3

I want to launch IDA debugger for one 64-bit exe file and it fails, have tried with more samples, but result always the same.

Here is that I do.

  1. Launch IDA Pro (64-bit)
  2. Select Debugger -> Run -> Local Windows Debugger from top menu.
  3. Select my file. How it looks and click OK.
  4. At this point getting such prompt. prompt and click Yes.
  5. Finally got such error: error1
  6. And after that this-one: error2

It happens all the time, have tried it on a few different VMs on my actual machine. I'm using full version of IDA v6.7.141229.

I believe something has to be configured, as the last error says something about wrong parameters, can someone advice?

Improve this question
1
  • I can't check this right now, but i think i remember that, for 64 bit programs, you have to start the 64 bit remote debugger and connect to that instead of debugging the file directly. So, "Run -> local windows debugger" is wrong. Start the win64_remotex64 server manually, then have IDA connect to it.
    – Guntram Blohm
    Nov 30, 2015 at 9:39

2 Answers 2

Reset to default
7

Since IDA is a 32 bit process, it can only debug x64 binaries remotely (source).

To do that, you need to use the IDA X.X/dbgsrv/win64_remotex64.exe file and start a debugger. Once the debugger is running, you can connect to it "remotely" and debug. You can check this tutorial for more specific details.

Improve this answer
3
  • The only thing that is also required is running IDA as administrator, otherwise it doesn't work, no matter if debugged program requires elevation or not.
    – ST3
    Nov 30, 2015 at 11:09
  • What's also important to note is that the password for win64_remotex64 must be specified without any spaces after -P. I know, it's a very strange way of doing it. And also on the client machine make sure to start a 64-bit version of IDA. Also as administrator.
    – c00000fd
    Jul 4, 2016 at 7:26
  • If you are getting socket error make sure firewall doesn't block the connection and/or port is not already used. In my case I got an error and had to disable COMODO firewall entirely
    – MaKiPL
    Feb 9, 2018 at 18:57
7

I write this mostly for myself as I'm tired of going thru this over and over again. Here's how you can debug x64 processes on a local machine with IDA Pro:

(1) Create a .bat file with the following:

"C:\Program Files (x86)\IDA 6.5\dbgsrv\win64_remotex64" -Pnh8sy261

in this case it's the location of win64_remotex64 or remote debugger and nh8sy261 is just some random password. You pick it. Make sure though not to put any spaces after the -P parameter and the password.

(2) Run batch file from (1) as admin.

(3) Open 64-bit version of IDA Pro as admin. (File "C:\Program Files (x86)\IDA 6.5\idaq64.exe")

(4) Pick Go to work on your own. Then in the blank IDA Pro window, in the menu go to Debugger -> Run -> Remote Windows debugger. Then in the Application pick your application with the ... button. Specify debuggee parameters and directory, if needed. Then in the Hostname add 127.0.0.1, port as 23946 and password as what you typed above in the batch file:

enter image description here

You can also check to Save network settings as default for later access. Then click OK.

(5) At this point the debugger should load the debuggee process and you should be able to step through it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.