Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash when attaching to binary #14

Open
metal-crow opened this issue Jul 4, 2017 · 5 comments
Open

Crash when attaching to binary #14

metal-crow opened this issue Jul 4, 2017 · 5 comments
Labels

Comments

@metal-crow
Copy link

After setting up a YaCo in the same folder, attempting to attach to a running binary (via debugger->attach to process) causes IDA 6.8 to crash. Verified this is a Yaco specific bug, not an IDA one, since using the non-local database can attach successfully, and renaming the _local database to anything else causes YaCo to alert that "the database doesn't match a YaCo project. YaCo is disabled" after which the database can successfully attach to the process.

I can upload the IDA dmp file if you believe that may be of use, but unfortunately there appear to be no other logs IDA uses to keep information about the crash. Is there some means of debugging YaCo I can use?

Windows 10, IDA 6.8.150423 32 bit with Hexrays, YaCo v1.5-6 (using distributed binaries)

@goulou
Copy link
Contributor

goulou commented Jul 5, 2017

Yaco tracks every modification made to the base either by the user or by IDA itself. Unfortunately, attaching to a debugger means that IDA will rebase the whole binary and add several segments, which is a huge modification to propagate to other users...
I would not expect YaCo to crash in this scenario, but I would not expect it to work either...
We can eventually fix the crash, but I don't see how YaCo can support debugging in any way.
As a workaround, I would advise to copy the_local file and use it for debugging.

@metal-crow
Copy link
Author

ah, that's unfortunate, but understandable. So for editing while in debug mode, the workaround would be: rename the _local database, debug and comment, detach, rename back to _local, commit changes?

@goulou
Copy link
Contributor

goulou commented Jul 5, 2017

That won't work either, because YaCo won't be notified of the changes.
The easy way is to document the YaCo base while debugging with another ida instance.
The correct way would be to improve YaCo so that it is automatically disabled during debugging, but still receives the notifications and remaps the addresses in the "normal address space" by taking into account the rebase that occurred when attaching to the debugger. But that is a lot of work!

@metal-crow
Copy link
Author

Oh, alright. That would be a very desirable addition, since I like to use IDA as a dynamic analysis tool. But i understand that is a large amount of work. Thank you.

@bamiaux bamiaux added the bug label Jul 21, 2017
@bamiaux
Copy link
Contributor

bamiaux commented Sep 20, 2018

It will be slow, like very slow, but it should not crash anymore

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants