GetProcessImageFileName function (Windows)

Switch View :
Classic
Lightweight
ScriptFree
GetProcessImageFileName function

Applies to: desktop apps only

Retrieves the name of the executable file for the specified process.

Syntax

DWORD WINAPI GetProcessImageFileName(
  __in   HANDLE hProcess,
  __out  LPTSTR lpImageFileName,
  __in   DWORD nSize
);

Parameters

hProcess [in]

A handle to the process. The handle must have the PROCESS_QUERY_INFORMATION or PROCESS_QUERY_LIMITED_INFORMATION access right. For more information, see Process Security and Access Rights.

Windows Server 2003 and Windows XP:  The handle must have the PROCESS_QUERY_INFORMATION access right.
lpImageFileName [out]

A pointer to a buffer that receives the full path to the executable file.

nSize [in]

The size of the lpImageFileName buffer, in characters.

Return value

If the function succeeds, the return value specifies the length of the string copied to the buffer.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Remarks

The file Psapi.dll is installed in the %windir%\System32 directory. If there is another copy of this DLL on your computer, it can lead to the following error when running applications on your system: "The procedure entry point GetProcessImageFileName could not be located in the dynamic link library PSAPI.DLL." To work around this problem, locate any versions that are not in the %windir%\System32 directory and delete or rename them, then restart.

The GetProcessImageFileName function returns the path in device form, rather than drive letters. For example, the file name C:\Windows\System32\Ctype.nls would look as follows in device form:

\Device\Harddisk0\Partition1\Windows\System32\Ctype.nls

To retrieve the module name of the current process, use the GetModuleFileName function with a NULL module handle. This is more efficient than calling the GetProcessImageFileName function with a handle to the current process.

To retrieve the name of the main executable module for a remote process in win32 path format, use the QueryFullProcessImageName function.

Starting with Windows 7 and Windows Server 2008 R2, Psapi.h establishes version numbers for the PSAPI functions. The PSAPI version number affects the name used to call the function and the library that a program must load.

If PSAPI_VERSION is 2 or greater, this function is defined as K32GetProcessImageFileName in Psapi.h and exported in Kernel32.lib and Kernel32.dll. If PSAPI_VERSION is 1, this function is defined as GetProcessImageFileName in Psapi.h and exported in Psapi.lib and Psapi.dll as a wrapper that calls K32GetProcessImageFileName.

Programs that must run on earlier versions of Windows as well as Windows 7 and later versions should always call this function as GetProcessImageFileName. To ensure correct resolution of symbols, add Psapi.lib to the TARGETLIBS macro and compile the program with -DPSAPI_VERSION=1. To use run-time dynamic linking, load Psapi.dll.

Requirements

Minimum supported client

Windows XP

Minimum supported server

Windows Server 2003

Header
Psapi.h

Library
Kernel32.lib on Windows 7 and Windows Server 2008 R2;
Psapi.lib (if PSAPI_VERSION=1) on Windows 7 and Windows Server 2008 R2;
Psapi.lib on Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP

DLL
Kernel32.dll on Windows 7 and Windows Server 2008 R2;
Psapi.dll (if PSAPI_VERSION=1) on Windows 7 and Windows Server 2008 R2;
Psapi.dll on Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP

Unicode and ANSI names

GetProcessImageFileNameW (Unicode) and GetProcessImageFileNameA (ANSI)

See also

Process Information
PSAPI Functions
QueryFullProcessImageName

 

 

Send comments about this topic to Microsoft

Build date: 2/7/2012

Community Content

p4msdn
Problem when renaming folder containing the executable
Ran into the same problem as "uluorta". Renamed the folder which contained the executable. Calls to GetProcessImageName() returned the path of the previous folder, not the new folder. Removing and replacing the executable file corrected the issue. A system restart was not necessary.

tech32
example please
i would like to see an example. it makes me more familliar with how to use the APIs as a beginner

Adam Nielsen
Return value is not filename length
Note that the return value is the length of the data copied to the buffer, which is *not* the length of the path.  The returned string contains an embedded NULL and some additional (unprintable) characters.  Use strlen() on the buffer to find out the length of the path itself.

uluorta
Consider WMI querying
We had an issue with GetProcessImageFileName() on WinXP: When you change the name of the folder containing an executable and then run the executable, GetProcessImageFileName() gives the previous folder name. This happens on a single session [it works fine after restart].
Then we used GetModuleFileNameEx() which overcame this problem, but it somehow has WOW64 issues [noted in its own page]. The final solution we have found is querying WMI with WQL:

Check out: http://msdn.microsoft.com/en-us/library/aa390423(VS.85).aspx

Likewise, you can query WMI like "SELECT * FROM Win32_Process WHERE ProcessId = ####" and this method probably works on all distributions.

Check Win32_Process class too: http://msdn.microsoft.com/en-us/library/aa394372(VS.85).aspx

eriklitze
For best results use the following
For the best results use the following table to convert paths.

Windows 2000 = GetModuleFileName()
Windows XP x32 = GetProcessImageFileName()
Windows XP x64 = GetProcessImageFileName()
Windows Vista = QueryFullProcessImageName()
Windows 7 = QueryFullProcessImageName()


Note: If you are not aware the API GetProcessImageFileName() returns a kernel DOS device path. You can use the following API to map the device paths to a Win32 format.

GetLogicalDriveStrings
QueryDosDevice