WDK : get processId by name.exe

Question

Hi, I'm developing a driver in Windows Filtering Platform and I need the process ID of another process to do what I need to do. I know only the file name of that process (name.exe).

In win32 I could use the function CreateToolhelp32Snapshot to get the list of all processes and I could search the PID there. ( http://msdn.microsoft.com/en-us/library/ms684834(VS.85).aspx )

Unfortunately in kernel mode this stuff is not available. Anyone know how can I obtain the processID knowing only the binary name, by kernel space?

Thanks, Marco

Answer 1

Depending on the timing, it seems that you could call PsSetCreateProcessNotifyRoutineEx() with your own handler for CreateProcessNotifyEx(). Your CreateProcessNotifyEx() will then receive a pointer to a PS_CREATE_NOTIFY_INFO. In this struct is the field ImageFileName and also the bit FileOpenNameAvailable.

The program name will be in the Unicode string pointed to by ImageFileName. If FileOpenNameAvailable, then that string will contain the fully-qualified path to the binary. Otherwise, expect to find only the module name, possibly without the extension.