I'm trying to debug executable notepad.exe (from Windows 10 distribution), and symbols ntdll.pdb from Microsoft symbols server are required, but debugger returns an error that they cannot find file specified:
0:000> .reload
Reloading current modules
.................................
SYMSRV: BYINDEX: 0x25
http://msdl.microsoft.com/download/symbols
ntdll.pdb
BC08E2B7EBB349A18DCE18BE9AA6660E1
SYMSRV: HTTPGET: /download/symbols/ntdll.pdb/BC08E2B7EBB349A18DCE18BE9AA6660E1/ntdll.pdb
SYMSRV: HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/ntdll.pdb/BC08E2B7EBB349A18DCE18BE9AA6660E1/ntdll.pd_
SYMSRV: HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/ntdll.pdb/BC08E2B7EBB349A18DCE18BE9AA6660E1/file.ptr
SYMSRV: HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV: C:\ProgramData\dbg\sym\ntdll.pdb\BC08E2B7EBB349A18DCE18BE9AA6660E1\ntdll.pdb - file not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntdll.pdb/BC08E2B7EBB349A18DCE18BE9AA6660E1/ntdll.pdb not found
SYMSRV: C:\ProgramData\dbg\sym\ntdll.pdb\BC08E2B7EBB349A18DCE18BE9AA6660E1\ntdll.pdb not found
DBGHELP: C:\WINDOWS\SYSTEM32\ntdll.pdb - file not found
DBGHELP: ntdll.pdb - file not found
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
DBGHELP: ntdll - export symbols
************* Symbol Loading Error Summary **************
Module name Error
SharedUserData No error - symbol load deferred
Symbol loading has been deferred because this symbol is not needed
at this time. Use reload /f to force load symbols.
ntdll The system cannot find the file specified : http://msdl.microsoft.com/download/symbols
The SYMSRV client failed to find a file in the UNC store, or there
is an invalid UNC store (an invalid path or the pingme.txt file is
not present in the root directory), or the file is present in the
symbol server exclusion list.
Is it possible that MS server does not contain required symbols?
It is: version 10.0.14393.447 (rs1_release_inmarket.161102-0100)
The NTDLL.PDB (ntdll.pdb\BC08E2B7EBB349A18DCE18BE9AA6660E1\ntdll.pdb) is now online and I was able to get the PDB:
00007ffb`c79c0000 00007ffb`c7b91000 ntdll
(pdb symbols) d:\sym\dl\nt\ntdll.pdb\BC08E2B7EBB349A18DCE18BE9AA6660E1\ntdll.pdb
Loaded symbol image file: ntdll.dll
Image path: C:\Windows\System32\ntdll.dll
Image name: ntdll.dll
Browse all global symbols functions data
Timestamp: Wed Nov 2 11:13:06 2016 (5819BC32)
CheckSum: 001DA569
ImageSize: 001D1000
File version: 10.0.14393.447
Product version: 10.0.14393.447
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntdll.dll
OriginalFilename: ntdll.dll
ProductVersion: 10.0.14393.447
FileVersion: 10.0.14393.447 (rs1_release_inmarket.161102-0100)
FileDescription: NT Layer DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
So try again to load the symbols.
Related
I'm attempting to debug an application using WinDbg. The server doesn't have internet access, so I can't use the Microsoft Symbol server. I went ahead and downloaded the symbols for Server 2012 R2 Retail. Moved them over to the server, and installed to C:\Symbols.
When I attempt to run the debugger, I get the following output.
