An exercise in filtering.
That’s not a pointer. This is a pointer.
Usually because you are out of memory, but really it’s when you’re out of commit.
It’s not there until somebody demands it.
Even if you could, it wouldn’t help you.
Look at the bigger picture.
GetFullPathName will tell you.
I thought that was the point of page heap.
Congratulations, you reinvented PulseEvent.
There’s the naïve solution and a sneakier one.