#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
// Process Name
char process_name[] = "Process.exe";
// Module Name
char module_name[] = "Module.dll";
//
// Error Message
//
void MessageError(TCHAR * msg)
{
// Local variable
DWORD eNum;
TCHAR Message[256];
TCHAR sysMsg[256];
TCHAR * p;
// Last Error
eNum = GetLastError( );
// Formatting error message
FormatMessage( FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, NULL, eNum, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), sysMsg, 256, NULL);
// Trim the end of the line and terminate it with a null
p = sysMsg;
while( ( *p > 31 ) || ( *p == 9 ) ) ++p;
do { *p-- = 0; } while( ( p >= sysMsg ) && ( ( *p == '.' ) || ( *p < 33 ) ) );
// Display the message
sprintf(Message, TEXT("\nWARNING: %s failed with error %d (%s)"
, msg, eNum, sysMsg );
// Print message
MessageBox(NULL, Message, "Error !!!", MB_OK);
}
//
// Main Program
//
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
// Local variable
DWORD Process;
DWORD ModuleAddress;
DWORD ModuleSize;
DWORD OldProtect;
PROCESSENTRY32 process;
MODULEENTRY32 module;
HANDLE snapshot;
BOOL gotime;
HANDLE phandle;
HANDLE hToken;
TOKEN_PRIVILEGES token;
PBYTE pMem;
DWORD Read;
// Get Full privilegies
if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &token.Privileges[0].Luid);
token.PrivilegeCount = 1;
token.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, 0, &token, sizeof(token), NULL, NULL);
}
// Init Process / Module size
process.dwSize = sizeof(process);
module.dwSize = sizeof(module);
// Init Search state
gotime = FALSE;
/*
* TH32CS_SNAPALL-> Includes all processes and threads in the system,
* plus the heaps and modules of the process specified in th32ProcessID.
*/
snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
// Search first process
Process32First(snapshot, &process);
// Search "Process.exe"
do
{
// Check found ...
if(strcmp(process.szExeFile, process_name) == 0)
{
// Save Process ID
Process = process.th32ProcessID;
// Find !!!
gotime = TRUE;
// End.
break;
}
} while (Process32Next(snapshot, &process));
// Close Search Process
CloseHandle(snapshot);
// Check found process
if (!gotime)
{
// Error
MessageError("Process not found"
;
// Exit
return(-1);
}
// Init Find Module
gotime = FALSE;
/*
* TH32CS_SNAPALL-> Includes all processes and threads in the system,
* plus the heaps and modules of the process specified in th32ProcessID.
*/
snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, Process);
// Search first module on process
Module32First(snapshot, &module);
// Search "Module.dll"
do
{
// Check found ...
if(strcmp(module.szModule, module_name) == 0)
{
// Save Module ID and Size
ModuleAddress = (DWORD)module.modBaseAddr;
ModuleSize = (DWORD)module.modBaseSize;
// Find !!!
gotime = TRUE;
// End.
break;
}
} while (Module32Next(snapshot, &module));
// Close Search Process
CloseHandle(snapshot);
// Check found process
if (!gotime)
{
// Error
MessageError("Module not found"
;
// Exit
return(-1);
}
// Get handle of "Process.exe"
phandle = OpenProcess(PROCESS_ALL_ACCESS, 0, Process);
// Check Open
if (phandle != 0)
{
// Allocate memory for Dump
pMem = (PBYTE)malloc(ModuleSize);
// Read Memory
ReadProcessMemory(phandle, (LPVOID)ModuleAddress, pMem, ModuleSize, &Read);
// Free Memory Dump
free(pMem);
// Close process
CloseHandle(phandle);
}
else
{
// Error
MessageError("Error Dump memory"
;
// Exit
return(-1);
}
// End
return (0);
}
