search

frida / frida-core

Frida core library intended for static linking into bindings
https://frida.re
Other
618 stars 197 forks source link

Timeout attaching to process on Windows #2

Closed markwo closed 10 years ago

markwo commented 10 years ago

I'm using Python3.3 on Windows 8 64-bit and frida 1.0.7

When I try to attach to a process (I tried notepad.exe both 64-bit and 32-bit), I get this: C:\Python33>Scripts\frida-trace.exe -i "Insert*" 8320 Attaching... Failed to attach: timed out

I tested this running non-elevated (and accepting the UAC prompt), or running elevated (no UAC prompt). In both cases I get the same timeout message.

Later I realized the instance of notepad.exe I was trying to attach to was elevated (launched from an admin cmd console). When I launched a regular non-elevated instance of notepad, I can attach to it fine from a normal cmd console. Trying to attach from an elevated cmd console still fails.

It looks like frida apps launched from elevated consoles have issues attaching (to normal or elevated processes).

oleavr commented 10 years ago

Interesting. I will try to reproduce this issue in a 8.1 x64 VM this weekend. Thanks a lot for reporting!

egirault commented 10 years ago

Hi,

I'm having the same type of problem on Windows 7, using frida 1.0.10 and Python 2.7. I'm getting the "timed out" exception only when I'm running an elevated Python. Otherwise It runs just fine. I tested on both Win7 32 and 64 bits, injecting to 32/64 bits processes (elevated or not), the error is always there. No problem with XP though. I guess this might be due to a problem with the injector running as a service.

More, sometimes the target process crashes just after the timeout error. And when it doesn't, the machine sometimes freezes after the timeout error if I exit Python before exiting the target process.

oleavr commented 10 years ago

Aha. Thanks @egirault, I now have an idea what might be the issue. Basically Frida uses named pipes on Windows, and I suspect the ACL is wrong.

Regarding the crasher, I recently upgraded the Windows build system to VS2013 and discovered a Windows-specific build system issue that may lead to the target process crashing.

I'll try to get 1.0.11 out as soon as the "timed out" issue has been resolved (the crasher should be fixed in latest master).

oleavr commented 10 years ago

@markwo @egirault Would be awesome if you could try the freshly built binaries available here.

I will try to get 1.0.11 released this weekend, the only remaining blocker right now is that the first .attach() takes about 10 seconds on Windows, whilst the next attempts are blazing fast.

egirault commented 10 years ago

Thanks a lot :) It now works perfectly on Win 7 32 bits when injecting on user, elevated and SYSTEM processes. However on Win 7 64 bits I can only inject into user and elevated processes; when injecting into a SYSTEM process (lsass.exe for example) I get another error:

frida.attach(484) Traceback (most recent call last): File "", line 1, in File "C:\Python27\lib\site-packages\fridainit.py", line 10, in attach return get_device_manager().get_device(device_id).attach(target) File "C:\Python27\lib\site-packages\frida\core.py", line 66, in attach return Process(self._device.attach(self._pid_of(target))) SystemError: GDBus.Error:org.gtk.GDBus.UnmappedGError.Quark._g_2dio_2derror_2dquark.Code14: GDBus.Error:org.gtk.GDBus.UnmappedGError.Quark._g_2dio_2derror_2dquark.Code14: CreateRemoteThread(pid=484) failed: 5

2014-03-06 1:26 GMT+01:00 Ole André Vadla Ravnås notifications@github.com:

@markwo https://github.com/markwo @egiraulthttps://github.com/egiraultWould be awesome if you could try the freshly built binaries available herehttp://build.frida.re/frida/windows/Win32-Release/lib/python2.7/site-packages/ .

I will try to get 1.0.11 released this weekend, the only remaining blocker right now is that the first .attach() takes about 10 seconds on Windows, whilst the next attempts are blazing fast.

Reply to this email directly or view it on GitHubhttps://github.com/frida/frida-core/issues/2#issuecomment-36811910 .

oleavr commented 10 years ago

@egirault Great to hear, thanks for testing! I'll let you know when there's a new build, it's hopefully very easy to fix.

egirault commented 10 years ago

I still have some trouble attaching to 64-bit SYSTEM processes, but this time the error is different:

frida.attach(4100) # (lsass.exe) Traceback (most recent call last): File "", line 1, in File "C:\Python27\lib\site-packages\fridainit.py", line 10, in attach return get_device_manager().get_device(device_id).attach(target) File "C:\Python27\lib\site-packages\frida\core.py", line 66, in attach return Process(self._device.attach(self._pid_of(target))) SystemError: GDBus.Error:org.gtk.GDBus.UnmappedGError.Quark._g_2dio_2derror_2dquark.Code14: GDBus.Error:org.gtk.GDBus.UnmappedGError.Quark._g_2dio_2derror_2dquark.Code14: RtlCreateUserThread(pid=4100) failed: 0xc0000022

2014-03-09 3:09 GMT+01:00 Ole André Vadla Ravnås notifications@github.com:

Closed #2 https://github.com/frida/frida-core/issues/2 via b5736dehttps://github.com/frida/frida-core/commit/b5736deae51885ad6e541ba696b9caa21ab238de .

Reply to this email directly or view it on GitHubhttps://github.com/frida/frida-core/issues/2 .

ret2kw commented 10 years ago

I am getting the same error on Win7 x64 and a SYSTEM processes as egirault.

Using Python 2.7.5 x64 and Frida 1.6.8