Untitled
unknown
plain_text
2 years ago
2.4 kB
6
Indexable
// Loop indefinitel DEBUG_EVENT event; while (WaitForDebugEvent(&event, INFINITE)) { switch (event.dwDebugEventCode) { case EXCEPTION_DEBUG_EVENT: printf("Exception occurred with code 0x%08X at address 0x%p ", event.u.Exception.ExceptionRecord.ExceptionCode, event.u.Exception.ExceptionRecord.ExceptionAddress); HMODULE moduleToTheAddress; if (!GetModuleHandleEx(0x00000004, (LPCSTR)event.u.Exception.ExceptionRecord.ExceptionAddress, &moduleToTheAddress)) { printf("Error GetModuleHandleEx(0x00000004, ptr, &moduleToTheAddress) (error code %d)\n", GetLastError()); /* Enumerating Modules Loaded */ HANDLE processHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processId); if (processHandle == NULL) { printf("Failed to open process handle.\n"); return 0; } HMODULE moduleTaken = RemoteAddressToModule( processHandle, (void*) event.u.Exception.ExceptionRecord.ExceptionAddress ); char moduleName[MAX_PATH]; GetModuleFileNameEx(processHandle, moduleTaken, moduleName, MAX_PATH); printf(" Module Name: %s", moduleName); CloseHandle(processHandle); }else{ char moduleName[MAX_PATH]; GetModuleFileName(moduleToTheAddress, moduleName, MAX_PATH); printf(" Module Name: %s", moduleName); /* Enumerating Modules Loaded */ HANDLE processHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processId); if (processHandle == NULL) { printf("Failed to open process handle.\n"); return 0; } HMODULE moduleTaken = RemoteAddressToModule( processHandle, (void*) event.u.Exception.ExceptionRecord.ExceptionAddress ); char moduleName2[MAX_PATH]; GetModuleFileNameEx(processHandle, moduleTaken, moduleName2, MAX_PATH); printf(" Module Name: %s", moduleName2); CloseHandle(processHandle); } printf("\n"); ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE); break; default: ContinueDebugEvent(event.dwProcessId, event.dwThreadId, DBG_CONTINUE); break; } } DebugSetProcessKillOnExit(FALSE); // Detach from target process DebugActiveProcessStop(processId);
Editor is loading...