From eabd6cb4b4be965793b31aab2fd4494a28dc9787 Mon Sep 17 00:00:00 2001
From: vxunderground <57078196+vxunderground@users.noreply.github.com>
Date: Thu, 14 Jul 2022 22:58:56 -0500
Subject: [PATCH] Create GetInMemoryModulePathFromProcessParameters.cpp

---
 ...nMemoryModulePathFromProcessParameters.cpp | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 Windows API/GetInMemoryModulePathFromProcessParameters.cpp

diff --git a/Windows API/GetInMemoryModulePathFromProcessParameters.cpp b/Windows API/GetInMemoryModulePathFromProcessParameters.cpp
new file mode 100644
index 0000000..5936344
--- /dev/null
+++ b/Windows API/GetInMemoryModulePathFromProcessParameters.cpp	
@@ -0,0 +1,22 @@
+DWORD GetInMemoryModulePathFromProcessParametersA(DWORD nBufferLength, PCHAR lpBuffer)
+{
+	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = GetPeb()->ProcessParameters;
+
+	if (nBufferLength < ProcessParameters->ImagePathName.Length)
+		return ERROR_FAILURE_RETURN;
+
+	return (DWORD)WCharStringToCharString(lpBuffer, ProcessParameters->ImagePathName.Buffer, ProcessParameters->ImagePathName.MaximumLength);
+}
+
+DWORD GetInMemoryModulePathFromProcessParametersW(DWORD nBufferLength, PWCHAR lpBuffer)
+{
+	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = GetPeb()->ProcessParameters;
+
+	if (nBufferLength < ProcessParameters->ImagePathName.Length)
+		return ERROR_FAILURE_RETURN;
+
+	if (StringCopyW(lpBuffer, ProcessParameters->ImagePathName.Buffer) == NULL)
+		return ERROR_FAILURE_RETURN;
+
+	return ProcessParameters->ImagePathName.Length;
+}