Question

I am trying to get process path by pid but I’m getting Win32Exception (access id denied).

The code looks like this:

string path = Process.GetProcessById(pid).MainModule.FileName

I have tried using OpenProcess with GetModuleFileNameEx but OpenProcess is returning 0. I even tried enabling SeDebugPrivilege according to C# – How to enable SeDebugPrivilege but it didn’t help.

The above code works for most of the processes but throws error for SynTPHelper.exe (Synaptics Pointing Device Helper) The application is running under the same username as my code. Both, my application and the process run in 64 bit.

Is it possible to retrieve the path without running my application as an administrator?

Edit

Task Manager is able to ‘open file location’ even though I’m not running it as an administrator.

Answer 1

Finally I managed to solve it. As it turned out there is new function in Vista and above for getting process path and new process access (PROCESS_QUERY_LIMITED_INFORMATION):

QueryFullProcessImageName

Here is the code that works from non-elevated process:

    private static string GetExecutablePathAboveVista(UIntPtr dwProcessId)
    {
        StringBuilder buffer = new StringBuilder(1024);
        IntPtr hprocess = OpenProcess(ProcessAccessFlags.PROCESS_QUERY_LIMITED_INFORMATION, false, dwProcessId);
        if (hprocess != IntPtr.Zero)
        {
            try
            {
                int size = buffer.Capacity;
                if (QueryFullProcessImageName(hprocess, 0, buff, out size))
                {
                    return buffer.ToString();
                }
            }
            finally
            {
                CloseHandle(hprocess);
            }
        }
        return string.Empty;
    }