techbliss/X64dbg_script_editor

on the latest release x64dbg ，lost response

sin5678 opened this issue · 16 comments

sin5678 commented

i use the x32dbg.exe ,install all latest x64dbg-python and X64dbg_script_editor, when open the X64dbg_editor.py file, the debugger lost response. need force kill

techbliss commented

Did you use the release, it shows as a plugin via x64dbg plugin menu.
https://github.com/techbliss/X64dbg_script_editor/releases/tag/v2.0
You also need to install PyQt5 with same runtime as x64dbg
https://github.com/x64dbg/PyQt5/releases

techbliss commented

If you open editor via open file instead of using the release plugin
Some lines needs to be quoted out
https://github.com/techbliss/X64dbg_script_editor/blob/master/X64Dbg_editor/Editor_x64dbg.py#L498

SvenLuebke commented

I am experiencing the same issue: I can execute some Python code, but as soon as I start the Editor via the dedicated plugin, x32dbg and x64dbg freezes. I also tried to update the APIs and compile x64dbgpy by myself, but that doesn't change anything.

How can I analyze and solve this issue? The Log doesn't report any error. I believe it's an issue on my workstation, but how can I analyze it?

Thank you and best regards,
Sven

techbliss commented

Hello
I tested with latest x64dbgpy
https://ci.appveyor.com/project/mrexodia/x64dbg-python/build/artifacts
lastest x64dbg snapshot
https://github.com/x64dbg/x64dbg/releases
and PyQt5 build for x64dbg(remember there are x64/x86 versions)
https://github.com/x64dbg/PyQt5/releases
latest x64dbgpy Editor release(launch via plugin menu)
https://github.com/techbliss/X64dbg_script_editor/files/914622/X64dbg_script_editor_11-04-17.zip
I get no freezes , so the issue must be a conflict with PyQt5.
Try launch the .\x64dbg\x32\plugins\X64Dbg_editor\Editor_x64dbg.py in windows without x64dbg,and see if it runs? If it freezes there also , there must be a conflict with PyQt5

Also notice that you cannot edit the folders names in the release, so it have to be x64dbg\x32\plugins\X64Dbg_editor and x64dbg\x64\plugins\X64Dbg_editor anything else would lead to a freeze
Regards

bruce30262 commented

Hello @techbliss ,

I'm having the same issue, and have done some testing:

OS: Windows 10 64 bit 1703
x64dbg : latest version ( snapshot_2017-06-30_19-50 )
x64dbgpy : latest version ( link )
PyQt5 : https://github.com/x64dbg/PyQt5/releases

I've followed every installation instruction, and the editor still crash the x64dbg ( it didn't generate the minidump file though) . So I tried launch Editor_x64dbg.py without x64dbg, and it gave me the following message:

This application failed to start because it could not find or load the Qt platform plugin "windows" in "".

After done some research, I followed this instruction and add the QT_QPA_PLATFORM_PLUGIN_PATH env to my user var. This time, I launch the Editor_x64dbg.py successfully. But when I tried to open the editor in x64dbg (x32dbg actually), it still crash the program.

Then I thought, maybe it's because I add the QT_QPA_PLATFORM_PLUGIN_PATH to a filepath that contains the 64 bit qwindows.dll. So, I launch the x64dbg.exe, hoping that this time it would work.

Except it did not . I couldn't even launch the x64dbg.exe, it just crash before I can even open the editor plugin. And this time, it did generate the minidump file. I then analyze the dump with OSR online,here's the result: dump.pdf. Seems like it crashed in Qt5Gui.dll. And so I removed the QT_QPA_PLATFORM_PLUGIN_PATH env, and it became normal again.

So I checked the version of both qwindows.dll (the one in x64dbg/release and the one in x64dbg/PyQt5), and found that there were different: x64dbg/release is using Qt 5.6.1.0, while x64dbg/PyQt5 is using Qt 5.6.0.0. I think that's the root cause of all the problems.

To fix the issue, maybe you can release a version that can work with Qt 5.6.1.0 ?

BTW I'm really curious about how you make the plugin work with the latest x64dbg without having any crash... 😕

techbliss commented

@bruce30262 actually it was me who wrote the wiki PyQT5 troubleshooting QT_QPA_PLATFORM_PLUGIN_PATH
The QT5 PyQt5 version mismatch, would have nothing todo with it, since QT5 and PyQT is backward compatible.
Try launch the .\x64dbg\x32\plugins\X64Dbg_editor\Editor_x64dbg.py in windows without x64dbg,and see if it runs?
Also have you tried the x64 version , and have you tried setting up python only in the x64dbg folder
python setup
Likely there is another Qt5Gui.dll in your sys envar or user envar.
it works fine here video demo latest branch

bruce30262 commented

@techbliss I've been testing for a while, and found some really weird behavior.

