title: How to use ZwQueryInformationProcess to get ProcessImageFileName in a kernel driver?
body: <p>I'm writing a simple kernel driver for my application (think of a very simple anti-malware application.)</p>
  
  <p>I've hooked <code>ZwOpenFile()</code> and used <code>PsGetCurrentProcess()</code> to get a handle to the caller process.</p>
  
  <p>It returns a PEPROCESS structure:</p>
  
  <pre><code>PEPROCESS proc = PsGetCurrentProcess();
  </code></pre>
  
  <p>I'm using <code>ZwQueryInformationProcess()</code> to get the <code>PID</code> and <code>ImageFileName</code>:</p>
  
  <pre><code>DbgPrint("ZwOpenFile Called...\n");
  DbgPrint("PID: %d\n", PsGetProcessId(proc));
  DbgPrint("ImageFileName: %.16s\n", PsGetProcessImageFileName(proc));
  </code></pre>
  
  <p>and trying to get the process <code>FullPath</code> this way (but I get BSOD):</p>
  
  <pre><code>WCHAR strBuffer[260];
  UNICODE_STRING str;
  
  //initialize
  str.Buffer = strBuffer;
  str.Length = 0x0;
  str.MaximumLength = sizeof(strBuffer);
  
  //note that the seconds arg (27) is ProcessImageFileName
  ZwQueryInformationProcess(proc, 27, &amp;str, sizeof(str), NULL);
  
  DbgPrint("FullPath: %wZ\n", str.Buffer);
  </code></pre>
  
  <p><img src="https://i.stack.imgur.com/5ik7K.png" alt="DbgView Output"></p>
  
  <p>As you see <code>str.Buffer</code> is empty or filled with garbage. Perhaps a buffer overflow while filling the <code>str</code> via <code>ZwQueryInformationProcess()</code> triggers the BSOD.</p>
  
  <p><img src="https://i.stack.imgur.com/YmFzJ.png" alt="alt text"></p>
  
  <p>Any help would be appreciated.</p>