Untitled
unknown
plain_text
2 years ago
1.8 kB
2
Indexable
Never
#include <stdio.h> #include <windows.h> // Main function int main(int argc, char *argv[]) { // Check if target process ID was provided as argument if (argc < 2) { printf("Usage: %s <Process ID>\n", argv[0]); return 1; } // Convert target process ID from string to integer DWORD processId = atoi(argv[1]); // Attach to target process if (!DebugActiveProcess(processId)) { printf("Error attaching to process (error code %d)\n", GetLastError()); return 1; } // Loop indefinitely DEBUG_EVENT event; while (WaitForDebugEvent(&event, INFINITE)) { switch (event.dwDebugEventCode) { case EXCEPTION_DEBUG_EVENT: printf("Exception occurred with code 0x%08X at address 0x%p", event.u.Exception.ExceptionRecord.ExceptionCode, event.u.Exception.ExceptionRecord.ExceptionAddress); HMODULE moduleToTheAddress; if (GetModuleHandleEx(0x00000004, (LPCSTR)event.u.Exception.ExceptionRecord.ExceptionAddress, &moduleToTheAddress) != 0) { printf("Error GetModuleHandleEx(0x00000004, ptr, &moduleToTheAddress) (error code %d)\n", GetLastError()); }else{ char moduleName[MAX_PATH]; GetModuleFileName(moduleToTheAddress, moduleName, MAX_PATH); printf(" Module Name: %s", moduleName); } printf("\n"); ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE); break; default: ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE); break; } } // Detach from target process DebugActiveProcessStop(processId); return 0; }