Get context of a remote process

Question

Hi. 
So I am trying to get the register values of other process when I receive a Debug Event. 
Right now I have everything set it up but when I call the function "GetThreadContext" it returns the error code 0x6 (Wrong handler). All the debugging part is working perfectly. 
Here is my code:
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
if (!hProc)
printf("OpenProcess failed");
return FALSE;
if (!SetSecurityInfo(hProc, SE_KERNEL_OBJECT, THREAD_GET_CONTEXT, NULL, NULL, NULL, NULL))
printf("Wrror");
DWORD oldProtect = 0;
int *base_address = (int*)0x00401000;
int *breakpoint_address = (int*)0x004165DA;
if (!VirtualProtectEx(hProc, base_address, 1708032, PAGE_EXECUTE_READWRITE, &oldProtect)){
printf("Error with the memory address perms change\n");
//set the BP
if (!WriteProcessMemory(hProc, breakpoint_address, "\xCC", 1, NULL))
printf("Error");
//Now we attach to the process and activelly debug it
DebugActiveProcess(pid);
int temp = 0;
DEBUG_EVENT DBEvent;
int flag = 0;
while (flag==0)
WaitForDebugEvent(&DBEvent, INFINITE);
switch (DBEvent.dwDebugEventCode)
case EXCEPTION_DEBUG_EVENT:
switch (DBEvent.u.Exception.ExceptionRecord.ExceptionCode)
case EXCEPTION_BREAKPOINT:
//Suspend the process
if (!SuspendThread(hProc)){
printf("Error suspending\n");
static CONTEXT threadContext;
memset(&threadContext, 0, sizeof(CONTEXT));
threadContext.ContextFlags = CONTEXT_FULL;
if (!GetThreadContext(hProc, &threadContext)){
DWORD error_code=GetLastError();
printf("Error getting thread conntext\n");
flag = 1;
WriteProcessMemory(hProc, breakpoint_address, "\x50", 1, NULL);
break;
break;
Why is it failing?
thank you for your help!

Answer 1

On 3/11/2015 8:03 PM, JhonSnow wrote:
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
        //Suspend the process
        if (!SuspendThread(hProc)){
SuspendThread expects a thread handle, not a process handle.
        if (!GetThreadContext(hProc, &threadContext)){
So does GetThreadContext.
See also DEBUG_EVENT::dwThreadId and OpenThread
Igor Tandetnik