Prev: Working on a NE disassembler
Next: How detect Server 2008 Core?
From: Volodymyr Shcherbyna on 1 Feb 2008 11:14
IIRC, ProcessImageFileName is undocumented class. Suggested way is to use
user mode helper application, or imagenotify routines.

--
V
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Uv" <yuvraaj(a)gmail.com> wrote in message
news:dbebce52-7ad3-4de8-9732-c5edb0fb5e55(a)b2g2000hsg.googlegroups.com...
> On Jan 30, 2:57 pm, joemango <joseandremora...(a)gmail.com> wrote:
> <a lot>
>
> Investigate NtQueryInformationProcess (..., ProcessImageFileName, ... )


From: Volodymyr Shcherbyna on 1 Feb 2008 18:39
I forgot to mention important thing. ProcessImageFileName is not implemented
on Windows 2000.

--
V.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Volodymyr Shcherbyna" <v_scherbina(a)online.mvps.org> wrote in message
news:%23azNsRCZIHA.220(a)TK2MSFTNGP04.phx.gbl...
> IIRC, ProcessImageFileName is undocumented class. Suggested way is to use
> user mode helper application, or imagenotify routines.
>
> --
> V
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
> "Uv" <yuvraaj(a)gmail.com> wrote in message
> news:dbebce52-7ad3-4de8-9732-c5edb0fb5e55(a)b2g2000hsg.googlegroups.com...
>> On Jan 30, 2:57 pm, joemango <joseandremora...(a)gmail.com> wrote:
>> <a lot>
>>
>> Investigate NtQueryInformationProcess (..., ProcessImageFileName, ... )
>
>


First  |  Prev  | 
Pages: 1 2
Prev: Working on a NE disassembler
Next: How detect Server 2008 Core?