WinDbg: Time Travel Debugging

IDA General
1

I’m trying to use WinDbg Time Travel Debugging option, following this documentation:

I have download WinDbg from Install WinDbg - Windows drivers | Microsoft Learn

Then i copied C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64

To a different folder and modified ida.cfg to point to it:

DBGTOOLS = "C:\\Users\\Lilo\\IDA WinDbg\\";

But when I start the debugger with WinDbg option on Ida Pro it fails with:

Could not initialize WinDbg engine <C:\Users\Lilo\IDA WinDbg\> with error:
The specified procedure could not be found. (0000007F).
Please make sure you have the latest Debugging Tools from Microsoft.

I’m missing something?

Ida Pro Version 9.3.26021

2

EDIT: Would you happen to also be using BinDiff?

Someone else had this issue in 2023. Another user suggested this on the previous forum:

Ref: Hex-Rays forum - Login

I had that problem a long time ago, and after some searching, I found a fix.

dbghelp.dll in Windows\System32 folder was older than dbghelp.dll in WinDbg folder.

When IDA was opened, for whatever reason, C:\Windows\System32\dbghelp.dll was loaded first.

When WinDbg debug plugin (windbg_user) loaded dbgeng.dll in WinDbg dir, it failed because it did not load dbghelp.dll in WinDbg folder again. Some APIs needed from dbghelp.dll that dbgeng.dll needed could not be resolved.

My fix was to always copy (or mklink) the new dbghelp.dll in Windbg folder (\amd64) to ida.exe folder

Best regard

There might be a better way to fix it but I don’t know. Attempt at own risk.

3

IIRC old versions of BinDiff linked to dbghelp.dll statically and triggered this issue. but it was supposed to be fixed in BinDiff 8+.

4

I don’t see any git commits mentioning a fix for that. The last official release was from Sep 2023 - Ref: Releases · google/bindiff · GitHub

There is a third-party repo with bindiff for IDA 9.x - Ref: GitHub - Lil-Ran/build-bindiff-for-ida-9: Use GitHub Actions to build BinDiff 8 and BinExport 12 for various IDA Pro 9.x on Windows, macOS, and Linux. · GitHub

5
6

No, I was not using BinDiff, I copied the dbghelp.dll to IDA folder and the WinDbg debugger now starts, thanks for mentioning it.

7

did you figure out what was loading the wrong dbghelp.dll before your fix?

8

No I don’t, looking on System Informer Modules window on IDA it was loading the dbghelp.dll from System32, my IDA installation have no modification or plugin.