUTES oa = { 0 };    ci.UniqueProcess = UniqueProcessId;    oa.Length = sizeof( oa );    Status = NtOpenProcess( &hProcess, PROCESS_QUERY_LIMITED_INFORMATION, &oa, &ci );    if ( ! hProcess )        return Status;    Status = NtQueryInformationProcess( hProcess, ProcessImageFileNameWin32, NULL, 0, &NeedSize );    if ( ! NeedSize )        return Status;    Buffer = malloc( NeedSize );    memset( Buffer, 0, NeedSize );    Status = NtQueryInformationProcess( hProcess, ProcessImageFileNameWin32, Buffer, NeedSize, NULL );    CloseHandle( hProcess );    *ProcessPath = ( PUNICODE_STRING )Buffer;    return Status;}