bootleg
automatic focus switching from X64DBG to IDA Pro on instruction stepping in x64dbg
When you connect X64DBG to IDA Pro and then a breakpoint hits within x64dbg, IDA Pro will (as expected) refresh and show that, but the problem is that when you want to step through within x64dbg, every single step will actually put the focus on IDA Pro again because it is reflecting the changes.
So that means that you have to always Alt + Tab just to get back into x64dbg after you stepped over a single instruction.
The idea is that ret-sync will refresh IDA Pro but it won't change the focus of the applications and let the user decide when to switch between the both.
Hi, can you create a video of the problem to make sure we understand it properly?
Also, what is your environment?
- IDA version
- x64dbg version
- Windows version
https://github.com/user-attachments/assets/6008b6b9-b1f1-4d64-be3c-b5ee216ea85e
Pay attention to the windows titles of X64DBG and IDA Pro. They randomly change focus when I step over a few instructions. There are also cases where it always switches the focus on a single instruction step.
I don't have any plugins or external applications installed that would cause this, this is just me running X64DBG with IDA + retsync and stepping over the instructions.
IDA Version: 9.2 X64DBG version: March 15th Windows 10
Ideally it will not force switch the focus and just update IDA Pro (like it does in the video sometimes - I can sometimes step over and no switch of focus happens).
Ok thanks that's really useful.
We think the culprit might be a recent change in IDA Pro (possibly 9.2). We are starting to wonder if IDA asks for being focused when the cursor is highlighted in certain conditions.
Could you try with an older version of IDA, see it happens?
Other ideas: 1.Do you recall if it starting happening recently? 2. If it happened with other debuggers like WinDbg? 3. The fact it does not always focus IDA when you step in x64dbg is very interesting. Can you try figuring out when it does focus and when it does not focus? Is it really random? Or is it after N steps? How many after you unfocused ida and refocused x64dbg? Does it change if you step slowly in x64dbg? Or quickly?
Here is me trying the same thing out in IDA 9.1 (I unfortunately do not have any older versions installed): https://github.com/user-attachments/assets/40f28594-f33a-462e-b86f-c1d55d0c07f9
Sadly the same thing happens on this version as well.
This time I included the task bar at the bottom so you can see when Ida is trying to grab the focus there as well.
Regarding your questions:
- I started using ret-sync only recently and this has been happening ever since. I am wondering if this is happening to you too?
- Can't say because I never used windbg
- I tried stepping slowly and fast but couldn't determine when it happens (the video is sped up a little because otherwise GitHub won't allow me to upload due to file size).
My guess, without knowing how ret-sync was built, is that the moment ret-sync is updating Ida, something is at the same time causing a focus switch.
Thanks for all the additional info, that's useful.
No it never happened to me. I used to use it with latest IDA and on Windows for years. However recently I switched to using ghidra.
Actually, it happened to someone before and they had a workaround. Not ideal but until we figure out a better fix. See https://github.com/bootleg/ret-sync/issues/18 and https://github.com/bootleg/ret-sync/issues/125
Is the machine you use for ida/x64dbg your host or a remote host or a vm? If not your host, how do you connect to it? vnc? Remote desktop?
I'll try solution #125 as it seems to be the way to go, but still would appreciate if you guys could check out what might be causing this
Update: Solution #125 works!
Hi. So if I understand correctly #125, you hooked SetForegroundWindow from user32.dll imported by IDA?
Yes, then I put the .dll into a folder called "ida.exe.local" so that it prefers my DLL instead of the one from System32 and no more focus switching.
That's awesome. Would you be able to provide detailed instructions here on what you exactly did? It seems it will be useful for others too.
Also, I guess you might have to do it again if user32.dll is updated and IDA relies on new features from it (though unlikely...)
Just attach a debugger to Ida (in my case x64dbg), CTRL+G to follow an expression and type in "SetForegroundWindow" then ret the first instruction, export the patched file, go to IDA location, create a new folder called "ida.exe.local" and place the patched user32.dll in there.