以下代码不能得到64位的进程路径

冥界3大法王

[Delphi] 纯文本查看 复制代码

uses
  Math, SHELLAPI, RegularExpressions, TLHelp32, PsAPI, Clipbrd, Unit2, Unit3,
  UnitMainForm4, Unit5, Unit6, Unit4, Unit7;

function GetPathFileofModule(ModuleName: string): string;
var
  hProcSnap: THandle;
  pProcess: THandle;
  pe32: TProcessEntry32;
  s: string;
  buf: array[0..MAX_PATH] of char;
  hMod: HMODULE;
  cbNeeded: DWORD;
begin
  hProcSnap := CreateToolHelp32SnapShot(TH32CS_SNAPALL, 0);
  if hProcSnap = INVALID_HANDLE_VALUE then
    Exit;
  pe32.dwSize := SizeOf(ProcessEntry32);
  if Process32First(hProcSnap, pe32) = True then
    while Process32Next(hProcSnap, pe32) = True do
    begin
      if uppercase(pe32.szExeFile) = uppercase(ModuleName) then
      begin
        pProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, FALSE, pe32.th32ProcessID);
        if pProcess <> 0 then
        begin
          if EnumProcessModules(pProcess, @hMod, sizeof(hMod), cbNeeded) then
          begin
            ZeroMemory(@buf, MAX_PATH + 1);
            GetModuleFileNameEx(pProcess, hMod, buf, MAX_PATH + 1);
            Result := strpas(buf);
          end;
        end;
      end;
    end;
  CloseHandle(hProcSnap);
end;

揰掵佲

试试 GetProcessImageFileName 和 QueryDosDevice

156608225

编译成64位程序就可以了，32位程序不能枚举64位进程

huangxiaolin520

学习一下，

156608225

冰棍好烫啊 发表于 2021-2-19 09:04
32位程序也能的...

CreateToolhelp32Snapshot可以枚举出64位进程，但EnumProcessModules不能枚举64位进程模块，需要编译成64位程序