GetModuleFileNameEx returns exe path of 64 bit application from a 32 bit application on win10 os but not on win 8.1 and win12server R2

Question

I am calling GetModuleFileNameEx from 32 bit com dll to get the path of a 64bit exe and it works fine on win10 enterprise and other os but fails with PARTIAL_COPY error in windows 8.1 and win12 server R2.
Why does it work on win10 but not on win8.1?

Answer 1

Usually, QueryFullProcessImageName or GetProcessImageFileName should work
(they use NtQueryInformationProcess instead of ReadProcessMemory)

Answer 2

A possible reason why GetModuleFileNameEx can fail with PARTIAL_COPY is discussed here - https://devblogs.microsoft.com/oldnewthing/20160310-00

Also, the docs for the function seem to indicate that its not really for general usage -

The GetModuleFileNameEx function is primarily designed for use by debuggers and similar applications that must extract module information from another process. If the module list in the target process is corrupted or is not yet initialized, or if the module list changes during the function call as a result of DLLs being loaded or unloaded, GetModuleFileNameEx may fail or return incorrect information. ....
To retrieve the name of the main executable module for a remote process, use the GetProcessImageFileName or QueryFullProcessImageName function. This is more efficient and more reliable than calling the GetModuleFileNameEx function with a NULL module handle.

Answer 3

@Castorix31 @RLWA32

The problem I am facing is although the QueryFullProcessImageName works for me but the COM dll is compatible with even the older OSs and somehow we have WINDEF macro defined less than 6 meaning the QueryFullProcessImageName is not defined for us.

Coming to GetProcessImageFileName although it works but the code gets complicated to extract the actual path from the device form path and also it does not work for network path.
Correct me if I am wrong.