1

I'm trying to reverse an application that is using a DLL that i'm interested in.

I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the used DLL with IDA, as it's a native C shared library.

I am using x64dbg as a debugger, and i would like to see the interactions between the application and the DLL. I can properly break on the DLL by loading the .Net app into x64Dbg, and waiting for a DLL call, and it's fine.

But the fact that x64dbg does not support .Net syntax make it very weird to play with when the flow came back from the DLL to the application, and i would like to do the following:

  • Use the DnSpy build-in debugger to see what's going on on a high level with the .Net application.

  • And use x64dbg attached to the DLL to take a look at it whenever it is call by the application.

But i can't manage to do that, since the root process (the .Net application) cannot be debugged by two debugger at the same time.

How can i setup x64dbg to intercept the DLL without attaching it to the .Net process ?

Is it even possible to do that ?

Or maybe I'm unaware of some magic tools that would help me ?

Any idea ?

Thanks :)

Improve this question
1
  • did you try windbg with sos for .NET support?
    – Paweł Łukasik
    Jan 14, 2020 at 20:02

1 Answer 1

Reset to default
2

The best way to debug this in my opinion is to use WinDbg from Windows SDK or WinDbg Preview from Windows Store. In Windows it is not possible to attach two debuggers to the same process. WinDbg supports easily debugging .NET and native processes.

To access .NET functionality you can run commands:

.loadby sos clr

More details of the .NET extensions here Improved .NET debugging with sosex 3rd party extension here Common commands for WinDbg thematically grouped here

There is some learning curve to use it fully effectively but once learned it is extremely powerful debugger for .NET and native code.

If must use x64dbg then you would require a plugin that supports .NET, the currently available plugins are listed here: https://github.com/x64dbg/x64dbg/wiki/Plugins

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.