file name from remote proc

//h , process ID - returned by NTQSI

//str - output buffer for fileName 

//returns false if handle is not file object or if errors ocured

bool GetFileName (HANDLE h, wchar_t* str, DWORD processId )

{

     ULONG size = 0x2000;

     UCHAR* lpBuffer = NULL;

     bool ret = FALSE;

     

     HANDLE handle;

     HANDLE hRemoteProcess = NULL;

     bool remote = processId != GetCurrentProcessId();

     

     if ( remote )

     {

            // Open the remote process

            hRemoteProcess = OpenProcess( processId );

            if ( hRemoteProcess == NULL ) return FALSE;



            // Duplicate the handle

            handle = DuplicateHandle( hRemoteProcess, h );

     }

     else handle = h;



     // Query the info size

     NtQueryObject( handle, 2, NULL, 0, &size );



     lpBuffer = new UCHAR[size];

     // Query the info size ( type = 2 = ObjectTypeInformation)

     if ( NtQueryObject( handle, 2, lpBuffer, size, NULL ) == 0 )

     {

            int i = _wcsicmp (L"File", (wchar_t*)(lpBuffer+0x60));

            if (i != 0) goto cleanup;

                       

              // --- PROBLEMS ARE HERE ----

            FILE_NAME_INFORMATION fni;

            DWORD status[2];

            long rc = NtQueryInformationFile(h, &status, &fni, sizeof(FILE_NAME_INFORMATION), 9);

            if ( rc != STATUS_SUCCESS) goto cleanup;

               

            wcscpy(str, fni.FileName);

            ret = TRUE;

     }



cleanup:

     if ( remote )

     {

            if ( hRemoteProcess != NULL )

                 CloseHandle(  hRemoteProcess );



            if ( handle != NULL )

                 CloseHandle(  handle );

     }

     if ( lpBuffer != NULL )     delete [] lpBuffer;



     return ret;

}