First of all I've installed python 2.7.13 from python.org ( both x64 & x86). The x64 python is in C:\Python27\, while the x86 python is in C:\Python27_32\. I've checked both x64dbg.ini & x32dbg.ini and make sure that the PythonHome setting are correct in both config files. I've also checked the system env & user env, there's no other Qt5Gui.dll in my envar setting.

So far on my PC ( Windows 10 1703 x64 ), the debugger and the editor plugin behave like this:

  • If I don't add the QT_QPA_PLATFORM_PLUGIN_PATH env
    • x64dbg.exe: can be launched without any problem
    • x64dbgpy editor in x64dbg.exe: failed to launch & crashed the debugger
    • Editor_x64dbg.py without x64dbg.exe: failed to lauch, saying This application failed to start because it could not find or load the Qt platform plugin "windows" in "".
    • x32dbg.exe: can be launched without any problem
    • x64dbgpy editor in x32dbg.exe: failed to launch & crashed the debugger
    • Editor_x64dbg.py without x32dbg.exe: failed to launch, saying This application failed to start because it could not find or load the Qt platform plugin "windows" in "".
  • If I add the QT_QPA_PLATFORM_PLUGIN_PATH env
    • x64dbg.exe: failed to launch, crached & generate the minidump file.
    • x64dbgpy editor in x64dbg.exe: ( cannot test )
    • Editor_x64dbg.py without x64dbg.exe: launched success
    • x32dbg.exe: can be launched without any problem
    • x64dbgpy editor in x32dbg.exe: failed to launch & crashed the debugger
    • Editor_x64dbg.py without x32dbg.exe: launched success

I also discovered two things:

  1. I opened 2 Windows 7 VMs ( 64 bit & 32 bit ) and installed x64dbg+editor plugin, and both of them work really well in my VMs, no crash appears. I've debug the x64dbg inside the VMs, and found it use the qwindows.dll inside the x64dbg\release\x64\platforms dir.

  2. So I replaced the qwindows.dll in the C:\Python27\Lib\site-packages\PyQt5\platforms with the x64dbg\release\x64\platforms one, and run the Editor_x64dbg.py without x64dbg.exe, here is what I got:

This application failed to start because it could not find or load the Qt platform plugin "windows"
in "C:\Python27\Lib\site-packages\PyQt5".

Available platform plugins are: minimal, offscreen, windows.  <---- WTF?

Reinstalling the application may fix this problem.

😕 ????????

Changing the QT_QPA_PLATFORM_PLUGIN_PATH var into x64dbg\release\x64\platforms also gave me the similar error message, saying that "he can't find platform windows, and the available platform plugins are windows" ( like WTF ??? )

Somehow on my Win10 the editor plugin can't recognize the qwindows.dll inside the x64dbg\platforms
dir. But inside the Win7 VM, the plugin recognize the qwindows.dll and launch it normally, which really confused me. I'm not sure if this is a Win10 problem ( I did not test a Win10 VM so far, maybe I'll test it later ).

Do you have any idea why this is happening? Any suggestion would be appreciated, thx.

techbliss commented

Well it is not really a issue for the editor , more like PyQt5 issue and envar.
However i think you're right that it somehow loads the wrong plugin path on some machines.And i have no idea why it does that.
I just tested with 3 different laptops , all win 10 x64, and i simply cannot reproduce the the fault.
However we can might add a check to the editor if QCoreApplication is frozen.

After looking at some simular issues
ref
PyQt5 - Failed to load platform plugin “windows”. Available platforms are: windows, minimal

and using the following code to check if it is frozen
PyQt5.QtCore.QCoreApplication.addLibraryPath

try using the following code in Editor.py start
we might have to tweak it a little to get right plugin_path
so test with
plugin_path = "Add_REAL_PATH"

add the code before
https://github.com/techbliss/X64dbg_script_editor/blob/master/X64Dbg_editor/Editor_x64dbg.py#L55
and after
https://github.com/techbliss/X64dbg_script_editor/blob/master/X64Dbg_editor/Editor_x64dbg.py#L45

import PyQt5
from PyQt5 import QtCore, QtGui, Qsci, QtWidgets, Qt
from PyQt5.Qsci import QsciScintilla, QsciLexerPython, QsciAPIs, \
    QsciScintillaBase
from PyQt5.QtGui import QFont, QFontMetrics, QColor, QTextCursor
from PyQt5.QtWidgets import QMainWindow, QDialog, QMessageBox, QDesktopWidget, QWidget
from PyQt5.QtCore import pyqtSignal, pyqtSlot, QObject, QEvent, QCoreApplication

plugin_path = ""
if sys.platform == "win32":
    if hasattr(sys, "frozen"):
        plugin_path = os.path.join(os.path.dirname(os.path.abspath(sys.executable)), "PyQt5", "plugins")
        QCoreApplication.addLibraryPath(plugin_path)
    else:
        import site
        for dir in site.getsitepackages():
            QCoreApplication.addLibraryPath(os.path.join(dir, "PyQt5", "plugins"))

elif sys.platform == "darwin":
    plugin_path = os.path.join(QCoreApplication.getInstallPrefix(), "Resources", "plugins")

if plugin_path:
    QCoreApplication.addLibraryPath(plugin_path)

