Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Access denied while getting process path

I am trying to get process path by pid but I'm getting Win32Exception (access id denied).

The code looks like this:

string path = Process.GetProcessById(pid).MainModule.FileName

I have tried using OpenProcess with GetModuleFileNameEx but OpenProcess is returning 0. I even tried enabling SeDebugPrivilege according to C# – How to enable SeDebugPrivilege but it didn't help.

The above code works for most of the processes but throws error for SynTPHelper.exe (Synaptics Pointing Device Helper) The application is running under the same username as my code. Both, my application and the process run in 64 bit.

Is it possible to retrieve the path without running my application as an administrator?

Edit

Task Manager is able to 'open file location' even though I'm not running it as an administrator.

like image 734
Giorgi Avatar asked Aug 03 '10 18:08

Giorgi


People also ask

How do I fix access denied error?

Right-click the file or folder, and then click Properties. Click the Security tab. Under Group or user names, click your name to see the permissions you have. Click Edit, click your name, select the check boxes for the permissions that you must have, and then click OK.

Why is access to the path denied?

You may see “Access to the path is denied” error if the application is not able access to a path that is trying to read or write. This will show up as 401 Unauthorized error in IIS logs.


2 Answers

Finally I managed to solve it. As it turned out there is new function in Vista and above for getting process path and new process access (PROCESS_QUERY_LIMITED_INFORMATION):

QueryFullProcessImageName

Here is the code that works from non-elevated process:

    private static string GetExecutablePathAboveVista(UIntPtr dwProcessId)
    {
        StringBuilder buffer = new StringBuilder(1024);
        IntPtr hprocess = OpenProcess(ProcessAccessFlags.PROCESS_QUERY_LIMITED_INFORMATION, false, dwProcessId);
        if (hprocess != IntPtr.Zero)
        {
            try
            {
                int size = buffer.Capacity;
                if (QueryFullProcessImageName(hprocess, 0, buff, out size))
                {
                    return buffer.ToString();
                }
            }
            finally
            {
                CloseHandle(hprocess);
            }
        }
        return string.Empty;
    }
like image 131
Giorgi Avatar answered Oct 13 '22 01:10

Giorgi


Well, it is certainly not unheard of for services to remove access rights so that even an administrator cannot open the process. A service has enough privileges to do so, DRM components like audiodg.exe readily do so. A mouse pad helper doesn't strike me as something that would require such protection. But what the hey, why would anybody ever need to mess with a mouse pad helper?

like image 30
Hans Passant Avatar answered Oct 13 '22 00:10

Hans Passant