WinDbg: Time Travel Debugging

IDA General
1

I’m trying to use WinDbg Time Travel Debugging option, following this documentation:

I have download WinDbg from Install WinDbg - Windows drivers | Microsoft Learn

Then i copied C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64

To a different folder and modified ida.cfg to point to it:

DBGTOOLS = "C:\\Users\\Lilo\\IDA WinDbg\\";

But when I start the debugger with WinDbg option on Ida Pro it fails with:

Could not initialize WinDbg engine <C:\Users\Lilo\IDA WinDbg\> with error:
The specified procedure could not be found. (0000007F).
Please make sure you have the latest Debugging Tools from Microsoft.

I’m missing something?

Ida Pro Version 9.3.26021

2

Someone else had this issue in 2023. Another user suggested this on the previous forum:

Ref: Hex-Rays forum - Login

I had that problem a long time ago, and after some searching, I found a fix.

dbghelp.dll in Windows\System32 folder was older than dbghelp.dll in WinDbg folder.

When IDA was opened, for whatever reason, C:\Windows\System32\dbghelp.dll was loaded first.

When WinDbg debug plugin (windbg_user) loaded dbgeng.dll in WinDbg dir, it failed because it did not load dbghelp.dll in WinDbg folder again. Some APIs needed from dbghelp.dll that dbgeng.dll needed could not be resolved.

My fix was to always copy (or mklink) the new dbghelp.dll in Windbg folder (\amd64) to ida.exe folder

Best regard

There might be a better way to fix it but I don’t know. Attempt at own risk.

3

IIRC old versions of BinDiff linked to dbghelp.dll statically and triggered this issue. but it was supposed to be fixed in BinDiff 8+.