I need to get process name from process id in windows to find process names associated with a logged event.
If you are getting the Process ID from a log, it will only be valid if the original process is still running. Otherwise, the ID is no longer valid for that process name. If the process has already exited before you read the log, all bets are off.
I need not currently running process since it talks about logged event.
Then you are out of luck, if the original process name was not logged.
I have a doubt of whether processID vs processName combination is unique or not in Windows.
A Process ID is unique only while being used for a running process. Once a process ends, its Process ID is no longer valid, and can be re-used for a subsequent new process.
I expect that there must be some structure to map process id to process name.
Yes, but only for a running process. You can pass the Process ID to OpenProcess()
. If successful, it will return a HANDLE
to the running process. You can then pass that HANDLE
to GetModuleFileName()
, GetProcessImageFileName()
, or QueryFullProcessImageName()
, depending on OS version and permissions you are able to gain from OpenProcess()
.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…