Untitled

mail@pastecode.io avatar
unknown
plain_text
2 years ago
1.8 kB
2
Indexable
Never
#include <stdio.h>
#include <windows.h>

// Main function
int main(int argc, char *argv[]) {
    // Check if target process ID was provided as argument
    if (argc < 2) {
        printf("Usage: %s <Process ID>\n", argv[0]);
        return 1;
    }

    // Convert target process ID from string to integer
    DWORD processId = atoi(argv[1]);

    // Attach to target process
    if (!DebugActiveProcess(processId)) {
        printf("Error attaching to process (error code %d)\n", GetLastError());
        return 1;
    }

    // Loop indefinitely
    DEBUG_EVENT event;
    while (WaitForDebugEvent(&event, INFINITE)) {
        switch (event.dwDebugEventCode) {
            case EXCEPTION_DEBUG_EVENT:
                printf("Exception occurred with code 0x%08X at address 0x%p", event.u.Exception.ExceptionRecord.ExceptionCode, event.u.Exception.ExceptionRecord.ExceptionAddress);
                HMODULE moduleToTheAddress;
                if (GetModuleHandleEx(0x00000004, (LPCSTR)event.u.Exception.ExceptionRecord.ExceptionAddress, &moduleToTheAddress) != 0) {
                    printf("Error GetModuleHandleEx(0x00000004, ptr, &moduleToTheAddress) (error code %d)\n", GetLastError());
                }else{
                    char moduleName[MAX_PATH];
                    GetModuleFileName(moduleToTheAddress, moduleName, MAX_PATH);
                    printf(" Module Name: %s", moduleName);
                }
                printf("\n");
                ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE);
                break;
            default:
                ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE);
                break;
        }
    }

    // Detach from target process
    DebugActiveProcessStop(processId);

    return 0;
}