Untitled
unknown
plain_text
2 years ago
2.6 kB
6
Indexable
Never
#include <stdio.h> #include <windows.h> // Exception handler function void checkBits(DWORD pid) { /* check the bits of the process */ HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid); if (hProcess == NULL) { printf("Error: OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid) failed with error code %d\n", GetLastError()); return; } BOOL isWow64 = FALSE; if (!IsWow64Process(hProcess, &isWow64)) { printf("Error: !IsWow64Process(hProcess, &isWow64) failed with error code %d\n", GetLastError()); CloseHandle(hProcess); return; } if (isWow64) { printf("Process %d is running as a 32-bit process on a 64-bit system.\n", pid); } else { printf("Process %d is running as a 64-bit process.\n", pid); } CloseHandle(hProcess); } // Main function int main(int argc, char *argv[]) { // Check if target process ID was provided as argument if (argc < 2) { printf("Usage: %s <Process ID>\n", argv[0]); return 1; } // Convert target process ID from string to integer DWORD processId = atoi(argv[1]); checkBits(processId); // Attach to target process if (!DebugActiveProcess(processId)) { printf("Error attaching to process (error code %d)\n", GetLastError()); return 1; } // Loop indefinitely DEBUG_EVENT event; while (WaitForDebugEvent(&event, INFINITE)) { switch (event.dwDebugEventCode) { case EXCEPTION_DEBUG_EVENT: printf("Exception occurred with code 0x%08X at address 0x%p", event.u.Exception.ExceptionRecord.ExceptionCode, event.u.Exception.ExceptionRecord.ExceptionAddress); HMODULE moduleToTheAddress; if (!GetModuleHandleEx(0x00000004, (LPCSTR)event.u.Exception.ExceptionRecord.ExceptionAddress, &moduleToTheAddress)) { printf("Error GetModuleHandleEx(0x00000004, ptr, &moduleToTheAddress) (error code %d)\n", GetLastError()); }else{ char moduleName[MAX_PATH]; GetModuleFileName(moduleToTheAddress, moduleName, MAX_PATH); printf(" Module Name: %s", moduleName); } printf("\n"); ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE); break; default: ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE); break; } } // Detach from target process DebugActiveProcessStop(processId); return 0; }