#3932 Attach dialog shows malformed arguments when the launch path differs from the image path

Operating System

Windows 11 Pro 25H2 x64, build 26200.9168
Microsoft.WindowsNotepad 11.2606.15.0 x64

x64dbg Version

May 27 2026 snapshot, x64.

The same dbglistprocesses function is unchanged in the current development branch at commit 17233957 (August 15, 2026).

Describe the issue

The Attach dialog can show malformed command-line arguments when the path or letter casing used to start a process does not exactly match its real image path.

For Windows Notepad in this environment:

Real image path: C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2606.15.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe
Full process command line: "C:\Windows\notepad.exe" C:\Windows\win.ini
Value shown by the Attach dialog: :\Windows\notepad.exe" C:\Windows\win.ini
Expected arguments: C:\Windows\win.ini

DbgFunctions()->GetProcessList returns the same malformed value in DBGPROCESSINFO.szExeArgs, so plugins using this SDK function are affected too.

The current code uses case-sensitive strstr calls to locate the executable path or name. In this example, Notepad.exe does not match notepad.exe. The match length remains zero, and the quoted-command branch then skips only the first two characters of the full command line.

Suspected code location

The problem appears to be in src/dbg/debugger.cpp, inside dbglistprocesses:

The full image path, executable name, and base name are searched with case-sensitive strstr calls (lines 2613–2671).
When all searches fail, cmdLineExeSize remains 0.
The QOUTES_AROUND_EXE branch then returns cmdline + cmdLineExeSize + 2 (lines 2713–2725), which becomes cmdline + 2 in this case.

A possible fix is to compare Windows executable paths/names case-insensitively and use the first command-line token as a safe fallback when no image-path match is found.

Steps to reproduce

Start Notepad from PowerShell:

& "$env:WINDIR\notepad.exe" "$env:WINDIR\win.ini"

Open x64dbg x64 and open the Attach dialog (Alt+A).
Find the new Notepad process and inspect its command-line arguments.

Attachments

None.

Disclosure: This report was drafted with AI assistance from a locally verified reproduction and source review.

If you think this issue is valid and worth fixing, I can try to contribute a PR (although I am not very familiar with Qt yet ).