function EnablePrivilege(Process: dword; lpPrivilegeName: PChar):Boolean;
var
       hToken: dword;
       NameValue: Int64;
       tkp: TOKEN_PRIVILEGES;
       ReturnLength: dword;
begin
       Result:=false;
       OpenProcessToken(Process, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken);
       if not LookupPrivilegeValue(nil, lpPrivilegeName, NameValue) then
         begin
          CloseHandle(hToken);
          exit;
         end;
       tkp.PrivilegeCount := 1;
       tkp.Privileges[0].Luid := NameValue;
       tkp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
       AdjustTokenPrivileges(hToken, false, tkp, SizeOf(TOKEN_PRIVILEGES), tkp, ReturnLength);
       if GetLastError() <> ERROR_SUCCESS then
          begin
           CloseHandle(hToken);
           exit;
          end;
       Result:=true;
       CloseHandle(hToken);
end;

function FixProcessPath(PPath: String): String;
begin
       if PPath = '?' then
       begin
         Result := '';
         Exit;
       end;
       if Pos('\??\',PPath) <> 0 then
         Result := Copy(PPath,5,length(PPath)) else
         Result := PPath;
end;

function GetPathByPID(hProcess: THandle) : string;
       var
       cb: DWORD;
       hMod: HMODULE;
       ModuleName: array [0..300] of Char;
begin
       if (hProcess <> 0) then
       begin
         EnumProcessModules(hProcess, @hMod, SizeOf(hMod), cb);
         GetModuleFilenameEx(hProcess, hMod, ModuleName, SizeOf(ModuleName));
         if FileExists( FixProcessPath (ModuleName)) then
           Result := (ModuleName);
       end;
end;

function GetProcessID(const AProcessName: string): DWord;
var
       lSnapHandle: THandle;
       lProcStruct: PROCESSENTRY32;
       lProcessName, lSnapProcessName: string;
       lOSVerInfo: TOSVersionInfo;
begin
       Result := INVALID_HANDLE_VALUE;
       lSnapHandle := CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
       if lSnapHandle = INVALID_HANDLE_VALUE then
       Exit;
       lProcStruct.dwSize := SizeOf(PROCESSENTRY32);
       lOSVerInfo.dwOSVersionInfoSize := SizeOf(TOSVersionInfo);
       GetVersionEx(lOSVerInfo);
       case lOSVerInfo.dwPlatformId of
         VER_PLATFORM_WIN32_WINDOWS: lProcessName := AProcessName;
         VER_PLATFORM_WIN32_NT: lProcessName :=ExtractFileName(AProcessName);
       end;
       if Process32First(lSnapHandle, lProcStruct) then
       begin
       try
        repeat
         lSnapProcessName := lProcStruct.szExeFile;
         if AnsiUpperCase(lSnapProcessName) = AnsiUpperCase(lProcessName) then
         begin
           Result := lProcStruct.th32ProcessID;
           Break;
         end;
        until not Process32Next(lSnapHandle, lProcStruct);
       finally
       CloseHandle(lSnapHandle);
       end;
       end;
end;

procedure TForm1.Button1Click(Sender: TObject);
var
       hProcess: cardinal;
       path: string;
begin
       EnablePrivilege(INVALID_HANDLE_VALUE, 'SeDebugPrivilege');
       hProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, false,
                     GetProcessID('winlogon.exe'));
       begin
         path := FixProcessPath(getPathbyPID(hProcess));
         MessageBox(0,PChar(path),'',0);
       end;
       CloseHandle(hProcess);
end;