Remote debugging with IDA Pro

Remote debugging is the process of debugging code running on one networked computer from another networked computer:

• The computer running the IDA Pro interface will be called the "debugger client".

• The computer running the application to debug will be called the "debugger server".

Remote debugging will be particularly useful in the following cases:

• To debug virus/trojans/malwares : in this way, the debugger client will be as isolated as possible from the compromised computer.

• To debug applications encountering a problem on one computer which is not duplicated on other computers.

• To debug distributed applications.

• To always debug from your main workstation, so you won't have to duplicate IDA configuration, documentation and various debugging related resources everywhere.

• In the future, to debug applications on more operating systems and architectures.

This small tutorial will present how to setup and use remote debugging in practice.

The remote IDA debugger server

In order to allow the IDA client to communicate with the debugger server over the network, we must first start a small server which will handle all low-level execution and debugger operations.

Debugger servers

The IDA distribution ships with the following debugger servers:

• For Windows: win32_remote32 (x86), win64_remote.exe (x64)

• For Linux: linux_server32 (x86), linux_server (x64), armlinux_server32 (ARM), armlinux_server (ARM64)

• For Android: android_x86_server, android_x64_server, android_server32 (ARM), android_server (ARM64)

• For Mac: mac_server32 (x86), mac_server (x64), mac_server_arm (ARM64), mac_server_arme (ARM64e)

With these, we can:

• Locally debug applications and shared libraries from the IDA graphical and text versions.

• Remotely debug applications and shared libraries from the IDA graphical and text versions.

So let's first copy the small x64 Windows debugger server file to our debugger server.

This server accepts various command line arguments:

C:\> win64_remote -?
IDA Windows 64-bit remote debug server(MT) v9.0.30. Hex-Rays (c) 2004-2024
Usage: win64_remote [options]
  -p ...  (--port-number ...) Port number
  -i ...  (--ip-address ...) IP address to bind to (default to any)
  -c ...  (--certchain-file ...) TLS certificate chain file
  -k ...  (--privkey-file ...) TLS private key file
  -v      (--verbose) Verbose mode
  -t      (--no-tls) Use plain, unencrypted TCP connections
  -P ...  (--password ...) Password
  -k      (--on-broken-connection-keep-session) Keep debugger session alive when connection breaks
  -K      (--on-stop-kill-process) Kill debuggee when closing session

Let's start it by specifying a password, to avoid unauthorized connections:

C:\>win64_remote -Pmypassword
IDA Windows 64-bit remote debug server(MT) v9.0.30. Hex-Rays (c) 2004-2024
2024-11-04 03:20:51 Listening on 0.0.0.0:23946 (my ip 172.20.156.1)...

Note that the remote debugger server can only handle one debugger session at a time. If you need to debug several applications simultaneously on the same host, launch several servers on different network ports by using the -p switch.

Setting up the debugger client.

First, we copy the executable we want to debug from the debugger server (Windows or Linux) to the debugger client (Windows or Linux). We can then load this file into IDA, as usual. To setup remote debugging, we select the 'Process options...' menu item in the Debugger menu:

Specify the Application and Directory paths. Note that these file paths should be valid on the remote debugger server. Also do not forget to enter the host name or IP address of the debugger server: remote debugging will only be enabled if these settings are specified ! You also might have to open the TCP port in the remote machine firewall. Finally, we enter the password we chose for the remote IDA debugger server.

Starting remote debugging.

Both debugger server and debugger client are now ready to start a remote debugging session. In fact, you can now use all debugger related commands as you would with the local Windows PE debugger or local Linux debugger! For example,we can run the process until RIP reaches the application entry point, by jumping to this entry point then pressing the F4 key:

If we now directly terminate the process (by pressing CTRL-F2) and look at win64_remote's output (on the debugger server), we indeed properly observe it accepted then closed our network connection:

C:\\> .\win64_remote.exe -Pmypassword
IDA Windows 64-bit remote debug server(MT) v9.0.30. Hex-Rays (c) 2004-2024
2024-11-04 03:20:51 Listening on 0.0.0.0:23946 (my ip 172.20.156.1)...
2024-11-04 03:29:26 [1] Accepting connection from 172.20.144.1...
2024-11-04 03:37:56 [1] Closing connection from 172.20.144.1...

Attaching to a running process.

Another interesting possibility is to attach to an already running process on the remote computer. If you click on the 'Attach to process...' command from the Debugger menu, IDA will display a listing of all remote running processes, you can then filter to choose the one you want to attach to (notepad.exe in this case):

Double clicking on a process from the list will automatically suspend the process and attach to it, allowing you to debug it without starting it manually.

Detaching from the debugged process.

Finally, if the debugger server is running Windows XP, Windows Server 2003 or Linux, you can also detach from a process you were currently debugging, simply by using the 'Detach from process' command in the Debugger menu:

On Windows, please note that IDA can also attach to Windows services running either locally or remotely. In particular, the 'Detach from process' command will be especially useful if you previously attached to a Windows service: it will allow you to stop the debugger without terminating a critical Windows service on the debugger server!