_WinAPI_ProcessGetFileName

[Ascend4nt]

I see where you mention it in the Help file, but I always took those 'maximums' to mean how much data is passed to the function, not what is received. I guess maybe I should query the developers on this to see if its possible for them to clarify if they intended it both ways

thanks

[rajeshontheweb]

great one, i have been looking for a code on this one, thanks mate. i have lately been facing a few virus dll files which are hooked on to variousthreads.

i had plans to analyse my network PCs for all running threads and check them against the database of dll file info i had in hand. of course its not gonna be a proper antivirus but it is very effective for me because when one pc is infected there is too many a chance it gets spread into the clients on same network...

[Ascend4nt]

Thanks rajeshontheweb. Be sure to set elevated privileges to get all information correctly.

Also, if you want info on DLL's and whatnot, I suggest you take a look at Manko's awesome ModuleHelper.

[trancexx]

I see where you mention it in the Help file, but I always took those 'maximums' to mean how much data is passed to the function, not what is received. I guess maybe I should query the developers on this to see if its possible for them to clarify if they intended it both ways

thanks

And? What was the response from Gods of Olympus?

[Ascend4nt]

And? What was the response from Gods of Olympus?

Don't particularly care for your sarcasm, but the response was nothing as you can see here. I don't know if they accept PM's but I'd rather not annoy people who are probably already overloaded with PM's as it is. Haven't seen many people using it the way you describe though, and the code works, so its not really on the top of my agenda to change it to please one person.

[trancexx]

Don't particularly care for your sarcasm, but the response was nothing as you can see here. I don't know if they accept PM's but I'd rather not annoy people who are probably already overloaded with PM's as it is. Haven't seen many people using it the way you describe though, and the code works, so its not really on the top of my agenda to change it to please one person.

You have very strange conjunction in your first sentence here.

I just wanted to know if you asked, but I see I'm touching the wiring (see this conjunction).

[sandin]

ok, my intention is to use your UDF in my script, but I get @error: 2 for your _WinAPI_ProcessGetPathname function and this is the result: LINK

I added consolewrite line:

$aPathList[$i-1][2]=_WinAPI_ProcessGetPathname($aProcessList[$i][1])
if @error then ConsoleWrite(@error & @LF)

and got bunch of twos (2) for every process

edit: My OS: WinXP, SP3

Edited March 18, 2009 by sandin

[Ascend4nt]

Thanks sandin for the info. I changed things in the function slightly to give better @error return info, plus I made a note about WinXP/2003 requirement for using the function (I missed this the first time I had created this function - so you'll either have to check for XP or 2003 1st, or just check for an x64 OS being active - otherwise you can use the smaller simpler _WinAPI_ProcessGetFileName)

Anyway, do me a favor, run this version, and change the one line to be two:

$aPathList[$i-1][2]=_WinAPI_ProcessGetPathname($aProcessList[$i][1])
ConsoleWrite("Error on exit from _WinAPI_ProcessGetPathname("&$aProcessList[$i][0]&"):"&@error&@CRLF)

Let me know what the @error code is.. probably 3 or 4 now..

btw, I've tested on 2 versions of XP and Vista - I wonder if there really is an issue with the location of Psapi.dll? I thought DllCall searches the Windows and System32 folders by default for DLL's..

Do you perhaps have more than one version of Psapi.dll? Maybe I need to add location checks for this hmm..

thx for your help, much appreciated.

Ascend4nt

[sandin]

this is what I've got:

