[Bug 50195] New: x64dbg snapshots >= 2020-11-12_05-12 need ntdll.dll.NtDebugActiveProcess implementation to debug process via attach

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50195

Bug ID: 50195
           Summary: x64dbg snapshots >= 2020-11-12_05-12 need
                    ntdll.dll.NtDebugActiveProcess implementation to debug
                    process via attach
           Product: Wine
           Version: 5.22
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: ntdll
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Hello folks,

continuation of bug 50194

--- snip ---
$ wine ./x32dbg.exe 
...
0144:fixme:process:NtCreateDebugObject (0x7ff72f24 1f000f 0x614fe78 0), stub!
0144:fixme:process:NtDebugActiveProcess (0x214 (nil)), stub!
--- snip ---

Wine source:

https://source.winehq.org/git/wine.git/blob/40d4fbe45997a1820296e7909ba22125...

--- snip ---
1747 /**********************************************************************
1748  *           NtDebugActiveProcess  (NTDLL.@)
1749  */
1750 NTSTATUS WINAPI NtDebugActiveProcess( HANDLE process, HANDLE debug_object
)
1751 {
1752     FIXME( "(%p %p), stub!\n", process, debug_object );
1753     return STATUS_SUCCESS;
1754 }
--- snip ---

The problem here is that debuggers expect to receive startup debug events about
process/thread creation, loading of modules etc. If they are not received, the
debugger can't synchronize its state machine in the debugger loop.

$ sha1sum snapshot_2020-11-12_05-12.zip 
6e88d4ce8fb967d08b381084f9ab805e5bcc4f18  snapshot_2020-11-12_05-12.zip

$ du -sh snapshot_2020-11-12_05-12.zip 
32M    snapshot_2020-11-12_05-12.zip

$ wine --version
wine-5.22-96-g4957599bbf5

Regards

[Bug 50195] x64dbg snapshots >= 2020-11-12_05-12 need ntdll.dll.NtDebugActiveProcess implementation to debug process via attach

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50195

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
                URL|                            |https://sourceforge.net/pro
                   |                            |jects/x64dbg/files/snapshot
                   |                            |s/snapshot_2020-11-12_05-12
                   |                            |.zip/download

[Bug 50195] x64dbg snapshots >= 2020-11-12_05-12 need ntdll.dll.NtDebugActiveProcess implementation to debug process via attach

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50195

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|https://sourceforge.net/pro |https://web.archive.org/web
                   |jects/x64dbg/files/snapshot |/20210127234740/https://git
                   |s/snapshot_2020-11-12_05-12 |hub.com/x64dbg/x64dbg/relea
                   |.zip/download               |ses/download/snapshot/snaps
                   |                            |hot_2021-01-14_13-25.zip

--- Comment #1 from Anastasius Focht  ---
Hello folks,

this is fixed by commit
https://source.winehq.org/git/wine.git/commitdiff/46b84e7a83beae7484e6daac16...
("ntdll: Implement NtDebugActiveProcess() and NtRemoveProcessDebug().") and
related commits in the series.

Thanks Alexandre.

--- snip ---
$ git remote -v
...
origin    git://source.winehq.org/git/wine.git (fetch)

$ git log --oneline 46b84e7a83b^...7999af82448
7999af82448 ntdll: Implement NtWaitForDebugEvent().
d848a25b765 ntdll: Implement DbgUiConvertStateChangeStructure().
c8f5cced471 ntdll: Implement NtDebugContinue().
7bebf7db8c2 ntdll: Implement NtSetInformationDebugObject().
46b84e7a83b ntdll: Implement NtDebugActiveProcess() and NtRemoveProcessDebug().
--- snip ---

Latest x64dbg snapshot used for testing:

https://web.archive.org/web/20210127234740/https://github.com/x64dbg/x64dbg/...

Prerequisite:

* workaround for bug 45916 (WINEDLLOVERRIDES=msvcr120,msvcp120=n,b)

Tests with x32dbg:

* start 32-bit process in debugger (entry point)
* attaching to running 32-bit process (pause/breakin)
* symbol loading (Wine builtins PDB)
* further debugging (stepping, breakpoints)

Tests with x64dbg:

* start 64-bit process in debugger (entry point)
* attaching to running 64-bit process (pause/breakin)
* symbol loading (Wine builtins PDB)
* further debugging (stepping, breakpoints)

Felt a bit like unwrapping late christmas gift ;-)

$ sha1sum snapshot_2021-01-14_13-25.zip 
e39756243f419db6f4d2213227ab266ae0618163  snapshot_2021-01-14_13-25.zip

$ du -sh snapshot_2021-01-14_13-25.zip 
32M    snapshot_2021-01-14_13-25.zip

$ wine --version
wine-6.1-38-gcfbbde2abce

Regards

[Bug 50195] x64dbg snapshots >= 2020-11-12_05-12 need ntdll.dll.NtDebugActiveProcess implementation to debug process via attach

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50195

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED
      Fixed by SHA1|                            |46b84e7a83beae7484e6daac167
                   |                            |39a2b9238f68e

--- Comment #2 from Anastasius Focht  ---
Hello folks,

resolving now.

Regards

[Bug 50195] x64dbg snapshots >= 2020-11-12_05-12 need ntdll.dll.NtDebugActiveProcess implementation to debug process via attach

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=50195

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Alexandre Julliard  ---
Closing bugs fixed in 6.2.