Debugactiveprocess Error 87

:: View next topic Author Message wh1t3yAdvanced CheaterReputation: 1Joined: 09 May 2003Posts: 85Location: Missouri Posted: Mon Jan 05, 2004 8:35 pm Post subject: BUG: Lockup after attaching a debugger Game: Need for Speed: Underground when i first attached a debugger to the nfsU proccess it gave me an error (87 i think) and it said it couldnt attach it and it loses the process so when i go to reselect it it tries to detach the debugger that was never attached in the first place and locks up. _________________(( / wh1t3y / )) ...yeah i guess that's cool... Back to top Dark ByteSite AdminReputation: 314Joined: 09 May 2003Posts: 18764Location: The netherlands Posted: Mon Jan 05, 2004 8:48 pm Post subject: Really a lockup? That detach should take only 30 seconds. But I'll look into it. was the Error: "Cheat Engine failed to attach to the process. (Error=87)" ? Also, error 87="Invalid parameter" The only parameter that the DebugActiveProcess api gets is the process ID. Where did you attach the debugger, in the process list, or when using an option that uses the debugger ? If it was in the processlist you most likely had "00000000-[system process]" selected (by accident?) The crash after that was because I forgot to destroy the debuggerthread after such an error. (I fixed it) Back to top wh1t3yAdvanced CheaterReputation: 1Joined: 09 May 2003Posts: 85Location: Missouri Posted: Mon Jan 05, 2004 10:40 pm Post subject: yeah thats what it was.. but it was an invalid handle.. and i also tried both process and the window list _________________(( / wh1t3y / )) ...yeah i guess that's cool... Back to top Display posts from previous: All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours Page 1 of 1 Jump to:Select a forumCheat Engine----------------Cheat EngineCheat Engine Lua ScriptingCheat Engine TutorialsGeneral GamehackingAuto Assembler tutorialsPointer tutorialsGame specific tutorialsWebbrowser stuff related tutorialsConsole ModdingLUA TutorialsLua ExtensionsGeneral Discussions----------------General DiscussionsArtComputer TalkRandom spamArt RequestsArt TutorialsWillekeurige RotzooiGuestsHorse ExcrementCheat Requests----------------Single player cheat requestCheat Engine Downloads----------------TablesTrainersAuto Assemble scriptsCoding----------------Cheat Engine SourceCETC Server and ClientsDBVMPlugin developmentGeneral programmingBinariesCrackmesGeneral programming+Game Development2D Graphics3D ModelingGameplay designWeb DevelopmentGames----------------Flash GamesGaia OnlineStick Arena Y

and then debug it. BOOL DebugActiveProcess( DWORD dwProcessId // process to be debugged ); Parameters dwProcessId Specifies the identifier for the process to be debugged. The debugger gets debugging access to the process as if it created the process with the DEBUG_ONLY_THIS_PROCESS flag. Return Values If the function succeeds, the return value is nonzero. If the function fails, the return value is zero. To get extended error information, call GetLastError. Remarks The debugger must have appropriate access to the target process; it must be http://www.cheatengine.org/forum/viewtopic.php?t=67&sid=d64b8b297a97963ff0e0e6420a21413e able to open the process for PROCESS_ALL_ACCESS access. In the Win32 application programming interface (API) for Windows 95, this is always true if the process identifier is valid. However, in the Win32 API for Windows NT, DebugActiveProcess can fail if the target process was created with a security descriptor that denies the debugger appropriate access. After the system checks http://winapi.freetechsecrets.com/win32/WIN32DebugActiveProcess.htm the process identifier and determines that a valid debugging attachment is being made, the function returns TRUE. The debugger is then expected to wait for debugging events by using the WaitForDebugEvent function. The system suspends all threads in the process and sends the debugger events representing the current state of the process. The system sends the debugger a single CREATE_PROCESS_DEBUG_EVENT debugging event representing the process specified by the dwProcessId parameter. The lpStartAddress member of the CREATE_PROCESS_DEBUG_INFO structure is NULL. For each thread currently part of the process, the system sends a CREATE_THREAD_DEBUG_EVENT debugging event. The lpStartAddress member of the CREATE_THREAD_DEBUG_INFO structure is NULL. For each dynamic-link library (DLL) currently loaded into the address space of the target process, the system sends a LOAD_DLL_DEBUG_EVENT debugging event. The system arranges for the first thread in the process to execute a breakpoint instruction after it resumes. Continuing this thread causes it to return to whatever it was doing before the debugger was attached. After all of this has been done, the system resumes all threads in the proc

