From d2215f26acb5bf394b2fc234b5fcaf5e93121e81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Mon, 9 Feb 2026 16:12:24 +0800
Subject: [PATCH] Processing (Windows): uses `NtQueryInformationProcess`
 instead of its wrapper

---
 src/common/impl/processing_windows.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/src/common/impl/processing_windows.c b/src/common/impl/processing_windows.c
index b128d1438..1c63013ea 100644
--- a/src/common/impl/processing_windows.c
+++ b/src/common/impl/processing_windows.c
@@ -1,7 +1,9 @@
 #include "fastfetch.h"
 #include "common/processing.h"
 #include "common/io.h"
+#include "common/windows/unicode.h"
 
+#include <stdalign.h>
 #include <windows.h>
 #include <ntstatus.h>
 #include <winternl.h>
@@ -193,9 +195,16 @@ const char* ffProcessReadOutput(FFProcessHandle* handle, FFstrbuf* buffer)
 
 exit:
     {
-        DWORD exitCode = 0;
-        if (GetExitCodeProcess(hProcess, &exitCode) && exitCode != STILL_ACTIVE && exitCode != 0)
-            return "Child process exited with an error";
+        PROCESS_BASIC_INFORMATION info = {};
+        ULONG size;
+        if(NT_SUCCESS(NtQueryInformationProcess(hProcess, ProcessBasicInformation, &info, sizeof(info), &size)))
+        {
+            assert(size == sizeof(info));
+            if (info.ExitStatus != STILL_ACTIVE && info.ExitStatus != 0)
+                return "Child process exited with an error";
+        }
+        else
+            return "NtQueryInformationProcess(ProcessBasicInformation) failed";
     }
 
     return NULL;
@@ -227,12 +236,13 @@ bool ffProcessGetInfoWindows(uint32_t pid, uint32_t* ppid, FFstrbuf* pname, FFst
     }
     if(exe)
     {
-        DWORD bufSize = exe->allocated;
-        if(QueryFullProcessImageNameA(hProcess, 0, exe->chars, &bufSize))
+        alignas(alignof(UNICODE_STRING)) uint8_t buffer[4096];
+        ULONG size;
+        if(NT_SUCCESS(NtQueryInformationProcess(hProcess, ProcessImageFileNameWin32, &buffer, sizeof(buffer), &size)))
         {
-            // We use full path here
-            // Querying command line of remote processes in Windows requires either WMI or ReadProcessMemory
-            exe->length = bufSize;
+            UNICODE_STRING* imageName = (UNICODE_STRING*)buffer;
+            ffStrbufSetNWS(exe, imageName->Length / sizeof(wchar_t), imageName->Buffer);
+
             if (exePath) ffStrbufSet(exePath, exe);
         }
         else