Untitled
unknown
plain_text
3 years ago
2.6 kB
12
Indexable
#include <stdio.h>
#include <windows.h>
// Exception handler function
void checkBits(DWORD pid) {
/* check the bits of the process */
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
if (hProcess == NULL) {
printf("Error: OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid) failed with error code %d\n", GetLastError());
return;
}
BOOL isWow64 = FALSE;
if (!IsWow64Process(hProcess, &isWow64)) {
printf("Error: !IsWow64Process(hProcess, &isWow64) failed with error code %d\n", GetLastError());
CloseHandle(hProcess);
return;
}
if (isWow64) {
printf("Process %d is running as a 32-bit process on a 64-bit system.\n", pid);
} else {
printf("Process %d is running as a 64-bit process.\n", pid);
}
CloseHandle(hProcess);
}
// Main function
int main(int argc, char *argv[]) {
// Check if target process ID was provided as argument
if (argc < 2) {
printf("Usage: %s <Process ID>\n", argv[0]);
return 1;
}
// Convert target process ID from string to integer
DWORD processId = atoi(argv[1]);
checkBits(processId);
// Attach to target process
if (!DebugActiveProcess(processId)) {
printf("Error attaching to process (error code %d)\n", GetLastError());
return 1;
}
// Loop indefinitely
DEBUG_EVENT event;
while (WaitForDebugEvent(&event, INFINITE)) {
switch (event.dwDebugEventCode) {
case EXCEPTION_DEBUG_EVENT:
printf("Exception occurred with code 0x%08X at address 0x%p", event.u.Exception.ExceptionRecord.ExceptionCode, event.u.Exception.ExceptionRecord.ExceptionAddress);
HMODULE moduleToTheAddress;
if (!GetModuleHandleEx(0x00000004, (LPCSTR)event.u.Exception.ExceptionRecord.ExceptionAddress, &moduleToTheAddress)) {
printf("Error GetModuleHandleEx(0x00000004, ptr, &moduleToTheAddress) (error code %d)\n", GetLastError());
}else{
char moduleName[MAX_PATH];
GetModuleFileName(moduleToTheAddress, moduleName, MAX_PATH);
printf(" Module Name: %s", moduleName);
}
printf("\n");
ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE);
break;
default:
ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE);
break;
}
}
// Detach from target process
DebugActiveProcessStop(processId);
return 0;
}Editor is loading...