Mac Forum / Programming / Mac Programming / November 2006

Hello,

I'm trying to find a way to reliably find the full path of a running
process. Currently, i'm sending a sysctl down (mib = {CTL_KERN,
KERN_PROCARGS, <pid>, 0, 0, 0}) to get the args the process was started
with to find the path, but that is not always reliable. For example, a
user can cd into a directory and start a process "./a.out", then the
proc args that come back will not include the full path to the a.out
(I'm looking for something will tell me the proc running is
/Users/me/a.out, instead of just a.out). I have the whole kinfo_proc
structure at my disposal, but i don't see any members in there that i
can use to find the full path of the process. kp_proc.p_comm, tells me
the proc name, but then again, not the full path.

To give a little more context on this, I need to the full path because
my process starts a thread that periodically monitors all processes
running & MD5's them to make sure that there are no malicious processes
(for which i know the MD5 of) running. In order to md5 the process, i
need the full path :). Any suggestions?

Thanks,

grant