Also do x64dbg crash when just having the x64dbgpy, without the editor plugin?

bruce30262 commented

@techbliss x64dbg do crash when just having the x64dbgpy, without the editor plugin.
However, after done some testing, this time I have an "encouraging & confusing" result:

First I remove the QT_QPA_PLATFORM_PLUGIN_PATH var, and modified the code to :

import PyQt5
from PyQt5 import QtCore, QtGui, Qsci, QtWidgets, Qt
from PyQt5.Qsci import QsciScintilla, QsciLexerPython, QsciAPIs, \
    QsciScintillaBase
from PyQt5.QtGui import QFont, QFontMetrics, QColor, QTextCursor
from PyQt5.QtWidgets import QMainWindow, QDialog, QMessageBox, QDesktopWidget, QWidget
from PyQt5.QtCore import pyqtSignal, pyqtSlot, QObject, QEvent, QCoreApplication

plugin_path = ""
if sys.platform == "win32":
    if hasattr(sys, "frozen"):
        plugin_path = os.path.join(os.path.dirname(os.path.abspath(sys.executable)), "Lib", "site-packages", "PyQt5")
        QCoreApplication.addLibraryPath(plugin_path)
    else:
        import site
        for dir in site.getsitepackages():
            QCoreApplication.addLibraryPath(os.path.join(dir, "PyQt5", "plugins"))

elif sys.platform == "darwin":
    plugin_path = os.path.join(QCoreApplication.getInstallPrefix(), "Resources", "plugins")


plugin_path = os.path.join(os.path.dirname(os.path.abspath(sys.executable)), "Lib", "site-packages", "PyQt5")    
print "ppath:", plugin_path

if plugin_path:
    QCoreApplication.addLibraryPath(plugin_path)

This time, when I tried launching Editor_x64dbg.py, it worked ! And so then I tried to open the editor plugin in x64dbg.exe.....

It still crashed !! 😠

And so I tried to debug the python code, and found an interesting result: the program crashed while executing the line :

from PyQt5 import QtCore, QtGui, Qsci, QtWidgets, Qt

After modifying the code and import those module one by one , I finally found that the program crashed when it tried to import PyQt5.Qt

So I change the line to

from PyQt5 import QtCore, QtGui, Qsci, QtWidgets # removing Qt

Also I remove the addLibraryPath part. Now I tried opening the editor in x64dbg.exe.....

Guess what ? IT WORKED!!!! Both in x32dbg.exe & x64dbg.exe!!! (Finally!!!!) 😫

So I guess we found the root cause of the problem : from PyQt5 import Qt
remove Qt from the import module will solve the issue ( although I've no idea why it crash the program )
I've search through the code in Editor_x64dbg.py, there's no line start with Qt.XXX so I guess it's OK to remove the module. I've tested it on my Win10 PC and my Win7 VM, everything work just fine.

Hope that help ! Looking foward for the new release ! 😄

  • 👍1
techbliss commented

That's awesome you found the problem👍i appreciate the problem solving. 😄

Before making a new release, could it be wise to have the

addLibraryPath

so it forces to use the right plugin path, or at least look for it.
and then removing the

from PyQt5 import QtCore, QtGui, Qsci, QtWidgets # removing Qt

Not sure why importing Qt hangs crashes the entire app, however it could be a blunt from my side when porting my editor from PyQt4 to PyQt5

could you do a quick test importing the Qt from QtCore
from PyQt5.QtCore import pyqtSignal, pyqtSlot, QObject, QEvent, Qt
and see if it crashed when importing from the right module.

QtCore.Qt is used several times.

techbliss commented

I also discovered that the release of the PyQt5 x86/x64 regarding QT_QPA_PLATFORM_PLUGIN_PATH
there is a folder missing

instead of
Lib\site-packages\PyQt5\
platforms it should be
Lib\site-packages\PyQt5\plugins\platforms
and it will not give you a error about
This application failed to start because it could not find or load the Qt platform plugin "windows" in "C:\Python27\Lib\site-packages\PyQt5".

with the
addLibraryPath
it will then find it automatic, so i will add it to the next release.

bruce30262 commented

@techbliss importing the Qt from QtCore works fine :)

As for the addLibraryPath part , please make sure the plugin is able to locate the PyQt5 path, otherwise I think it's OK to add the check.

BTW I open another issue #5, please fix it also in the next version :)

techbliss commented

Release and code updated

  • 👍1
techbliss commented

@sinCoder
Can you check the latest release, and see if the issue is resolved?

SvenLuebke commented

@bruce30262

Great work, this also solved my issues! Now both versions are working now. Thank you all for your work!

  • 👍1
  • 🎉1
sin5678 commented

sorry for delay response, as the replies above, surly it is fixed now.

  • 👍1