bootleg / bootleg/ret-sync

retsync WinDbg extension GetIdentity() fails with 0x8001010A (RPC_E_SERVERCALL_RETRYLATER) when sync-ing to IDA

Open
#119 1 comment 0 reactions 0 assignees View on GitHub
bug windbg
Dominant language
C
Stars
2.4k
Forks
307
PR merge metrics
No merged PRs in 30d

Description

When I use the Windbg plugin compiled with Visual Studio 2017 to synchronize with IDA, WinDbg tells me that getting the identity failed, like that:
![image](https://github.com/bootleg/ret-sync/assets/55967871/aaa0b0a5-57d0-4257-aeb6-66f9075884e0)

The feedback IDA gave me is as follows
![image](https://github.com/bootleg/ret-sync/assets/55967871/0fd7adaa-8acb-48d0-b69f-cf7d10a1f505)

But I think it might not be an issue with IDA since I can sync with IDA using x64dbg and Windbg can't sync with Ghidra either
I debugged the source code of the WinDbg plug-in and found that there was a problem in the Identity function in the sync.cpp
![image](https://github.com/bootleg/ret-sync/assets/55967871/522c7a24-b3f4-4fc5-b42b-f662b903ecd0)
The return value of this function (hRes) has the value 0x8001010A (RPC_E_SERVERCALL_RETRYLATER)
This looks like a COM server issue but I don't know how to fix it.
Any suggestions? Thanks.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the WinDbg plugin's Identity function in sync.cpp and reproduce the GetIdentity() failure returning RPC_E_SERVERCALL_RETRYLATER. Compare the synchronization behavior with IDA and Ghidra, then verify that WinDbg can obtain the identity and synchronize without the reported COM error.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
devtools, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.