Why QueryFullProcessImageNameW throws System.AccessViolationException

Question

Hello everyone,

What I would like to accomplish is to retrieve the full name of the executable program for the specified process.
It is a reason why I am trying to use the QueryFullProcessImageNameA function from the Kernel32.dll.

It is part of my code:

[DllImport("kernel32.dll")]
private static extern bool QueryFullProcessImageNameW(IntPtr hProcess, int flags, StringBuilder text, int count);
[DllImport("user32.dll")]
private static extern IntPtr GetForegroundWindow();
[DllImport("user32.dll")]
private static extern int GetWindowThreadProcessId(IntPtr hWnd, out int lpdwProcessId);
[DllImport("kernel32.dll")]
private static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

private const int PROCESS_QUERY_LIMITED_INFORMATION = 0x1000;
IntPtr handle = GetForegroundWindow();
const int nChars = 1024;
StringBuilder strBuilder = new StringBuilder(nChars);
GetWindowThreadProcessId(handle, out int processId);
IntPtr hProc = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, processId);
QueryFullProcessImageNameW(hProc, 0, strBuilder, nChars);

But QueryFullProcessImageNameW function throws the System.AccessViolationException exception. Don't know why and how can I fix it. Do you have any suggestions?

Answer 1

Your import statements do not properly handle charset and unmanaged types resulting in memory corruption.

[DllImport("kernel32.dll", CharSet=CharSet.Unicode, ExactSpelling = true, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool QueryFullProcessImageNameW ( IntPtr hProcess, int flags, StringBuilder text, ref int count );

//To call - make nChars not const
QueryFullProcessImageNameW(hProc, 0, strBuilder, ref nChars);

Answer 2

And you can see old MSDN threads, like Win10 + c# WindowHandle and Process.Id issue with ApplicationFrameHost.exe
where I had posted a code sample