C# Signature:

[DllImport("psapi.dll")]
static extern uint GetProcessImageFileName(
    IntPtr hProcess,
    [Out] StringBuilder lpImageFileName,
    [In] [MarshalAs(UnmanagedType.U4)] int nSize
);

VB Signature:

Declare Function GetProcessImageFileName Lib "psapi.dll"
<DllImport("psapi.dll")> _
Public Shared Function GetProcessImageFileName(
    ByVal hProcess As IntPtr,
    <Out> lpImageFileName As StringBuilder,
    <[In]> <MarshalAs(UnmanagedType.U4)> uSize As Integer
) As UInteger
End Function

User-Defined Types:

None.

Alternative Managed API:

Do you know one? Please contribute it!

Notes:

From MSDN: The GetProcessImageFileName function returns the path in device form, rather than drive letters. For example, the file name C:\Winnt\System32\Ctype.nls would look as follows in device form:

\Device\Harddisk0\Partition1\WINNT\System32\Ctype.nls

This can be used in place of the GetModuleFileName call, which doesn't work on processes that haven't been loaded by the current one.

Tips & Tricks:

I found this to be more comprehensive than GetModuleFileNameEx. Didnt need to enumerate windows or modules

Sample Code:

uint pid = 0;
StringBuilder fileName = new StringBuilder(2000);

/** get the handle for point under cursor **/
IntPtr hWnd = WindowFromPoint(pt);

/** Need to get the process ID from handle under cursor **/
GetWindowThreadProcessId(hWnd, out pid);

/** Hook into process **/
IntPtr pic = OpenProcess(NativeMethods.ProcessAccessFlags.All, true, (int)pid);

/** This gets the filename of the process image. Path is in device format **/
GetProcessImageFileName(pic, fileName, 2000);

MessageBox.Show(fileName.ToString());