Vector35 / Vector35/debugger

DBGENG adapter fails to attach to SYSTEM process - “no current process or thread” / no attach output

Open
#876 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug DbgEng Adapter Impact: Medium
Dominant language
C++
Stars
331
Forks
33
PR merge metrics
No merged PRs in 30d

Description

Version and Platform (required):

  • Binary Ninja Version: 5.1.8104 (stable, 64-bit)
  • OS: Windows
  • OS Version: Windows 11 Home (10.0.26100 N/A Build 26100), 64-bit
  • CPU Architecture: x64
  • Local or Remote Debugging: Local (DBENG/DbgEng adapter)

Bug Description:
Attempting to attach the DBENG (DbgEng) adapter to a process running as both an Administrator and NT AUTHORITY\SYSTEM (via psexec) results in no visible attach success and a non-functional session.
The Debugger console repeatedly prints:

WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
         ^ Operation not supported by current debuggee error in 'bp @!""+0x1401a2123'

Binary Ninja’s log also includes:

[Default] DbgEngAdapter::AttachInternal, debugger is still active

When attaching in the context of NT AUTHORITY/SYSTEM No information populates in the log or debugger UI.
Attaching to the same PID with standalone WinDbg works correctly, so the behavior appears specific to Binary Ninja’s DbgEng adapter.

Steps To Reproduce:

  1. Launch Binary Ninja from the desktop using Run as Administrator.
  2. Open an existing .bndb database or the target binary.
  3. Ensure the Debug Adapter is set to DBENG.
  4. Open Attach to Process, select the process, and click Attach.
  5. Observe the Debugger console and UI, and see “no current process or thread” warnings are printed, and no threads or modules populate.

Expected Behavior:

  • The adapter should confirm a successful attach, enumerate threads and modules, and allow normal debugging, or in the event of a failure, indicate it to the user with an appropriate error message.
  • Behavior should be consistent with WinDbg attaching to the same PID.

Screenshots/Video Recording:

Image Image Image Image

Binary:
https://www.goodsync.com/download/GoodSync-vsub-Server-Setup.exe

Additional Information:

  • WinDbg version: 1.2508.27001.0 — attaches successfully to the same PID under identical conditions.
  • Both Binary Ninja (running as Administrator) and the target process (running as SYSTEM) are on the same machine and architecture.
  • The issue occurs immediately after selecting the process from the Attach dialog — there is no visible attach or detach event.
  • The adapter never transitions to an active debuggee state and does not populate thread or module context.
  • This behavior prevents evaluation of Binary Ninja’s debugger feature, which was the primary reason for purchasing a Home license to assess potential for wider licensing.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the DBENG/DbgEng adapter attach flow, especially the logged DbgEngAdapter::AttachInternal path, and reproduce the SYSTEM-process case on Windows. Compare the adapter’s behavior with WinDbg for the same PID, focusing on the missing active debuggee, thread, and module context. Done means successful attach and enumeration, or a clear user-facing failure message.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
devtools, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.