search

Vector35 / debugger

Binary Ninja debugger
Other
211 stars 14 forks source link

Windows debugger cannot launch the target when used in a VM without any network interface #567

Open xusheng6 opened 7 months ago

xusheng6 commented 7 months ago

The user tries to debug a binary in a Hype-V VM. The VM has no internet connection. The error message is:

ConnectToDebugServerInternal timeout
Failed to connect process server

On the other hand, things work perfectly when the VM is connected to the Internet.

I suspect this is related to the synbol server handling in DbgEng, but it is still weird because this failure is so early. Previously, I have observed a hang when one uses the debugger on a box that appears to have network, but is not actually connected to the Internet

xusheng6 commented 6 months ago

I can also reproduce this on a Virtualbox VM with no network interface configured

xusheng6 commented 6 months ago

Also this has nothing to do with Internet, I tested and found that, as long as there is a network interface, even if it is not attached to anything, the debugging will work. A temporary workaround for this issue is to create a network interface for the VM, but do not attach it to any actual network

xusheng6 commented 6 months ago

This is more complicated than I have expected. It seems a bug in the DbgEng DLLs. I can reproduce this with the dbgsrv.exe that omes with WinDbg as well. However, this is really not expected -- things should just work in the same way.

I checked and WinDbg is doing the debugging slightly different than our approach. It is running an EngHost.exe (which seems to be an engine host), and then use DebugConnect (https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/dbgeng/nf-dbgeng-debugconnect) to connect to it. DebugConnect does not have the same bug

xusheng6 commented 6 months ago

However, using DebugConnect seems to require that the access to the engine to be made from the same thread, which our current implementation is violating.