here for a quick overview of the site Help Center Detailed answers to any questions you might have Meta Discuss the workings and http://stackoverflow.com/questions/20807108/pythondebugger-from-gray-hat-python policies of this site About Us Learn more about Stack Overflow the http://ezbeat.tistory.com/372 company Business Learn more about hiring developers or posting ads with us Stack Overflow Questions Jobs Documentation Tags Users Badges Ask Question x Dismiss Join the Stack Overflow Community Stack Overflow is a community of 4.7 million programmers, just like you, helping each other. Join them; it only takes debugactiveprocess error a minute: Sign up PythonDebugger from Gray Hat Python up vote 1 down vote favorite I am reading Gray Hat Python I copied the code form the book but it dosen't seem to work. Other people are having problems with this book too, but not at the stage where i am at. I copied the my_debugger_defines.py as described in the book from debugactiveprocess error 87 here: http://dpunkt.de/leseproben/3245/Quellcodes.zip There is a my_debugger.py inside too and I also tried it, dosen't work. Yes I am using Python 2.5 as required The Problem is that it puts out : "[*] Unable to attach to the process. There was an error" And i honestly have no idea where the problem could be. Here is my version of the my_debugger.py (don't worry about german comments) from ctypes import * from my_debugger_defines import * kernel32 = windll.kernel32 class debugger(): def __init__(self): self.h_process = None self.pid = None self.debugger_active = False def load(self, path_to_exe): #Bestimmt wie der Prozess zu erzeugen ist, zb CREATE_NEW_CONSOLE creation_flags = DEBUG_PROCESS #Strukturen instanzieren startupinfo = STARTUPINFO() process_information = PROCESS_INFORMATION() #die beiden flags ermoeglichen es den prozess in einem eigenen fenster da zu stellen startupinfo.dwFlags = 0x1 startupinfo.wShowWindow = 0x0 #cb Countbyte startupinfo.cb = sizeof(startupinfo) if kernel32.CreateProcessA(path_to_exe, None, None, None, None, creation_flags, None, None, byref(startupinfo), byref(process_information) ): print "[*] Process erfolgreich gestarted" print "[*] PID: %d" % process_information.dwProcessId else: print "[*] Erorr: 0x%08x" % kernel32.GetLastError() #Anfordern des gewuenschten Access fuer einen Prozess mit der angegeben pid def open_process(self, pid): h_pr

검사할 때 어떠한 방식으로 알아보려고 리버싱을 시도하려는데이와 같은 창이 뜨게됩니다. 해당 프로세스를 어테치를 할 수가 없습니다.그래서 시작한 아바스트 어테치하기... 얼른 끝나면 좋으려만;ㅋ사실 해보면서 글 작성하고 있는 겁니다.왜냐하면.. 이렇게 글을 쓰기 시작해놔야 글 완성을 위해서라도 끝까지 하게되기 때문이죠.저의 게으름성을 채찍질하기 위함?Avast 는 아래와 같이 기본적으로 2개의 프로세스로 작동하고 있습니다. 두 프로세스다 어테치가 안되는 건 당연..일단 ollydbg에서 attach를 실패하는 것으로보아 AvastUI.exe의 pid를 가지고OpenProcess 할 때 함수가 실패하고 있는 것으로 생각했습니다.그리고 그렇게 생각했던 이유 중 가장 큰 원인이..NtOpenProcess가 SSDT 후킹 되어 있다는 점이었습니다. 바로 아바스트 시스템 파일에 의해 말이죠.하..지..만.. =_= 그건 저의 명백한 착각..아무리 커널 디버깅을 해서 봐보아도 일반 계산기를 attach할 때와 avastui.exe를 attach 할 때와의 차이점이 없는 것입니다.NtOpenProcess 성공적으로 호출되구요. 아무튼 아니라는 겁니다.근데 당연한 거지만 저도 이 짓을 하면서 처음 알았는데 올리디버거에서 Attach를 눌렀을 때 뜨는 바로 이창..이 창에서 나오는 프로세스들은 OpenProcess가 성공해야만 나오는 것이었습니다.고로 AvastUI.exe가 저기 나온걸로 보아 OpenProcess는 무조건 성공 -0-;; 아.. 허무허무..그러면 다른 함수로 눈을 돌려야겠죠. 어테치가 안된다고 에러메시지창이 떴을 때 루틴을 봐보니DebugActiveProcess 함수가 실패하고 있었던 것입니다. AvastUI.exe를 attach하려고 했을 때 말이죠.Ollydbg에서.. 보이는 루틴IDA에서 보이는 루틴똑같은 주소에 있는 루틴인데 왜 올디에선 저렇게 보이는지.. -_-;;;;하지만 hex 값을 보아