debugger icon indicating copy to clipboard operation
debugger copied to clipboard

DBGENG adapter fails to attach to SYSTEM process - “no current process or thread” / no attach output

Open sanitycheck opened this issue 3 months ago • 0 comments

Version and Platform (required):

  • Binary Ninja Version: 5.1.8104 (stable, 64-bit)
  • OS: Windows
  • OS Version: Windows 11 Home (10.0.26100 N/A Build 26100), 64-bit
  • CPU Architecture: x64
  • Local or Remote Debugging: Local (DBENG/DbgEng adapter)

Bug Description: Attempting to attach the DBENG (DbgEng) adapter to a process running as both an Administrator and NT AUTHORITY\SYSTEM (via psexec) results in no visible attach success and a non-functional session.
The Debugger console repeatedly prints:

WARNING: The debugger does not have a current process or thread
WARNING: Many commands will not work
         ^ Operation not supported by current debuggee error in 'bp @!""+0x1401a2123'

Binary Ninja’s log also includes:

[Default] DbgEngAdapter::AttachInternal, debugger is still active

When attaching in the context of NT AUTHORITY/SYSTEM No information populates in the log or debugger UI.
Attaching to the same PID with standalone WinDbg works correctly, so the behavior appears specific to Binary Ninja’s DbgEng adapter.

Steps To Reproduce:

  1. Launch Binary Ninja from the desktop using Run as Administrator.
  2. Open an existing .bndb database or the target binary.
  3. Ensure the Debug Adapter is set to DBENG.
  4. Open Attach to Process, select the process, and click Attach.
  5. Observe the Debugger console and UI, and see “no current process or thread” warnings are printed, and no threads or modules populate.

Expected Behavior:

  • The adapter should confirm a successful attach, enumerate threads and modules, and allow normal debugging, or in the event of a failure, indicate it to the user with an appropriate error message.
  • Behavior should be consistent with WinDbg attaching to the same PID.

Screenshots/Video Recording:

Image Image Image Image

Binary: https://www.goodsync.com/download/GoodSync-vsub-Server-Setup.exe

Additional Information:

  • WinDbg version: 1.2508.27001.0 — attaches successfully to the same PID under identical conditions.
  • Both Binary Ninja (running as Administrator) and the target process (running as SYSTEM) are on the same machine and architecture.
  • The issue occurs immediately after selecting the process from the Attach dialog — there is no visible attach or detach event.
  • The adapter never transitions to an active debuggee state and does not populate thread or module context.
  • This behavior prevents evaluation of Binary Ninja’s debugger feature, which was the primary reason for purchasing a Home license to assess potential for wider licensing.

sanitycheck avatar Oct 13 '25 11:10 sanitycheck