CommandLine: C:\actionsync\ActionSync\ActionSync.exe
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*
DBGHELP: Symbol Search Path: .sympath srv*c:\symbols*
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred .sympath srv*c:\Symbols*
DBGHELP: Symbol Search Path: .sympath srv*c:\symbols*
DBGHELP: Symbol Search Path: .sympath srv*c:\symbols*
Symbol search path is: .sympath srv*c:\Symbols*
Executable search path is: srv*
DBGHELP: SharedUserData - virtual symbol module
ModLoad: 00ec0000 00ecc000 ActionSync.exe
ModLoad: 77120000 7728f000 ntdll.dll
ModLoad: 6fc30000 6fc86000 C:\Windows\SysWOW64\MSCOREE.DLL
ModLoad: 74de0000 74f20000 C:\Windows\SysWOW64\KERNEL32.dll
ModLoad: 74f20000 74ff7000 C:\Windows\SysWOW64\KERNELBASE.dll
(1054.478): Break instruction exception - code 80000003 (first chance)
DBGHELP: Invalid path: '.sympath srv*c:\symbols*'
DBGHELP: C:\Windows\SYSTEM32\wntdll.pdb - file not found
DBGHELP: wntdll.pdb - file not found
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
DBGHELP: ntdll - export symbols
eax=00000000 ebx=00000000 ecx=7fdc0000 edx=00000000 esi=7ee16000 edi=00000000
eip=771d3c7d esp=0104f2f4 ebp=0104f320 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!LdrInitShimEngineDynamic+0x6dd:
771d3c7d cc int 3
I am completely new to using WinDbg. Additionally, I cannot install VS on this machine.
As far as I know, I have everything setup correctly, but I'm still not able to debug this application.
Any help would be appreciated.
EDIT 1:
I updated the symbol path based on Thomas Weller's Comment
Here is the output
0:000> .sympath
Symbol search path is: .sympath srv*c:\Symbols*
Expanded Symbol search path is: .sympath srv*c:\symbols*
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred .sympath srv*c:\Symbols*
Error: Change all symbol paths attempts to access '.sympath c:\symbols' failed: 0x7b - The filename, directory name, or volume label syntax is incorrect.
************* Symbol Path validation summary **************
Response Time (ms) Location
Error 16 .sympath c:\symbols
DBGHELP: Symbol Search Path: .sympath c:\symbols
DBGHELP: Symbol Search Path: .sympath c:\symbols
0:000> .reload
Reloading current modules
.....
DBGHELP: Invalid path: '.sympath c:\symbols'
DBGHELP: C:\Windows\SYSTEM32\wntdll.pdb - file not found
DBGHELP: wntdll.pdb - file not found
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
DBGHELP: ntdll - export symbols
************* Symbol Loading Error Summary **************
Module name Error
ntdll All symbol search paths were invalid
Please check your symbol search path.
The following location did not respond and were excluded during symbol loading:
.sympath c:\symbols
EDIT 2:
So, it appears that the sympath is case sensitive.
I updated the sympath C:\Symbols
This is the output.
************* Symbol Path validation summary **************
Response Time (ms) Location
OK c:\Symbols
DBGHELP: Symbol Search Path: c:\symbols
DBGHELP: Symbol Search Path: c:\symbols
0:000> .reload
Reloading current modules
.....
DBGHELP: c:\symbols\wntdll.pdb - file not found
DBGHELP: c:\symbols\dll\wntdll.pdb - file not found
DBGHELP: c:\symbols\symbols\dll\wntdll.pdb - file not found
DBGHELP: C:\Windows\SYSTEM32\wntdll.pdb - file not found
DBGHELP: wntdll.pdb - file not found
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
DBGHELP: ntdll - export symbols
************* Symbol Loading Error Summary **************
Module name Error
ntdll PDB not found : c:\symbols\symbols\dll\wntdll.pdb
Unable to locate the .pdb file in this location
For both solutions, you need a copy of WinDbg (not neccesarily an installation). You find symchk in the WinDbg folder.
Solution for a specific dump / specific debug session
On the machine where you're debugging, create crash dump file with .dump. Skip this step if you already have a crash dump file.
At a command prompt, create a manifest file, i.e. a file that contains information about the symbols to be downloaded
symchk /id <dumpfile>.dmp /om D:\symbols.manifest
/id is for input = dump
/om is for output = manifest
Transfer that manifest file onto a machine with Internet access.
