I need to receive ImagePathName from Process.
In my previous project I used ZwQueryInformationProcess() with ProcessBasicInformation and received name from PEB - works great.
But ZwQueryInformationProcess() was called only for current process (-1).

Currently I need receive the same for parent process which HANDLE is result of ZwOpenProcess(…) (obviously with attribute OBJ_KERNEL_HANDLE).

ZwQueryInformationProcess() returns SUCCESS and basic information, but PEB is not correct!?!

Searching our forum gives me th folowing (Anton Bassov): “PEB is user-mode structure, and, hence, may be unusable in the caller’s context - in order to make any use of it, you have to attach your thread to the address space of the target process.” ( https://www.osronline.com/showthread.cfm?link=115084 )

which means that PEB is valid only for calls inside process!?!
There is no this limitation in DDK!?!

The question: is it correct to call ZwQueryInformationProcess(…, ProcessBasicInformation,…) for parent handle?