Retrieving process running dir from PID

Question

Trying to retrieve the running directory of a process using the PID. I am obtaining the PID using FindWindow() and GetWindowThreadProcessId() which results in the same process ID as shown in task manager, so I assume it to be correct.

When using GetModuleFileNameEx() , instead of resulting in a path, I get what seems to be a memory address.

auto wnd = FindWindow(nullptr, L"prog");
while (wnd == nullptr)
{
    wnd = FindWindow(nullptr, L"prog");
}

TCHAR fBuf[MAX_PATH]; // buffer for path
DWORD procId; // process id
GetWindowThreadProcessId(wnd, &procId); // get process id
std::cout << procId << std::endl; // results in correct pid
auto procHdl = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, procId); // create handle for process
if (procHdl != NULL) {
    if (GetModuleFileNameEx(procHdl, 0, fBuf, MAX_PATH) == 0) {
        std::cerr << "Failed to get module filename." << std::endl;
    }
    else {
        std::cout << "Module filename is: " << fBuf << std::endl;
    }

    CloseHandle(procHdl);
}

Sample output is:

10488
Module filename is: 008CF93C

I have had the same result using GetProcessImageFileNname() too.

Answer 1

To get the directory of a program, first use GetModuleFileNameEx to get the program path, and your directory will start from the first character to the last backslash found.

Example:

Program is: "C:\\Windows\\notepad.exe";
Directory is: "C:\\Windows";

In code:

DWORD pid = 104;
CHAR ProgramFile[MAX_PATH];
std::string DirectoryPath;
HANDLE hProcess = OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, FALSE, pid);
GetModuleFileNameExA(hProcess, NULL, ProgramFile, MAX_PATH);
DirectoryPath = ProgramFile;
DirectoryPath = DirectoryPath.substr(0, DirectoryPath.find_last_of('\\'));
std::cout << "ProgramFile: " << ProgramFile << endl;
std::cout << "Directory: " << DirectoryPath.c_str();