Re: 关于ntdll.dll对应的符号文件

0:005> .sympath

Symbol search path is: srv*d:\mssymbols*http://msdl.microsoft.com/download/symbols

Expanded Symbol search path is: srv*d:\mssymbols*http://msdl.microsoft.com/download/symbols

************* Symbol Path validation summary **************

Response Time (ms) Location

Deferred srv*d:\mssymbols*http://msdl.microsoft.com/download/symbols

0:005> .reload

Reloading current modules

....................................

0:005> !heap -s

*************************************************************************

*** ***

*** Either you specified an unqualified symbol, or your debugger ***

*** doesn't have full symbol information. Unqualified symbol ***

*** resolution is turned off by default. Please either specify a ***

*** fully qualified symbol module!symbolname, or enable resolution ***

*** of unqualified symbols by typing ".symopt- 100". Note that ***

*** enabling unqualified symbol resolution with network symbol ***

*** server shares in the symbol path may cause the debugger to ***

*** appear to hang for long periods of time when an incorrect ***

*** symbol name is typed or the network symbol server is down. ***

*** ***

*** For some commands to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: ntdll!_HEAP_ENTRY ***

*** ***

*************************************************************************

Invalid type information

!heap -s总是提示符号不对 ntdll!_HEAP_ENTRY 这个总是提示找不到，试过了各种办法，windbg的版本也换了几个，都是不行，最后怀疑是微软提供的符号有问题。

0:005> !lmi ntdll

Loaded Module Info: [ntdll]

Module: ntdll

Base Address: 0000000077360000

Image Name: C:\Windows\SYSTEM32\ntdll.dll

Machine Type: 34404 (X64)

Time Stamp: 55b02e88 Thu Jul 23 08:00:08 2015

Size: 1a9000

CheckSum: 1b56fe

Characteristics: 2022 perf

Debug Data Dirs: Type Size VA Pointer

CODEVIEW 22, fd498, fc898 RSDS - GUID: {4BF6B131-3C5C-41D5-BC33-DD96E4F33786}

Age: 2, Pdb: ntdll.pdb

CLSID 4, fd494, fc894 [Data not mapped]

Image Type: FILE - Image read successfully from debugger.

C:\Windows\SYSTEM32\ntdll.dll

Symbol Type: PDB - Symbols loaded successfully from image path.

d:\mssymbols\ntdll.pdb\4BF6B1313C5C41D5BC33DD96E4F337862\ntdll.pdb

Load Report: public symbols , not source indexed

d:\mssymbols\ntdll.pdb\4BF6B1313C5C41D5BC33DD96E4F337862\ntdll.pdb

4BF6B1313C5C41D5BC33DD96E4F337862 应该是个GUID吧，其它电脑上ntdll对应的符号文件的GUID不是这个值，运行很正常。

ntdll的信息如下：

0:005> lm vm ntdll

start end module name

00000000`77360000 00000000`77509000 ntdll (pdb symbols) d:\mssymbols\ntdll.pdb\4BF6B1313C5C41D5BC33DD96E4F337862\ntdll.pdb

Loaded symbol image file: C:\Windows\SYSTEM32\ntdll.dll

Image path: C:\Windows\SYSTEM32\ntdll.dll

Image name: ntdll.dll

Timestamp: Thu Jul 23 08:00:08 2015 (55B02E88)

CheckSum: 001B56FE

ImageSize: 001A9000

File version: 6.1.7601.18939

Product version: 6.1.7601.18939

File flags: 0 (Mask 3F)

File OS: 40004 NT Win32

File type: 2.0 Dll

File date: 00000000.00000000

Translations: 0409.04b0

CompanyName: Microsoft Corporation

ProductName: Microsoft® Windows® Operating System

InternalName: ntdll.dll

OriginalFilename: ntdll.dll

ProductVersion: 6.1.7601.18939

FileVersion: 6.1.7601.18939 (win7sp1_gdr.150722-0600)

FileDescription: NT Layer DLL

Re: 关于ntdll.dll对应的符号文件

C/C++本地代码调试

关于ntdll.dll对应的符号文件

Re: 关于ntdll.dll对应的符号文件

Re: 关于ntdll.dll对应的符号文件