On the Internet machine then run
symchk /im X:\symbols.manifest /s srv*X:\downloadedsymbols\*http://msdl.microsoft.com/download/symbols /od
at the command prompt.
/im is for input = manifest
/od is for output details (like verbose)
Transfer the symbols back to the machine without Internet access. Copy them into a new folder, e.g. c:\downloadedsymbols, not c:\symbols . Don't use an existing symbol path, because the n-tier-layout might not match.
Open the crash dump in WinDbg.
Fix the symbols
.sympath C:\downloadedsymbols
and maybe
.reload /f
Solution for retrieving all symbols of the machine without Internet
Note: this process may take really long, since it may download thousands of symbols
At a command prompt, run
symchk /r /if %windir% /om D:\windir.manifest
/r is for recursive
/if is for input = files
/om is for output = manifest
Transfer that manifest file onto a different machine with Internet access.
On the Internet machine, run
symchk /im X:\windir.manifest /s srv*X:\winsymbols\*http://msdl.microsoft.com/download/symbols /od
/im is for input = manifest
/od is for output details (like verbose)
Transfer the symbols back to the machine without Internet access. Copy them into a new folder, e.g. c:\winsymbols, not c:\symbols . Don't use an existing symbol path, because the n-tier-layout might not match.
Use the symbols with
.sympath C:\winsymbols
.reload
I am starting windbg using the following command line:
C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64>windbg -i c:\tmp\Psscor4\amd64;c:\tmp\Psscor4\x86;c:\tmp;srv*E:\symbols*http://msdl.microsoft.com/download/symbols
C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64>
Then I load a memory crash dump and inspect where did it load the clr.dll from:
Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\tmp\Memory.dmp]
User Mini Dump File with Full Memory: Only application data is available
Comment: 'Dump created by DbgHost. First chance exception 0XE0434352'
Symbol search path is: c:\tmp\Psscor4\amd64;c:\tmp\Psscor4\x86;c:\tmp;srv*E:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\tmp\Psscor4\amd64;c:\tmp\Psscor4\x86;c:\tmp;srv*E:\symbols*http://msdl.microsoft.com/download/symbols
Windows 7 Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 6.1.7601.17965 (win7sp1_gdr.121004-0333)
Machine Name:
Debug session time: Mon Oct 14 13:45:55.000 2013 (UTC - 4:00)
System Uptime: not available
Process Uptime: 0 days 2:49:12.000
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
............................................................
Loading unloaded module list
..
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(5768.5db4): CLR exception - code e0434352 (first/second chance not available)
KERNELBASE!RaiseException+0x39:
000007fe`fd33bccd 0000 add byte ptr [rax],al ds:00000000`3af07bb2=00
0:122> lm vm clr
start end module name
000007fe`f9a70000 000007fe`fa3ce000 clr (deferred)
Image path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
Image name: clr.dll
Timestamp: Mon Jul 09 00:10:25 2012 (4FFA59B1)
CheckSum: 00959DDE
ImageSize: 0095E000
File version: 4.0.30319.17929
Product version: 4.0.30319.17929
File flags: 8 (Mask 3F) Private
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
0:122> ld clr
Symbols loaded for clr
0:122> lm vm clr
start end module name
000007fe`f9a70000 000007fe`fa3ce000 clr (pdb symbols) e:\symbols\clr.pdb\D3D86782AEDD446F917F5D81FDFD3D252\clr.pdb
Loaded symbol image file: clr.dll
Mapped memory image file: c:\tmp\clr.dll
Image path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
Image name: clr.dll
Timestamp: Mon Jul 09 00:10:25 2012 (4FFA59B1)
CheckSum: 00959DDE
ImageSize: 0095E000
File version: 4.0.30319.17929
Product version: 4.0.30319.17929
File flags: 8 (Mask 3F) Private
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
0:122> .exepath
Executable image search path is: c:\tmp\Psscor4\amd64;c:\tmp\Psscor4\x86;c:\tmp;srv*E:\symbols*http://msdl.microsoft.com/download/symbols
Expanded Executable image search path is: c:\tmp\psscor4\amd64;c:\tmp\psscor4\x86;c:\tmp;srv*e:\symbols*http://msdl.microsoft.com/download/symbols
So, my question is why does windbg insist on loading clr.dll from C:\Windows\Microsoft.NET\Framework64\v4.0.30319 when both the image path and the symbol path direct to another location where sits the clr.dll that I truly need - c:\tmp?