expandcollapse popup

Error on exit from _WinAPI_ProcessGetPathname([System Process]):3
Error on exit from _WinAPI_ProcessGetPathname(System):2
Error on exit from _WinAPI_ProcessGetPathname(smss.exe):2
Error on exit from _WinAPI_ProcessGetPathname(csrss.exe):2
Error on exit from _WinAPI_ProcessGetPathname(winlogon.exe):2
Error on exit from _WinAPI_ProcessGetPathname(services.exe):2
Error on exit from _WinAPI_ProcessGetPathname(lsass.exe):2
Error on exit from _WinAPI_ProcessGetPathname(svchost.exe):2
Error on exit from _WinAPI_ProcessGetPathname(svchost.exe):2
Error on exit from _WinAPI_ProcessGetPathname(svchost.exe):2
Error on exit from _WinAPI_ProcessGetPathname(svchost.exe):2
Error on exit from _WinAPI_ProcessGetPathname(svchost.exe):2
Error on exit from _WinAPI_ProcessGetPathname(LEXBCES.EXE):2
Error on exit from _WinAPI_ProcessGetPathname(spoolsv.exe):2
Error on exit from _WinAPI_ProcessGetPathname(LEXPPS.EXE):2
Error on exit from _WinAPI_ProcessGetPathname(explorer.exe):2
Error on exit from _WinAPI_ProcessGetPathname(DTVSchdl.exe):2
Error on exit from _WinAPI_ProcessGetPathname(CtHelper.exe):2
Error on exit from _WinAPI_ProcessGetPathname(egui.exe):2
Error on exit from _WinAPI_ProcessGetPathname(fppdis3a.exe):2
Error on exit from _WinAPI_ProcessGetPathname(ctfmon.exe):2
Error on exit from _WinAPI_ProcessGetPathname(TBPANEL.exe):2
Error on exit from _WinAPI_ProcessGetPathname(WFWIZ.exe):2
Error on exit from _WinAPI_ProcessGetPathname(msnmsgr.exe):2
Error on exit from _WinAPI_ProcessGetPathname(uTorrent.exe):2
Error on exit from _WinAPI_ProcessGetPathname(daemon.exe):2
Error on exit from _WinAPI_ProcessGetPathname(SetPoint.exe):2
Error on exit from _WinAPI_ProcessGetPathname(KHALMNPR.exe):2
Error on exit from _WinAPI_ProcessGetPathname(ekrn.exe):2
Error on exit from _WinAPI_ProcessGetPathname(MDM.EXE):2
Error on exit from _WinAPI_ProcessGetPathname(nvsvc32.exe):2
Error on exit from _WinAPI_ProcessGetPathname(svchost.exe):2
Error on exit from _WinAPI_ProcessGetPathname(ULCDRSvr.exe):2
Error on exit from _WinAPI_ProcessGetPathname(wdfmgr.exe):2
Error on exit from _WinAPI_ProcessGetPathname(alg.exe):2
Error on exit from _WinAPI_ProcessGetPathname(svchost.exe):2
Error on exit from _WinAPI_ProcessGetPathname(WFTV.exe):2
Error on exit from _WinAPI_ProcessGetPathname(firefox.exe):2
Error on exit from _WinAPI_ProcessGetPathname(SciTE.exe):2
Error on exit from _WinAPI_ProcessGetPathname(AutoIt3Wrapper.exe):2
Error on exit from _WinAPI_ProcessGetPathname(AutoIt3.exe):2
Error on exit from _WinAPI_ProcessGetPathname(AutoIt3Wrapper.exe):2

my psapi.dll is located where it should be:

c:\WINDOWS\system32\psapi.dll

I have 2 more, but irrelevant:

c:\WINDOWS\ServicePackFiles\i386\psapi.dll
c:\WINDOWS\$NtServicePackUninstall$\psapi.dll

also, my psapi.dll file version is: 5.1.2600.3311 (xpsp.080212-0004)

Edited March 18, 2009 by sandin

[Ascend4nt]

Okay, it looks like its most likely the 2nd DLLCall, I should have provided the DLLCall's error info. You can insert this line after the @error checks on the PSAPI call, like this if you want to continue being experiment on by me lol:

If @error Then
        $tErr=2
    ElseIf Not $aRet[0] Then
        $tErr=4
    Else
        $tErr=0
    EndIf
    ConsoleWrite("DLLCall error report for GetProcessImageFileNameW, PID #"&$vProcessID&":"&@error&@CRLF)

[sandin]

ok, the result is:

