Debugger crashes when trying to record a TTD trace by attaching to or launching a process in free

[xusheng6]

[xusheng6]

I cannot reproduce this anymore, but I did get it when binja free is freshly installed. Will look into this further later

[VaslD]

Can still reproduce this on my end. Crashes when starting a new TDD or attaching to a selected process.

Binary Ninja 6.0.10601-stable
WinDbg 1.2603.20001 installed by Install WinDbg menu into %AppData%\Binary Ninja.
Windows 11 Version 25H2 (OS Build 26200.9445)
Full Windows Security Core Isolation settings enabled if that matters.

Faulting application name: binaryninja.exe, version: 6.0.10601.0, time stamp: 0x6a99dd4d
Faulting module name: binaryninja.exe, version: 6.0.10601.0, time stamp: 0x6a99dd4d
Exception code: 0xc0000005
Fault offset: 0x00000000048629cf
Faulting process id: 0x2B94
Faulting application start time: 0x1DD44549D4A37F5
Faulting application path: C:\Program Files\Binary Ninja\binaryninja.exe
Faulting module path: C:\Program Files\Binary Ninja\binaryninja.exe

According to https://binary.ninja/purchase/#non-commercial, debugger is supported on free versions.

Tried both WINDOWS_NATIVE and DBGENG adapters, both crash.

Confirmed this likely has nothing to do with application being analyzed/debugged (though even if it had, it would crash the target application instead), attaching to explorer.exe and open source applications can reproduce the crash

[xusheng6]

Can still reproduce this on my end. Crashes when starting a new TDD or attaching to a selected process.

Binary Ninja 6.0.10601-stable WinDbg 1.2603.20001 installed by Install WinDbg menu into %AppData%\Binary Ninja. Windows 11 Version 25H2 (OS Build 26200.9445) Full Windows Security Core Isolation settings enabled if that matters.

Faulting application name: binaryninja.exe, version: 6.0.10601.0, time stamp: 0x6a99dd4d
Faulting module name: binaryninja.exe, version: 6.0.10601.0, time stamp: 0x6a99dd4d
Exception code: 0xc0000005
Fault offset: 0x00000000048629cf
Faulting process id: 0x2B94
Faulting application start time: 0x1DD44549D4A37F5
Faulting application path: C:\Program Files\Binary Ninja\binaryninja.exe
Faulting module path: C:\Program Files\Binary Ninja\binaryninja.exe

According to https://binary.ninja/purchase/#non-commercial, debugger is supported on free versions.

Tried both WINDOWS_NATIVE and DBGENG adapters, both crash.

Confirmed this likely has nothing to do with application being analyzed/debugged (though even if it had, it would crash the target application instead), attaching to explorer.exe and open source applications can reproduce the crash

Could you please help do the following?

1. Attach the logs from the log sidebar
2. Record a video of what happened
3. Attach a debugger to binaryninja.exe and get the stack trace

Also -- does this only happen when you try to do TTD? Can you try a normal debugging session with WINDOWS_NATIVE?

Thanks in advance

[VaslD]

If you mean the Binary Ninja log sidebar, there is nothing useful.

[WarpNinjaStatic.Plugin] Loading files took 566.2388ms
[WarpNinjaStatic.Plugin] Server 'https://warp.binary.ninja' connected, logged in as guest

That's info. I tuned it down to debug and it's just internals on how those two components are doing. Nothing about TTD and WinDbg is shown before crash.

---

Then the video. GitHub limits attachment to 10 MB so I have to be pretty fast. As soon as I confirm selection on the process (double-click), Binary Ninja exits with no additional logs.

Screen.Recording.2026-09-15.004110.mp4

This only happens with TTD spawn or attach. Regular breakpoint and attach with WINDOWS_NATIVE work fine when I'm dissecting functions.

---

Mini dump from procdump64.exe:

[00:55:14]Unhandled: C0000005.ACCESS_VIOLATION

binaryninja.exe.dmp

[VaslD]

Just in case to avoid misunderstanding, I ran Binary Ninja without administrative privilege. I knew debugging and injecting into another process require administrator, but I'd expect any application to promptly elevate when they need privilege (and properly scope their newfound access).

Update: Tried starting as admin, no luck.

[xusheng6]

If you mean the Binary Ninja log sidebar, there is nothing useful.

[WarpNinjaStatic.Plugin] Loading files took 566.2388ms
[WarpNinjaStatic.Plugin] Server 'https://warp.binary.ninja' connected, logged in as guest

That's info. I tuned it down to debug and it's just internals on how those two components are doing. Nothing about TTD and WinDbg is shown before crash.

Then the video. GitHub limits attachment to 10 MB so I have to be pretty fast. As soon as I confirm selection on the process (double-click), Binary Ninja exits with no additional logs.
Screen.Recording.2026-09-15.004110.mp4

This only happens with TTD spawn or attach. Regular breakpoint and attach with WINDOWS_NATIVE work fine when I'm dissecting functions.

Mini dump from procdump64.exe:

[00:55:14]Unhandled: C0000005.ACCESS_VIOLATION

binaryninja.exe.dmp

Thanks for the video. I think I know what is going on, you are trying to start a TTD session without opening a binary first. This would not work and is known to lead to a crash. We fixed the launch path using the debugger sidebar, but apparently I forgot to also fix it from the menu

You said it works with the WINDOWS_NATIVE debug adapter. When you do that, do you also do it from the menu? Do you have the binary open first?

For context, if you have the binary that you recorded, you can open it before trying to start a TTD session. If you do not have it, you can follow the instructions in https://docs.binary.ninja/guide/debugger/index.html#debugging-without-opening-a-file

[VaslD]

Don't think that's it... Tried you suggestion, both with a real analyzed binary and a new mapped empty view, still crash.

Screen.Recording.2026-09-15.021526.mp4

I used the same menu to attach the debugger when not using TTD and it works. Can't get the video below 10 MB because it involves multiple steps. So you'll have to imagine me doing it. 🤣

[xusheng6]

Don't think that's it... Tried you suggestion, both with a real analyzed binary and a new mapped empty view, still crash.
Screen.Recording.2026-09-15.021526.mp4

I used the same menu to attach the debugger when not using TTD and it works. Can't get the video below 10 MB because it involves multiple steps. So you'll have to imagine me doing it. 🤣

Thanks for letting me know.

Meanwhile, the log window should at least contain the path of the dbgeng DLLs loaded, can you provide that info to me? You previously said there is no relevant info from the logs, can you check again?

[VaslD]

Had to run. I'll get the full log when I'm off work.

But if memory serves it's the %AppData% path because I entered it myself in the settings. Funny that BN ran the installer, reported WinDbg version installed, but said no engine DLL the first time I tried TTD. So I found the dbgeng.dll myself (from installation command line window) and set x64 + x86 paths manually.

[xusheng6]

Had to run. I'll get the full log when I'm off work.

But if memory serves it's the %AppData% path because I entered it myself in the settings. Funny that BN ran the installer, reported WinDbg version installed, but said no engine DLL the first time I tried TTD. So I found the dbgeng.dll myself (from installation command line window) and set x64 + x86 paths manually.

Hmmm the missing DLL is also kinda weird. If you can get a repro for that I would love to look into it as well

I had a look at your crash dump and have a lead, that might help resolve the current crash