Answer the question
In order to leave comments, you need to log in
How to set privileges to read process memory (C++)?
You need to access the running process to find out from which directory it started.
DWORD PIDByName(WCHAR * AProcessName)
{
HANDLE pHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 ProcessEntry;
DWORD pid;
LPWSTR s=NULL;
string str;
TCHAR sttr[MAX_PATH];;
ProcessEntry.dwSize = sizeof(ProcessEntry);
bool Loop = Process32First(pHandle, &ProcessEntry);
while (Loop)
{
if (wcsstr(ProcessEntry.szExeFile, AProcessName))
{
pid = ProcessEntry.th32ProcessID;
CloseHandle(pHandle);
return pid;
}
Loop = Process32Next(pHandle, &ProcessEntry);
}
return 0;
}
With this function I get the pid of the process.if (processHandle != NULL) {
QueryFullProcessImageName(processHandle,0,ss,&pid);
GetProcessImageFileName(processHandle,ss,256);
if (GetModuleFileNameEx(processHandle, NULL, filename, sizeof(char)) == 0) {
cout << GetLastError();
cerr << "Failed to get module filename." << endl;
} else {
cout << "Module filename is: " << filename << endl;
}
CloseHandle(processHandle);
} else {
cerr << "Failed to open process." << endl;
}
here I want to extract the path using the QueryFullProcessImageName and GetProcessImageFileName functions, but it throws "Unhandled exception at 0x77DD2373 (ntdll.dll) in RLE.exe: 0xC0000005: Access violation while writing at 0x00000000." SetPrivilege(HANDLE hToken,LPCTSTR Privilege,BOOL bEnablePrivilege);
including #pragma comment(lib, "Advapi32.lib"). Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question