Get path of process without Admin privileges in C#

0

I am trying to get the path of a running process without admin privileges. There is lots of tutorials online, but i can't get them to work. This is the basic premise that works great when running as administrator:

// main

   Process pname = Process.GetProcessesByName(processName)[0];
   string path = GetExecutablePath(pname);

// api

    private static string GetExecutablePath(Process process) {
        //If running on Vista or later use the new function
        if (Environment.OSVersion.Version.Major >= 6) {
            return GetExecutablePathAboveVista(process.Id);
        }

        return process.MainModule.FileName;
    }


    private static string GetExecutablePathAboveVista(int ProcessId) {
        var buffer = new StringBuilder(1024);
        IntPtr hprocess = OpenProcess(ProcessAccessFlags.QueryLimitedInformation,
                                      false, ProcessId);
        if (hprocess != IntPtr.Zero) {
            try {
                int size = buffer.Capacity;
                if (QueryFullProcessImageName(hprocess, 0, buffer, out size)) {
                    return buffer.ToString();
                }
            } finally {
                CloseHandle(hprocess);
            }
        }
        throw new Win32Exception(Marshal.GetLastWin32Error()); //always throws error
    }


    [DllImport("kernel32.dll")]
    private static extern bool QueryFullProcessImageName(IntPtr hprocess, int dwFlags,
                   StringBuilder lpExeName, out int size);
    [DllImport("kernel32.dll")]
    private static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess,
                   bool bInheritHandle, int dwProcessId);

    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern bool CloseHandle(IntPtr hHandle);

    [Flags]
    public enum ProcessAccessFlags : uint {
        All = 0x001F0FFF,
        Terminate = 0x00000001,
        CreateThread = 0x00000002,
        VirtualMemoryOperation = 0x00000008,
        VirtualMemoryRead = 0x00000010,
        VirtualMemoryWrite = 0x00000020,
        DuplicateHandle = 0x00000040,
        CreateProcess = 0x000000080,
        SetQuota = 0x00000100,
        SetInformation = 0x00000200,
        QueryInformation = 0x00000400,
        QueryLimitedInformation = 0x1000,
        Synchronize = 0x00100000
    }

Unfortunately, the line

throw new Win32Exception(Marshal.GetLastWin32Error()); 

always executes with an error message

System.ComponentModel.Win32Exception: 'Not all privileges or groups referenced are assigned to the caller'

Is it possible to find the path of an exe without running as administrator? What solution do you recommend?

Update:

I think admin priviligies are needed because the program that I am inspecting has been run with admin priviliges. So the question could be rephrased to: how to find the executable path of a running process that is started as administrator?

In broader context.. I've been trying to determine if process A, that I installed, is already running on the machine. Process A requirs admin priviliges and it is usually starter as a service. There are many processes on the machines, that are named A. To find out, if this is my process, I inspected the path to exe file. Is there another way to determine if the process is indeed the one you are looking for? What else can be checked beside path to executable?

c#
asked on Stack Overflow Mar 15, 2020 by Robert Segdewick • edited Mar 16, 2020 by Robert Segdewick

1 Answer

0

You can't. You must run as admin to get the process's path.

You don't need all that excess code you can just use this, as long as you run as admin:

string path = Process.GetProcessesByName("processfilename")[0].MainModule.FileName;
answered on Stack Overflow Jun 3, 2020 by GuidedHacking

User contributions licensed under CC BY-SA 3.0