X64dbg: Unable to Debug x64 processes

[AxDSan]

Image of Issue:
https://forum.tuts4you.com/applications/core/interface/imageproxy/imageproxy.php?img=http%3A%2F%2Fi.imgur.com%2Fu696L7i.png&key=10567de8788c02dc9e2c2235a2d68ae8b589995cfcf05de1a41117e11acdb0c4

And that seems to be for every x64 process I load.

Q: How problem appeared to start?
A: Problem seemed to be happening already because I'm not the ones who debug x64 often, however the other day was about to analize an x64 process and thought it had anti-debugging measurements because it got stuck on that same screen you see up above...

Q: How could I reproduce the error:
A: It's hard, like I said I don't know what could be causing the error. I suddenly started using x64dbg and it didn't worked properly. x32dbg in other hand works like a charm.

Q: Happens with every x64 architecture process?
A: Seems so, I tired and 10 out of 10 with same ending result.

Hope this helps if anything.

[blaquee]

What processes have you tried debugging? Which snapshot are you using? and can you provide any publicly available samples to test this on?
Also what OS?

[mrexodia]

Disable your antivirus and disable all system hooks.

[mrfearless]

I had a similar issue with x64 debugging and found the issue was with Actual Windows Manager - which always seemed to load a aimemb64.dll into the target process regardless of exclusions etc.

I would get an exception error when it was just about to create a dialog (CreateDialogParamIndirect would always throw up the exception and the call stack showed a return from a aimemb64 module)

Once i quit running that utility (for purposes of debugging x64 programs) it solved the issue.

So as mrexodia has said disable any tools and utilities that may have hooks that might be interfering.

One way to figure out which tool/utility/program is causing the issue, is to have a look at the modules loaded for the program you are debugging via process explorer / process hacker (run it without debugging first) - look for any third party dlls and take note of them. Close down those third party utilities, stop the services/drivers that are related to those dll's if possible, and see if that helps you in a process of elimination to figure out the culprit.

Tools like msconfig and autoruns by system internals could be useful to see what programs and tools are running on your system and to disable them from running at startup - which might help you as well.

Hope that helps or points you in the right direction

[AxDSan]

@blaquee
Q: What processes have you tried debugging?
A: Everything under my [Program Files] directory.

Q: Which snapshot are you using?
A: Latest one.

Q: Can you provide any publicly available samples to test this on?
A: No since what I'm testing belongs to my [Program Files] directory, you could see some of them here though: http://i.imgur.com/TlYKN16.png

Q: What OS?
A: Windows™ 10 Pro Build 10586

---

@mrexodia

"Disable your antivirus and disable all system hooks."

Thanks for your recommendation, will surely test that ASAP.

Update: _Just disabled my Antivirus (COMODO Internet Security + Firewall) and it seemed to make no change at all as the problem still persists. Will keep testing for all the other recommendations posted along._

---

@mrfearless

I had a similar issue with x64 debugging and found the issue was with Actual Windows Manager...

Thanks for your recommendation also, will definitely put it to test...

---

Will come back with results, hopefully with the problem fixed..

[AxDSan]

Well well, seems that it's solved :dart: :+1: - wasn't working thanks to https://bitbucket.org/NtQuery/scyllahide/overview - ScyllaHide x64 was getting in the middle of everything, seemed to be causing the problem.

Thanks for everyone who willingly showed mercy and gave me recommendations :v:

[mrexodia]

https://github.com/x64dbg/ScyllaHide