Error when attaching to a process already being debugged

x64dbg · Apr 28, 2023 · 19e93ae · 19e93ae
1 parent fb52153
commit 19e93ae
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 3 deletions.
diff --git a/src/dbg/commands/cmd-debug-control.cpp b/src/dbg/commands/cmd-debug-control.cpp
@@ -231,6 +231,14 @@ bool cbDebugAttach(int argc, char* argv[])
         dprintf(QT_TRANSLATE_NOOP("DBG", "Could not open process %X!\n"), DWORD(pid));
         return false;
     }
+
+    BOOL debuggerPresent = FALSE;
+    if(CheckRemoteDebuggerPresent(hProcess, &debuggerPresent) && debuggerPresent)
+    {
+        dputs(QT_TRANSLATE_NOOP("DBG", "Process is already being debugged!"));
+        return false;
+    }
+
     BOOL wow64 = false, meow64 = false;
     if(!IsWow64Process(hProcess, &wow64) || !IsWow64Process(GetCurrentProcess(), &meow64))
     {
@@ -246,11 +254,13 @@ bool cbDebugAttach(int argc, char* argv[])
 #endif // _WIN64
         return false;
     }
+
     if(!GetFileNameFromProcessHandle(hProcess, szDebuggeePath, _countof(szDebuggeePath)))
     {
         dprintf(QT_TRANSLATE_NOOP("DBG", "Could not get module filename %X!\n"), DWORD(pid));
         return false;
     }
+
     if(argc > 2) //event handle (JIT)
     {
         duint eventHandle = 0;
@@ -259,6 +269,7 @@ bool cbDebugAttach(int argc, char* argv[])
         if(eventHandle)
             dbgsetattachevent((HANDLE)eventHandle);
     }
+
     if(argc > 3) //thread id to resume (PLMDebug)
     {
         duint tid = 0;
@@ -267,6 +278,7 @@ bool cbDebugAttach(int argc, char* argv[])
         if(tid)
             dbgsetresumetid(tid);
     }
+
     static INIT_STRUCT init;
     init.attach = true;
     init.pid = (DWORD)pid;

diff --git a/src/dbg/debugger.cpp b/src/dbg/debugger.cpp
@@ -2876,10 +2876,15 @@ static void debugLoopFunction(INIT_STRUCT* init)
     //run debug loop (returns when process debugging is stopped)
     if(init->attach)
     {
-        if(AttachDebugger(init->pid, true, fdProcessInfo, cbAttachDebugger) == false)
+        if(!AttachDebugger(init->pid, true, fdProcessInfo, cbAttachDebugger))
         {
-            String error = stringformatinline(StringUtils::sprintf("{winerror@%d}", GetLastError()));
-            dprintf(QT_TRANSLATE_NOOP("DBG", "Attach to process failed! GetLastError() = %s\n"), error.c_str());
+            auto status = NtCurrentTeb()->LastStatusValue;
+            auto error = stringformatinline(StringUtils::sprintf("{ntstatus@%X}", status));
+            if(status == STATUS_PORT_ALREADY_SET)
+            {
+                error = GuiTranslateText(QT_TRANSLATE_NOOP("DBG", "Process is already being debugged!"));
+            }
+            dprintf(QT_TRANSLATE_NOOP("DBG", "Attach to process failed: %s\n"), error.c_str());
         }
     }
     else