I want to dump the memory of a process with PID. Here is my code below :
#include <cstdio>
#include <windows.h>
#include <DbgHelp.h>
#include <tlhelp32.h>
void EnableDebugPriv()
{
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = luid;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL);
CloseHandle(hToken);
}
int main( int, char *[] )
{
EnableDebugPriv();
DWORD procid = 880;
HANDLE myfile = CreateFile(L"test.out", GENERIC_ALL, 0,
NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL,NULL);
HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procid);
printf("%d", processHandle);
if (processHandle = nullptr) {
printf("error while getting handle");
}
MiniDumpWriteDump(processHandle, procid, myfile, MiniDumpWithFullMemory,
NULL, NULL, NULL);
DWORD error = GetLastError();
printf("%d",error);
}
I use EnableDebugPriv() because I need admin rights to execute correctly my program.
Unfortunately the dump.out file is always empty, while the handle is not null, and I can't find why this issue happens ? (The process I want to dump is around 75mb with other tools like ProcDump).
Edit : Here is the error code given by GetLastError() : -2147024597