Edit

SeLocateProcessImageName function (ntifs.h)

  • Article

The SeLocateProcessImageName routine returns the full process image name for the specified process.

Syntax

NTSTATUS SeLocateProcessImageName(
  PEPROCESS       Process,
  PUNICODE_STRING *pImageFileName
);

Parameters

Process

[in/out] Pointer to the process value for which to acquire the name.

pImageFileName

[out] Pointer to an allocated buffer that receives the full image name of the process. The buffer contains a Unicode string followed by the image name string.

Return value

SeLocateProcessImageName returns an NTSTATUS value such as the following.

Return code Description
STATUS_SUCCESS The routine successfully returned the process image name.
STATUS_NOT_FOUND The routine could not find the process image name.

Remarks

The caller is responsible for freeing the buffer that pImageFileName points to.

Requirements

Requirement Value
Header ntifs.h
IRQL PASSIVE_LEVEL