Now, when I force loading of the symbols, then we can see this:
Loaded symbol image file: clr.dll
Mapped memory image file: c:\tmp\clr.dll
Image path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
Image name: clr.dll
I do not like it. I want the image path to come from c:\tmp as well.
How do I do it?
The Image path shows where debugee (the process which were dumped) found the clr.dll.
Like it or not, it's noting you can do about it :-)
TL;DR
Why does WinDBG lmvdisplay two version info fields (when no other tool I know of does this) and under which circumstances can these fields differ?
Background: I have a live dump (from a deadlock) of our application. Symbols are loaded correctly and I was able to trace back the deadlock to Microsoft's pdm.dll ("Process Debug Manager" used for our vbscript engine).
I then wanted to check which version of this DLL was loaded in the session at the production site:
0:000> lmv m pdm
start end module name
51860000 518b8000 pdm # (pdb symbols) d:\symcache\pdm.pdb\7BE601EDE9234816B72B49DA4A25DF042\pdm.pdb
Loaded symbol image file: pdm.dll
Image path: C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\pdm.dll
Image name: pdm.dll
Timestamp: Tue Jul 29 16:46:11 2008 (488F2D33)
CheckSum: 000663E0
ImageSize: 00058000
?? File version: 9.0.30729.1
?? Product version: 9.0.30729.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Visual Studio .NET
InternalName: pdm.dll
OriginalFilename: pdm.dll
?? ProductVersion: 7.10.3077
?? FileVersion: 7.10.3077
FileDescription: Process Debug Manager
LegalCopyright: Copyright© Microsoft Corporation. All rights reserved.
As you can see, the file and product versions are displayed twice, but they are mismatched in the dump!
When I cross-check on my machine for (apparently, see the timestamp and checksum!) the same file for a running iexplore process:
0:043> lmv m pdm
start end module name
3efa0000 3eff8000 pdm (pdb symbols) c:\windows\symbols\martin-cache\pdm.pdb\415D0A165EB24613BC01CE516512062C2\pdm.pdb
Loaded symbol image file: C:\Program Files (x86)\Internet Explorer\pdm.dll
Image path: C:\Program Files (x86)\Internet Explorer\pdm.dll
Image name: pdm.dll
Timestamp: Tue Jul 29 16:46:11 2008 (488F2D33)
CheckSum: 000663E0
ImageSize: 00058000
File version: 9.0.30729.1
Product version: 9.0.30729.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Visual Studio® 2008
InternalName: pdm.dll
OriginalFilename: pdm.dll
ProductVersion: 9.0.30729.1
FileVersion: 9.0.30729.1 built by: SP
FileDescription: Process Debug Manager
LegalCopyright: © Microsoft Corporation. All rights reserved.
the version infos match up.
lmv displays the strings which are defined in the resource file,
I don’t know why there is common to two set of File/Product versions names the same except some spaces.
0:041> lmv m kernel32
start end module name
753e0000 754f0000 kernel32 (deferred)
Image path: C:\Windows\SysWOW64\kernel32.dll
Image name: kernel32.dll
Timestamp: Fri Aug 02 03:53:25 2013 (51FB1115)
CheckSum: 00111A9F
ImageSize: 00110000
File version: 6.1.7601.18229
Product version: 6.1.7601.18229
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: kernel32
OriginalFilename: kernel32
ProductVersion: 6.1.7601.18229
FileVersion: 6.1.7601.18229 (win7sp1_gdr.130801-1533)
In your case you have two different dll’s, look at the image file path.
