therealdreg/dbgchild

Debug Child Process Tool (auto attach)

dbgchild's Issues

not support windows11

version: Windows11 22H2 22621.1928

Don't know how to use it

Failed to open the debugger debug child process
Don't know how to use it
can provide video？

Can you please put an up to date Github Release?

OllyDbg and Immunity plugin [$3000]

Support for DbgChild can be extended to OllyDbg and Immunity debugger if so required via crowdfunding:

It will be like the x64dbg plugin:

The money will be split amongst the following projects and contributors:

40% x64dbg
35% DbgChild
15% Contributors
10% Capstone

ERROR: ReadDirectoryChangesW - Watching: Z:\x64dbg\x32\CPIDS

When opening processwatcher.exe I get a continous loop of this errors

TID[1500] - ERROR: ReadDirectoryChangesW.
TID[1500] - Watching: Z:\x64dbg\x64\CPIDS

 TID[3892] - ERROR: ReadDirectoryChangesW.
TID[3892] - Watching: Z:\x64dbg\x32\CPIDS

 TID[1500] - ERROR: ReadDirectoryChangesW.
TID[1500] - Watching: Z:\x64dbg\x64\CPIDS

 TID[3892] - ERROR: ReadDirectoryChangesW.
TID[3892] - Watching: Z:\x64dbg\x32\CPIDS

 TID[1500] - ERROR: ReadDirectoryChangesW.
TID[1500] - Watching: Z:\x64dbg\x64\CPIDS

 TID[3892] - ERROR: ReadDirectoryChangesW.
TID[3892] - Watching: Z:\x64dbg\x32\CPIDS

 TID[1500] - ERROR: ReadDirectoryChangesW.
TID[1500] - Watching: Z:\x64dbg\x64\CPIDS

 TID[3892] - ERROR: ReadDirectoryChangesW.
TID[3892] - Watching: Z:\x64dbg\x32\CPIDS

 TID[1500] - ERROR: ReadDirectoryChangesW.
TID[1500] - Watching: Z:\x64dbg\x64\CPIDS

 TID[3892] - ERROR: ReadDirectoryChangesW.
TID[3892] - Watching: Z:\x64dbg\x32\CPIDS

I am using Windows 7 SP1 x86 right out of the box on a VirtualBox VM.
I only download x64dbg and copied the plugin inside the folder.
No logs are created.
I don't know why it shows error in the x64 folder since it is an x86 platform. I even deleted the x64 folder and it is still showing in the error.

Problem with installation

I don’t understand how to install it. it is written that you have to extract the contents of the archive in the x64dbg folder, but the contents are totally different from what is described in the readme:
It may be:
CreateProcessPatch.exe - Hook ZwCreateUserProcess (two separate exe files for x86 and x64) and loads DbgChildHookDLL.dll
DbgChildHookDLL.dll - (two separate dll files for x86 and x64) - outputs process id's to CPIDS folder
NTDLLEntryPatch.exe - Patches or unpatches LdrInitializeThunk (two separate exe files for x86 and x64)
DbgChild.dp32 - x64dbg plugin x86
DbgChild.dp64 - x64dbg plugin x64
NewProcessWatcher.exe - Watches for new child processes from the CPIDS folder
x64_post.unicode.txt - Support file
x64_pre.unicode.txt - Support file
x86_post.unicode.txt - Support file
x86_pre.unicode.txt - Support file

how can I install it as plugin for x64dbg?
Thanks for any reply.

parent process crashed

The parent process is x86, and the child process is x64. When enabled dbgchild plugin in x32dbg and spawn the child, the parent will simply crash and the debugging of both parent and child processes failed