Access denied while getting process path

Question

Hello,

I am trying to get process path by pid but I'm getting Win32Exception (access id denied).

The code looks like this:

string path = Process.GetProcessById(pid).MainModule.FileName

I have tried using OpenProcess with GetModuleFileNameEx but OpenProcess is returning 0. I even tried enabling SeDebugPrivilege according to C# – How to enable SeDebugPrivilege but it didn't help.

The above code works for most of the processes but throws error for SynTPHelper.exe (Synaptics Pointing Device Helper) The application is running under the same username as my code. Both, my application and the process run in 64 bit.

Is it possible to retrieve the path without running my application as an administrator?

Edit

Task Manager is able to 'open file location' even though I'm not running it as an administrator.

Answer 1

Well, it is certainly not unheard of for services to remove access rights so that even an administrator cannot open the process. A service has enough privileges to do so, DRM components like audiodg.exe readily do so. A mouse pad helper doesn't strike me as something that would require such protection. But what the hey, why would anybody ever need to mess with a mouse pad helper?

Answer 2

Finally I managed to solve it. As it turned out there is new function in Vista and above for getting process path and new process access (PROCESS_QUERY_LIMITED_INFORMATION):

QueryFullProcessImageName

Here is the code that works from non-elevated process:

    private static string GetExecutablePathAboveVista(UIntPtr dwProcessId)
    {
        StringBuilder buffer = new StringBuilder(1024);
        IntPtr hprocess = OpenProcess(ProcessAccessFlags.PROCESS_QUERY_LIMITED_INFORMATION, false, dwProcessId);
        if (hprocess != IntPtr.Zero)
        {
            try
            {
                int size = buffer.Capacity;
                if (QueryFullProcessImageName(hprocess, 0, buff, out size))
                {
                    return buffer.ToString();
                }
            }
            finally
            {
                CloseHandle(hprocess);
            }
        }
        return string.Empty;
    }