Image path: C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\
and
Image path: C:\Program Files (x86)\Internet Explorer
They must have different strings in the resource section, winDbg can’t do anything but display it.
Since the time stamps are identical, one may have been tampered.
I'm investigating a w3wp crash on our production machines, I'm loading the crashdump with windbg with the following settings:
SRV*C:\MicrosoftSymbols*http://msdl.microsoft.com/download/symbols;C:\MySymbols
sym noisy
(also tried symbol path http://msdn.microsoft.com/en-us/windows/hardware/gg463028)
Why can't it still not load the msvcr80 symbols?
0:025> !analyze -v
*
Exception Analysis *
*
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\w3wp.exe\45D6968E5000\w3wp.exe - OK DBGENG:
C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\w3wp.exe\45D6968E5000\w3wp.exe - Mapped
image memory DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\mscorwks.dll\4889DC18590000\mscorwks.dll -
OK DBGENG: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\mscorwks.dll\4889DC18590000\mscorwks.dll -
Mapped image memory SYMSRV: mscorwks.pdb from
http://msdl.microsoft.com/download/symbols: 4599999 bytes - copied
DBGHELP: mscorwks - public symbols
c:\microsoftsymbols\mscorwks.pdb\37AFE5AF09D54705B6B685CBCD2208FC2\mscorwks.pdb
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\mscorlib.ni.dll\4889DC80af7000\mscorlib.ni.dll
- mismatched DBGHELP: C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\mscorlib.ni.dll\4889DC80af7000\mscorlib.ni.dll
- mismatched DBGHELP: C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll - file not found DBGHELP:
C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll -
file not found SYMSRV: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\mscorlib.ni.dll\4889DC80af7000\mscorlib.ni.dll
- file not found DBGHELP: C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll - file not found DBGHELP:
C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll -
file not found SYMSRV:
c:\microsoftsymbols\mscorlib.ni.dll\4889DC80af7000\mscorlib.ni.dll not
found SYMSRV:
http://msdl.microsoft.com/download/symbols/mscorlib.ni.dll/4889DC80af7000/mscorlib.ni.dll
not found DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\mscorlib.ni.dll - file not found DBGHELP:
C:\Program Files (x86)\Windows Kits\8.0\Debuggers\mscorlib.ni.dll -
file not found DBGHELP: mscorlib.ni.dll not found in c:\mysymbols
DBGHELP: mscorlib.ni.dll not found in c:\mysymbols DBGENG:
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll - Couldn't map image from disk. Unable to load image C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll,
Win32 error 0n2 DBGENG: mscorlib.ni.dll - Partial symbol image load
missing image info DBGHELP: Module is not fully loaded into memory.
