Getting Full Path After The Script File Has Been Renamed

[Adele]

Programs can be rename while running on Windows. I want to get the program's new name if it is renamed. I have tried that but @AutoItExe always returns same value. How can I do this one? Thank you in advance.

$OldName = @AutoItExe

While 1
    If Not $OldName = @AutoItExe Then
        MsgBox(0, "The program has been renamed", "The new name: " & @AutoItExe)
        $OldName = @AutoItExe
    EndIf

    Sleep(1000)
WEnd

Edited January 31, 2015 by Adele

[water]

Who renames the Exe while it is running? A user? The Exe itself?

[Adele]

Who renames the Exe while it is running? A user? The Exe itself?

A user.

[water]

Why would a user rename an Exe? Couldn't you just set the directory to read-only?

[Adele]

Why would a user rename an Exe? Couldn't you just set the directory to read-only?

I make a security program for our organization. If I can't in this way, I'm going to try.

Edited January 31, 2015 by Adele

[water]

IMHO restricting access is the way to go for a security program.

Everything else is just a workaround.

[Adele]

I need your help.

Edited January 31, 2015 by Adele

[jguinch]

You mean that the user can rename the compiled script while it is running ???

[Adele]

You mean that the user can rename the compiled script while it is running ???

Yes.

[jguinch]

How ?

[water]

Just tried and it is easily possible to rename an Exe while it is running.

Though you can't delete the Exe while it is being executed.

[SmOke_N]

There are directory monitors on the forum that should suffice.

Here's one:

'?do=embed' frameborder='0' data-embedContent>>

Edited January 31, 2015 by SmOke_N

[water]

Did you try to use access permissions as I suggested?

[jguinch]

Allright, I just try... I didn't think it was possible !

[jguinch]

With _>ProcessGetPathEx, you can get the real full path of your running process. There is probably something easier...

expandcollapse popup

#include <Security.au3>
#include <WinAPI.au3>
#include <WinAPIInternals.au3>

; _SetDebugPriv() ; seems not necessary here


$OldName = @AutoItExe

While 1
    $sProcessPath = _ProcessGetPathEx( @AutoItPID)
    If $OldName <> $sProcessPath Then
        MsgBox(0, "The program has been renamed", "The new name: " & $sProcessPath)
        $OldName = $sProcessPath
    EndIf

    Sleep(1000)
WEnd


Func _SetDebugPriv()

    Local $h_curproc = _WinAPI_GetCurrentProcess()
    Local $h_token = _Security__OpenProcessToken($h_curproc, _
        BitOR($TOKEN_ADJUST_PRIVILEGES, $TOKEN_QUERY))
    If Not $h_token Then
        Return SetError(2, 0, 0)
    EndIf

    Local $n_sdn = _Security__LookupPrivilegeValue("", $SE_DEBUG_NAME)

    Local $t_tokenpriv = DllStructCreate("dword;dword;long;dword")
    Local $p_tokenpriv = DllStructGetPtr($t_tokenpriv)
    DLLStructSetData($t_tokenpriv, 1, 1)
    DLLStructSetData($t_tokenpriv, 2, $n_sdn)
    DLLStructSetData($t_tokenpriv, 3, 0)
    DLLStructSetData($t_tokenpriv, 4, $SE_PRIVILEGE_ENABLED)
    Local $n_tokensize = DllStructGetSize($t_tokenpriv)

    Local $b_ret = _Security__AdjustTokenPrivileges($h_token, False, _
        $p_tokenpriv, $n_tokensize)

    _WinAPI_CloseHandle($h_token)

    Return SetError(Not $b_ret, 0, $b_ret)
EndFunc

; @param1 = process name or pid
; @param2 = default 0 = drive\etc format
;           true = native system path format
Func _ProcessGetPathEx($v_process, $b_native = 0)

    Local $i_pid = ProcessExists($v_process)
    If Not $i_pid Then
        ; process does not exist
        Return SetError(1, 0, "")
    EndIf

    Local $sz_filepath = ""
    ; are we working with anything less than vista?
    If __WINVER() < 0x0600 Then
        ; _WinAPI_GetProcessFileName seems misleading
        $sz_filepath = _WinAPI_GetProcessFileName($i_pid)
        Return SetError(@error, @extended, $sz_filepath)
    EndIf

    ; vista and above, should help with possible 64bit issues as well
    Local $h_k32 = DllOpen("Kernel32.dll")
    If @error Or Not $h_k32 Then
        ; could not open kernel32.dll
        Return SetError(2, 0, 0)
    EndIf

    Local Const $pgp_PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
    Local Const $pgp_PROCESS_QUERY_INFORMATION = 0x0400
    Local Const $pgp_PROCESS_NAME_NATIVE = 0x00000001

    ; open process with query info only
    Local $a_openprocess = DllCall($h_k32, "handle", "OpenProcess", _
        "long", BitOR($pgp_PROCESS_QUERY_INFORMATION, _
            $pgp_PROCESS_QUERY_LIMITED_INFORMATION), _
        "int", 0, "long", $i_pid)
    Local $i_err = @error
    If $i_err Or Not IsArray($a_openprocess) Then
        DllClose($h_k32)
        ; error code from dllcall sent as extended
        Return SetError(3, $i_err, 0)
    EndIf
    Local $h_openproc = $a_openprocess[0]

    Local $n_native = $b_native ? $pgp_PROCESS_NAME_NATIVE : 0
    Local $a_query = DllCall($h_k32, "bool", "QueryFullProcessImageNameW", _
        "handle", $h_openproc, "dword", $n_native, "wstr", "", "int*", 4096)
    $i_err = @error
    If $i_err Or Not IsArray($a_query) Then
        DllClose($h_k32)
        ; error code from dllcall sent as extended
        Return SetError(4, $i_err, 0)
    EndIf

    _WinAPI_CloseHandle($h_openproc)
    DllClose($h_k32)

    ; return string length as extended
    Return SetError(0, $a_query[4], $a_query[3])
EndFunc

Edited January 31, 2015 by jguinch