expandcollapse popup

DLLCall error report for GetProcessImageFileNameW, PID #4:3
DLLCall error report for GetProcessImageFileNameW, PID #636:3
DLLCall error report for GetProcessImageFileNameW, PID #692:3
DLLCall error report for GetProcessImageFileNameW, PID #716:3
DLLCall error report for GetProcessImageFileNameW, PID #760:3
DLLCall error report for GetProcessImageFileNameW, PID #772:3
DLLCall error report for GetProcessImageFileNameW, PID #944:3
DLLCall error report for GetProcessImageFileNameW, PID #1012:3
DLLCall error report for GetProcessImageFileNameW, PID #1108:3
DLLCall error report for GetProcessImageFileNameW, PID #1184:3
DLLCall error report for GetProcessImageFileNameW, PID #1272:3
DLLCall error report for GetProcessImageFileNameW, PID #1324:3
DLLCall error report for GetProcessImageFileNameW, PID #1352:3
DLLCall error report for GetProcessImageFileNameW, PID #1376:3
DLLCall error report for GetProcessImageFileNameW, PID #1748:3
DLLCall error report for GetProcessImageFileNameW, PID #1876:3
DLLCall error report for GetProcessImageFileNameW, PID #1904:3
DLLCall error report for GetProcessImageFileNameW, PID #1920:3
DLLCall error report for GetProcessImageFileNameW, PID #1944:3
DLLCall error report for GetProcessImageFileNameW, PID #1952:3
DLLCall error report for GetProcessImageFileNameW, PID #1960:3
DLLCall error report for GetProcessImageFileNameW, PID #1968:3
DLLCall error report for GetProcessImageFileNameW, PID #1976:3
DLLCall error report for GetProcessImageFileNameW, PID #1984:3
DLLCall error report for GetProcessImageFileNameW, PID #1992:3
DLLCall error report for GetProcessImageFileNameW, PID #268:3
DLLCall error report for GetProcessImageFileNameW, PID #576:3
DLLCall error report for GetProcessImageFileNameW, PID #1672:3
DLLCall error report for GetProcessImageFileNameW, PID #1720:3
DLLCall error report for GetProcessImageFileNameW, PID #1728:3
DLLCall error report for GetProcessImageFileNameW, PID #1772:3
DLLCall error report for GetProcessImageFileNameW, PID #184:3
DLLCall error report for GetProcessImageFileNameW, PID #200:3
DLLCall error report for GetProcessImageFileNameW, PID #2396:3
DLLCall error report for GetProcessImageFileNameW, PID #3128:3
DLLCall error report for GetProcessImageFileNameW, PID #620:3
DLLCall error report for GetProcessImageFileNameW, PID #2716:3
DLLCall error report for GetProcessImageFileNameW, PID #2576:3
DLLCall error report for GetProcessImageFileNameW, PID #2772:3
DLLCall error report for GetProcessImageFileNameW, PID #2268:3
DLLCall error report for GetProcessImageFileNameW, PID #3272:3

[Ascend4nt]

Odd. DllCall's documentation says "@error = 3 "function" not found in the DLL file."

Can you verify that the psapi.dll that you have has this function (GetProcessImageFileNameW)? You can use DLL Export Viewer to check each psapi.dll you have (if you don't mind - I know I must be driving you nuts with this) - check that that function name exists with/without the 'W' at the end, and if there are any differences in case (like if 'N' in 'FileName' is actually lowercase).

Anyway, your help is much appreciated. If this function truly doesn't exist in your DLL I'd really be curious as to why - unless for some freak reason the wrong psapi.dll is being loaded (a windows 2000 version wouldn't have this function for example)

Edited March 18, 2009 by ascendant

[sandin]

just tested all of my psapi.dll files, and I have functions:

GetProcessImageFileNameW
GetProcessImageFileNameA

EDIT: It worked once I set psapi's destination as:

@SystemDir & "\Psapi.dll"

I missed psapi.dll, there was one in AutoIt folder (which is not the folder I keep my scripts), and that was strange, so calling dll without full destination can be done from installed AutoIt folder, script's folder and system32 folder?

tnx for your help

Edited March 18, 2009 by sandin

[Ascend4nt]

Ahh, good I'm glad we tracked down what it was. Hmm.. I wonder why you would have had a psapi.dll in your AutoIT folder. But that is interesting that it checks not only the script folder and Window's system32 folder, but the one where the AutoIt interpreter is as well! I wouldn't have guessed.

Makes me think that perhaps all my code that relies on psapi.dll functions need to specify a destination if there's a chance there are multiple versions scattered across a user's computer...

[sandin]

ya, thank you for support

Actually I have no idea how did psapi.dll get there, maybe it got stuck from previous versions of autoit (if any of them contained psapi.dll), though I remember I installed latest version with uninstalling previous first.

(that's why I scanned only Windows, and my scripts dir, and I missed the one in AutoIt folder, which I checked, doesn't contain GetProcessImageFileName function)