Determine the path or a process on WOW64 / use of GetProcessImageFileName

See more:

C++

Hi all,
I'm currently facing an interesting problem to determine the path of a process on WOW64.

The usual approaches via GetModuleFileName or Module32First / Module32Next on a snapshot
are failing with the error ERROR_PARTIAL_COPY. Several pages on the internet advises
to use Get GetProcessImageFileName. This command works, but the result is rather
the device name as the path on the file system (e.g. \Device\Harddisk1\DP(1)0-0+4\myprocess.exe
for a process launched on a mounted USB stick).

This brings me to the task how to convert the device information to a path on the file
system. The usual adviced approach is to determine all mapped drive letters by
GetLogicalDriveStrings and determine their path by QueryDosDevice. Of course this is
only half of the story since you also have to be aware for mounted devices (like my
USB stick above), UNC network paths (e.g \\mycomputer\myshare\... ) and maybe more
other ways to mount devices on a file system.

This brings me to my ultimate :) questions:
- Is there any general way to query for a device mapping in the file system except
from testing for all the different ways (drive letters, mounted devices,
network mapping etc)?

- What is the deeper meaning of the GetProcessImageFileName in the user mode?
in case the GetModuleFileName would work, I currently see no sense of this command
if you are not coding in the kernel mode. Maybe somebody as a clue on this.