DBGHELP: Searching for symbols using debugger-provided data. SYMSRV:
mscorlib.pdb from http://msdl.microsoft.com/download/symbols: 117111
bytes - copied
* WARNING: Unable to verify timestamp for mscorlib.ni.dll DBGHELP: mscorlib_ni - public symbols
c:\microsoftsymbols\mscorlib.pdb\E47AF49130474776AF6C5994C50088421\mscorlib.pdb
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\kernel32.dll\49C51F0A102000\kernel32.dll -
OK DBGENG: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\kernel32.dll\49C51F0A102000\kernel32.dll -
Mapped image memory SYMSRV: kernel32.pdb from
http://msdl.microsoft.com/download/symbols: 416879 bytes - copied
DBGHELP: kernel32 - public symbols
c:\microsoftsymbols\kernel32.pdb\BE496DC9472F4438B080C70594D8F9CC2\kernel32.pdb
SYMSRV: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll not
found SYMSRV: user32.dll from
http://msdl.microsoft.com/download/symbols: 266731 bytes - copied
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll already
cached DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll already
cached DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll - OK
DBGENG: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\user32.dll\45E7C67691000\user32.dll -
Mapped image memory SYMSRV: user32.pdb from
http://msdl.microsoft.com/download/symbols: 293451 bytes - copied
DBGHELP: user32 - public symbols
c:\microsoftsymbols\user32.pdb\B29B53A483EA4F5DAF2BF0FB1A4E7DB92\user32.pdb
DBGHELP: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\ole32.dll\45D70AA5139000\ole32.dll - OK
DBGENG: C:\Program Files (x86)\Windows
Kits\8.0\Debuggers\x86\sym\ole32.dll\45D70AA5139000\ole32.dll - Mapped
image memory SYMSRV: ole32.pdb from
http://msdl.microsoft.com/download/symbols: 1014574 bytes - copied
DBGHELP: ole32 - public symbols
c:\microsoftsymbols\ole32.pdb\DC8A079CAE0B4A0C89EC5A936EAF1F7F2\ole32.pdb
FAULTING_IP: msvcr80!terminate+4d 781346b4 e820460000 call
msvcr80!_SEH_epilog4 (78138cd9)
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 781346b4 (msvcr80!terminate+0x0000004d)
ExceptionCode: 40000015 ExceptionFlags: 00000000 NumberParameters: 0
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
PROCESS_NAME: w3wp.exe
ERROR_CODE: (NTSTATUS) 0x40000015 - {Fatal Application Exit} %hs
EXCEPTION_CODE: (NTSTATUS) 0x40000015 (1073741845) - {Fatal
Application Exit} %hs
APP: w3wp.exe
MANAGED_STACK: !dumpstack -EE No export dumpstack found
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS
LAST_CONTROL_TRANSFER: from 00000000 to 781346b4
STACK_TEXT: 14b98e30 00000000 00000000 00000000 00000000
msvcr80!terminate+0x4d
FOLLOWUP_IP: msvcr80!terminate+4d 781346b4 e820460000 call
msvcr80!_SEH_epilog4 (78138cd9)
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: msvcr80!terminate+4d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: msvcr80
IMAGE_NAME: msvcr80.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4889d619
STACK_COMMAND: ~25s; .ecxr ; kb
FAILURE_BUCKET_ID: WRONG_SYMBOLS_40000015_msvcr80.dll!terminate
BUCKET_ID: APPLICATION_FAULT_WRONG_SYMBOLS_msvcr80!terminate+4d
WATSON_STAGEONE_URL:
http://watson.microsoft.com/StageOne/w3wp_exe/6_0_3790_3959/45d6968e/msvcr80_dll/8_0_50727_3053/4889d619/40000015/000046b4.htm?Retriage=1
WATSON_IBUCKET: 977211931
WATSON_IBUCKETTABLE: 1
Followup: MachineOwner
Regards,
Michel
Sometimes Windbg need access to .dll file itself to be able to locate the .pdb
(if the actual dump don’t contain enough of the header)
Find the msvcr80.dll from the crashed machine, and locate it by
File->Image File Path, and .reload
I am doing remote debugging of windows vista using VmWare , but i encounter the
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe "
also , if i give "!process 0 0 " in windbg , i get
**** NT ACTIVE PROCESS DUMP **** NT symbols are incorrect, please fix symbols
I tried setting _NT_SYMBOL_PATH to "symsrv*symsrv.dll*c:\symbols*http://msdl.microsoft.com/download/symbols" (This was given in http://support.microsoft.com/kb/311503/) , then i changed the symbol file path of windbg to "srv*C:\Symbols\MsSymbols*http://msdl.microsoft.com/download/symbols" , but even after that i get the same errors, when i run symchk.exe to download symbols, i could get a lot of FAILED messages.
when i try to reload using .reload after running !sym noisy, i get
Connected to Windows Vista 6000 x86 compatible target at (Sat Jan 28 16:52:23.839 2012 (GMT+5)), ptr64 FALSE
SYMSRV: The system cannot find the file specified.
