I have found the following code in several places Google, so I have started testing. It works OK ( ish ) but the problem is "QueryFullProcessImageNameA" because according to Microsoft: https://msdn.microsoft.com/en-us/library/windows/desktop/ms684919(v=vs.85).aspx this function works on minimum Windows Vista.
The code:
int Is64(HANDLE ProcessHandle, PBOOL Is64)
{
int Status = 1;
HANDLE hFile = INVALID_HANDLE_VALUE;
LPVOID lpFile = 0;
DWORD dwFileSize = 0, dwReaded = 0, dwSize = MAX_PATH;
PIMAGE_NT_HEADERS NtHeaders = 0;
char Path[MAX_PATH];
//Minimum supported client Windows Vista[desktop apps only]
//TODO
if (!QueryFullProcessImageNameA(ProcessHandle, 0, Path, &dwSize) || !Is64)
{
Status = 2;
goto EXIT;
}
hFile = CreateFileA(Path, GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0);
if (!hFile || hFile == INVALID_HANDLE_VALUE)
{
Status = 3;
goto EXIT;
}
dwFileSize = GetFileSize(hFile, 0);
lpFile = VirtualAlloc(0, dwFileSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (!lpFile)
{
Status = 4;
goto EXIT;
};
if (!ReadFile(hFile, lpFile, dwFileSize, &dwReaded, 0))
{
Status = 5;
goto EXIT;
}
NtHeaders = reinterpret_cast<PIMAGE_NT_HEADERS>((reinterpret_cast<DWORD_PTR>(lpFile) + PIMAGE_DOS_HEADER(lpFile)->e_lfanew));
if (!NtHeaders ||
NtHeaders->Signature != IMAGE_NT_SIGNATURE)
{
Status = 6;
goto EXIT;
}
if (NtHeaders->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 || NtHeaders->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64)
{
*Is64 = true;
Status = 7;
goto EXIT;
}
if (NtHeaders->FileHeader.Machine == IMAGE_FILE_MACHINE_I386)
{
*Is64 = false;
Status = 7;
goto EXIT;
}
EXIT:
if (hFile)
CloseHandle(hFile);
if (lpFile)
VirtualFree(lpFile, dwFileSize, MEM_DECOMMIT);
return true;
}
So my question is, is there an "alternative" for "QueryFullProcessImageNameA" which would work on Windows XP as well, without changing this function much ?
Thank you