Solved

How do I find a list of all processes currently being debuged?

Posted on 2003-11-02
7
567 Views
Last Modified: 2010-05-18
If I want to get a list of all the processes currently being debuged, how would I do that?

I am looking for all the thread IDs that are involved in the debug process linked to the ProcessID.

So... I am looking for the ProcessID + ThreadIDs of processes being debuged

Please help!!!

Thank you
0
Comment
Question by:HoratioH
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 5

Expert Comment

by:Hypoviax
ID: 9675673
Try this modifying this to get a list of running processes. I do not exactly no what you are refering to so i hope this leads ou in the direction you want to head:

function KillTask(ExeFileName: string): integer;
const
  PROCESS_TERMINATE=$0001;
var
  ContinueLoop: BOOL;
  FSnapshotHandle: THandle;
  FProcessEntry32: TProcessEntry32;
begin
  result := 0;
  FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  FProcessEntry32.dwSize := Sizeof(FProcessEntry32); //use FProcessEntry32.szPID to
                                                                                   //get PID
  ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
  while integer(ContinueLoop) <> 0 do begin
    if (StrIComp(PChar(ExtractFileName(FProcessEntry32.szExeFile)), PChar(ExeFileName)) = 0)
       or (StrIComp(FProcessEntry32.szExeFile, PChar(ExeFileName)) = 0)  then
      Result := Integer(TerminateProcess(OpenProcess(
                        PROCESS_TERMINATE, BOOL(0), // BOOL(0) means 'false'
                        FProcessEntry32.th32ProcessID), 0));
    ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
  end;
  CloseHandle(FSnapshotHandle);
end;

procedure TForm1.Button2Click(Sender: TObject);
begin
  KillTask(Edit1.Text); // 'notepad.exe' for example
end;

Regards,

Hypoviax
0
 

Author Comment

by:HoratioH
ID: 9676622
I know how to do this :(

I need to know how to identify that this process in the list is being debuged.
0
 

Author Comment

by:HoratioH
ID: 9681526
Well now I need to know if this thread and process in the list is being Suspended?
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 
LVL 5

Expert Comment

by:Hypoviax
ID: 9692324
Sorry mate.
0
 
LVL 6

Accepted Solution

by:
GloomyFriar earned 150 total points
ID: 9721651
Here is a small addition to the code I've sent to you before.
It'll give you suspended threads.

scnt: DWORD;

...
        if (Thread32First(hSnapshoot, the32)) then
        repeat
            ShowMessage('Got thread!');
            hDestTh := _imp_OpenThread(THREAD_ALL_ACCESS, False, the32.th32ThreadID);
            scnt := SuspendThread(hDestTh);
            if scnt > 0 then begin
              ShowMessage('The thread is suspended !');
            end;
            ResumeThread(hDestTh);
        until not Thread32Next(hSnapshoot, the32);
...
0
 
LVL 20

Expert Comment

by:Madshi
ID: 9797668
You could call "IsDebuggerPresent" in the context of each process. Not easy to do, though. Maybe my components can help you a bit. E.g. calling madRemote's RemoteExecute can let you execute a function in the context of another process. So you could call "IsDebuggerPresent" there.

http://help.madshi.net
0
 
LVL 20

Expert Comment

by:Madshi
ID: 9797677
P.S: I think in win9x debugged processes have some special flags in the process database. But first of all you would need to get access to the process database. <sigh>
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Objective: - This article will help user in how to convert their numeric value become words. How to use 1. You can copy this code in your Unit as function 2. than you can perform your function by type this code The Code   (CODE) The Im…
Introduction The parallel port is a very commonly known port, it was widely used to connect a printer to the PC, if you look at the back of your computer, for those who don't have newer computers, there will be a port with 25 pins and a small print…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

825 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question