SYMSRV: The system cannot find the file specified.
SYMSRV: The system cannot find the file specified.
SYMSRV: c:\symbols\mssymbols\ntkrpamp.pdb\FD50D285751D4684938604B2CC1B41682\ntkrpamp.pdb not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntkrpamp.pdb/FD50D285751D4684938604B2CC1B41682/ntkrpamp.pdb not found
DBGHELP: ntkrpamp.pdb - file not found
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
DBGHELP: nt - export symbols
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
....
But still when i try to run !process 0 0 , i get an error saying incorrect symbols
Thanks for your help and time in advance..
Your fixed symbol path looks good to me, that first path was entirely incorrect. Can you try the following commands and see if it works?
.symfix c:\websymbols
.reload /o
If that doesn't work, are you running and official version on the target? As in, it's not a Beta release or something, right? You might also want to rule out any networking issues.
I've encountered the same problems.
It is that My IE browser cannt connect Internet(while others could) causing the windbg return ERROR_CANNOT_CONNECT_INTERNET resulting pdb-file cannot be found..
SYMSRV: BYINDEX: 0x5
d:\symbolslocal*http://msdl.microsoft.com/download/symbols
ntdll.dll
4CE7B96E13c000
SYMSRV: d:\symbolslocal\ntdll.dll\4CE7B96E13c000\ntdll.dll - file not found
SYMSRV: HTTPGET: /download/symbols/ntdll.dll/4CE7B96E13c000/ntdll.dll
SYMSRV: HttpSendRequest: 12029 - ERROR_INTERNET_CANNOT_CONNECT
SYMSRV: d:\symbolslocal\ntdll.dll\4CE7B96E13c000\ntdll.dll not found
SYMSRV:http://msdl.microsoft.com/download/symbols/ntdll.dll/4CE7B96E13c000/ntdll.dll not found
DBGHELP: E:\Program Files (x86)\Windows Kits\10\Debuggers\x64\ntdll.dll - file not found
DBGHELP: E:\Program Files (x86)\Windows Kits\10\Debuggers\x64\ntdll.dll - file not found
DBGENG: ntdll.dll - Image mapping disallowed by non-local path.
DBGHELP: No debug info for ntdll.dll. Searching for dbg file
SYMSRV: BYINDEX: 0x6
d:\symbolslocal*http://msdl.microsoft.com/download/symbols
ntdll.dbg
4CE7B96E13c000
SYMSRV: d:\symbolslocal\ntdll.dbg\4CE7B96E13c000\ntdll.dbg - file not found
SYMSRV: HTTPGET: /download/symbols/ntdll.dbg/4CE7B96E13c000/ntdll.dbg
SYMSRV: HttpSendRequest: 12029 - ERROR_INTERNET_CANNOT_CONNECT
SYMSRV: d:\symbolslocal\ntdll.dbg\4CE7B96E13c000\ntdll.dbg not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntdll.dbg/4CE7B96E13c000/ntdll.dbg not found
DBGHELP: .\ntdll.dbg - file not found
DBGHELP: .\dll\ntdll.dbg - path not found
DBGHELP: .\symbols\dll\ntdll.dbg - path not found
DBGHELP: ntdll.dll missing debug info. Searching for pdb anyway
DBGHELP: Can't use symbol server for ntdll.pdb - no header information available
DBGHELP: ntdll.pdb - file not found
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
So just fix IE problem, then windbg will work fine.
About how to fix IE problem,
open 'Internet Options' --- > 'Connection' --->
delete all connections -----> restart the IE ----> IE OK
Then windbg can access Internet now, it can download symbol files now.
IE cannot access INTERNET may cause many probs in many programs.Hope it helps.