Debugger hang problem #1341

Open
hulucc opened this Issue Dec 2, 2016 · 6 comments

Projects

None yet

5 participants

@hulucc
hulucc commented Dec 2, 2016

Windows10 10586 enterprise 64bit
x64dbg v25 compiled on: Dec 1 2016, 22:29:29
ScyllaHide(profile:Themida x86)
Reproduce the problem:

  1. Load the unpackme.exe
  2. Press shift+F9 to run it
  3. Close the unpackme window
  4. Hang

Target:
unpackme.zip
Crashdump:
dump-02122016_1654220665.zip

@d3v1l401
d3v1l401 commented Dec 5, 2016

Same situation, loading a x32 executable with ScyllaHide (updated Nt*.ini) simply throws me a loop of ACCESS_DENIED into the log and if you try to close it just crashes.

Simply, seems there're some problems with Win 10.

@d3v1l401
d3v1l401 commented Dec 5, 2016

Adding information:
If you rename the plugins folder (therefore disabling plugins) you'll be able to debug without any problem.
There's a plugin who's giving problems, not sure but MAY be Scylla.

@mrexodia mrexodia added a commit that referenced this issue Dec 28, 2016
@mrexodia mrexodia DBG: limit the maximum amount of exception to be skippable (resolves #… 5e37953
@mrexodia
Member

should no longer hang now.

@mrexodia mrexodia closed this Dec 28, 2016
@hulucc
hulucc commented Jan 16, 2017

It still hang. How could i reopen this issue?@mrexodia

@mrexodia mrexodia reopened this Jan 16, 2017
@skillax
skillax commented Feb 10, 2017 edited

Reproduced on Win 8.1 Pro x64 with build 2017-02-05 using the ScyllaHide Themida x86 profile and only adding Exception 0xC0000096 to the Exception-list (otherwise the unpackme won't run properly --> anti-debugging); after closing the unpackme, the unpackme window disappears, but the main thread of the unpackme seems still active and unresponsive; x64dbg times out with 'Debuggee unresponsive after 10s). In the x64Dbg statusbar is says 'Running | Cleaning up wait objects...'. The x64Dbg GUI thread is still responsive, but you can't for example restart or stop the debuggee, nor close the Debugger itself normally.

It happens in Olly too (with the same ScyllaHide plugin + settings); so I guess it's anti-debug... but Olly asks if you want to terminate the unresponsive process, and clicking yes will kill the hanging thread and leave Olly operational. Perhaps that would be a nice enhancement for x64Dbg too in this case ?

PS: If it is anti-debug, it might be interesting to bugreport it to ScyllaHide as well (as a potential improvement), as to investigate the cause and potentially have a 'workaround/fix' implemented.

@wk-952
wk-952 commented Feb 10, 2017

@hulucc I tried your unpackme with the VMProtect profile and it ran fine.
Although, it couldn't be dumped with Scylla.
1

OEP seems to be at RVA 0x1253

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment