Untitled

mail@pastecode.io avatar
unknown
plain_text
2 years ago
2.6 kB
6
Indexable
Never
#include <stdio.h>
#include <windows.h>

// Exception handler function
void checkBits(DWORD pid) {
    /* check the bits of the process */
	HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
    if (hProcess == NULL) {
        printf("Error: OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid) failed with error code %d\n", GetLastError());
        return;
    }

	BOOL isWow64 = FALSE;
    if (!IsWow64Process(hProcess, &isWow64)) {
        printf("Error: !IsWow64Process(hProcess, &isWow64) failed with error code %d\n", GetLastError());
        CloseHandle(hProcess);
        return;
    }

    if (isWow64) {
        printf("Process %d is running as a 32-bit process on a 64-bit system.\n", pid);
    } else {
        printf("Process %d is running as a 64-bit process.\n", pid);
    }

    CloseHandle(hProcess);
}

// Main function
int main(int argc, char *argv[]) {
    // Check if target process ID was provided as argument
    if (argc < 2) {
        printf("Usage: %s <Process ID>\n", argv[0]);
        return 1;
    }
	


    // Convert target process ID from string to integer
    DWORD processId = atoi(argv[1]);

	checkBits(processId);

    // Attach to target process
    if (!DebugActiveProcess(processId)) {
        printf("Error attaching to process (error code %d)\n", GetLastError());
        return 1;
    }

    // Loop indefinitely
    DEBUG_EVENT event;
    while (WaitForDebugEvent(&event, INFINITE)) {
        switch (event.dwDebugEventCode) {
            case EXCEPTION_DEBUG_EVENT:
                printf("Exception occurred with code 0x%08X at address 0x%p", event.u.Exception.ExceptionRecord.ExceptionCode, event.u.Exception.ExceptionRecord.ExceptionAddress);
				HMODULE moduleToTheAddress;
				if (!GetModuleHandleEx(0x00000004, (LPCSTR)event.u.Exception.ExceptionRecord.ExceptionAddress, &moduleToTheAddress)) {
					printf("Error GetModuleHandleEx(0x00000004, ptr, &moduleToTheAddress) (error code %d)\n", GetLastError());
				}else{
					char moduleName[MAX_PATH];
					GetModuleFileName(moduleToTheAddress, moduleName, MAX_PATH);
					printf(" Module Name: %s", moduleName);
				}
				printf("\n");
				ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE);
                break;
            default:
                ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE);
                break;
        }
    }

    // Detach from target process
    DebugActiveProcessStop(processId);

    return 0;
}