none
Request for windows symbol server RRS feed

  • 问题

  •  在使用Windbg对一个蓝屏memory dump进行分析时,打开dump file时,windbg提示
    Symbol search path is: c:\windows\symbols;SRV*c:\webdown*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
    Machine Name:
    Kernel base = 0x81c02000 PsLoadedModuleList = 0x81d19c70
    Debug session time: Tue Jan  1 21:49:04.422 2008 (GMT+8)
    System Uptime: 0 days 0:08:28.038
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    我安装在本地的symbol版本windows_longhorn.6001.080118-1840.x86fre.symbols
    memory dump 是从一台vista x86 sp1的机器上copy过来的,如下
    0: kd> vertarget
    Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
    Machine Name:*** ERROR: Module load completed but symbols could not be loaded for srv.sys
    0: kd> .reload nt
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    0: kd> !sym noisy
    noisy mode - symbol prompts on
    0: kd> .reload nt
    DBGHELP: c:\windows\symbols\ntkrpamp.pdb - file not found
    DBGHELP: c:\windows\symbols\exe\ntkrpamp.pdb - mismatched pdb
    DBGHELP: c:\windows\symbols\symbols\exe\ntkrpamp.pdb - file not found
    SYMSRV:  c:\webdown\ntkrpamp.pdb\E3AF30C94A334570818A670674C7F9602\ntkrpamp.pdb not found
    SYMSRV:  http://msdl.microsoft.com/downloads/symbols/ntkrpamp.pdb/E3AF30C94A334570818A670674C7F9602/ntkrpamp.pdb not found
    SYMSRV:  c:\webdown\ntkrpamp.pdb\E3AF30C94A334570818A670674C7F9602\ntkrpamp.pdb not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrpamp.pdb/E3AF30C94A334570818A670674C7F9602/ntkrpamp.pdb not found
    DBGHELP: ntkrpamp.pdb - file not found
    DBGHELP: Couldn't load mismatched pdb for ntkrpamp.exe
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    DBGHELP: nt - export symbols


    请问这种问题该怎么解决,symbol file server有用体还是需要其他的设置呢??
    谢谢
    Jacky_Deng
    2009年2月17日 4:53

全部回复

  • 正确的做法如下:

    ------------------------------------------------------------

    首先下载windebug

     

    http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

    说下debug方法
    1.
    我的电脑,属性->高级->启动,最下面的内存调试选最后一项的全部,确定后重新启动
    2.
    蓝屏后不要急着重启,系统会保存整个内存内容,然后会自动重启
    3.
    重启后,windows目录会多出 MEMORY.DMP, 如果1步骤选完全调试,那么这个文件和你的内存一样大
    4.
    下载安装windwos debug tools, 我这有下载地址,或微软网站
    http://public.hshh.org/SysTools/debug/dbg_x86_6.6.07.5.exe
    5.
    安装后创建一个临时目录,例如 c:\temp
    6.
    启动 windbg
    7. windbg
    界面: file->symbol file path (ctrl+s) 输入:
    SRV*c:\temp*http://msdl.microsoft.com/download/symbols
    然后确定
    8. windbg
    界面: file->open crash dump(ctrl+d),打开windows目录下面的 memory.dmp
    9.
    打开后,等待提示
    当出现 Use !analyze -v to get detailed debugging information. 字样后,在下面输入框
    !analyze -v
    10.
    等待分析完毕,可以知道什么导致的出错
    11. windbg
    使用中需要网上下载调试内容,这个速度嘛,取决于你的网络了。

    -----------------------------------------------------------------------

    你把敲!analyze -v的信息发上来也可以!

     


    Microsoft Certified Systems Engineer 如果您觉得对您有帮助,请在“是否有帮助”点“是”;如果你觉得回复很满意,请“标记为已解答”
    2009年2月17日 6:30
  • 这位大侠,我做的步骤和你一样啊,我的memory dump只是kernel memory dump
    symbol path 除了设置了symbol server我还设置了一个本地已经安装的symbol file
    但是windbg仍然会提示找不到symbol,如果是网速问题,会提示找不到吗??
    SYMSRV:  c:\webdown\ntkrpamp.pdb\E3AF30C94A334570818A670674C7F9602\ntkrpamp.pdb not found
    SYMSRV:  http://msdl.microsoft.com/downloads/symbols/ntkrpamp.pdb/E3AF30C94A334570818A670674C7F9602/ntkrpamp.pdb not found
    SYMSRV:  c:\webdown\ntkrpamp.pdb\E3AF30C94A334570818A670674C7F9602\ntkrpamp.pdb not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrpamp.pdb/E3AF30C94A334570818A670674C7F9602/ntkrpamp.pdb not found
    谢谢

    Jacky_Deng
    2009年2月17日 6:43
  • 你先不要设置本地的!试试
    Microsoft Certified Systems Engineer 如果您觉得对您有帮助,请在“是否有帮助”点“是”;如果你觉得回复很满意,请“标记为已解答”
    2009年2月17日 6:47
  •  

    Loading Dump File [C:\Users\gr4\Desktop\MEMORY0A for zy6l x86 lan card.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*c:\webdown*http://msdl.microsoft.com/download/symbols;c:\windows\symbols
    Executable search path is:
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
    Machine Name:
    Kernel base = 0x81c02000 PsLoadedModuleList = 0x81d19c70
    Debug session time: Tue Jan  1 21:49:04.422 2008 (GMT+8)
    System Uptime: 0 days 0:08:28.038
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 7ffd700c).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    ........
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for halmacpi.dll -
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {c4, 2, 1, 81fbeede}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    Page 98f11 not present in the dump file. Type ".hh dbgerr004" for details
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    Unable to open image file: C:\Program Files\Debugging Tools for Windows (x86)\sym\halmacpi.dll\48740A0633000\halmacpi.dll
    The system cannot find the file specified.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    PEB is paged out (Peb.Ldr = 7ffd700c).  Type ".hh dbgerr001" for details
    PEB is paged out (Peb.Ldr = 7ffd700c).  Type ".hh dbgerr001" for details
    Probably caused by : ntkrpamp.exe ( nt!Kei386EoiHelper+291c )

    Followup: MachineOwner
    ---------

    0: kd> !process 0 0
    **** NT ACTIVE PROCESS DUMP ****
    NT symbols are incorrect, please fix symbols

    还是不可以阿,还是红色部分是什么意思?


    Jacky_Deng
    2009年2月17日 8:18
  •   

    Loading Dump File [C:\Users\gr4\Desktop\MEMORY0A for zy6l x86 lan card.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*c:\webdown*http://msdl.microsoft.com/download/symbols;c:\windows\symbols
    Executable search path is:
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
    Machine Name:
    Kernel base = 0x81c02000 PsLoadedModuleList = 0x81d19c70
    Debug session time: Tue Jan  1 21:49:04.422 2008 (GMT+8)
    System Uptime: 0 days 0:08:28.038
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 7ffd700c).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    ........
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for halmacpi.dll -
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {c4, 2, 1, 81fbeede}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    Page 98f11 not present in the dump file. Type ".hh dbgerr004" for details
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    Unable to open image file: C:\Program Files\Debugging Tools for Windows (x86)\sym\halmacpi.dll\48740A0633000\halmacpi.dll
    The system cannot find the file specified.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    PEB is paged out (Peb.Ldr = 7ffd700c).  Type ".hh dbgerr001" for details
    PEB is paged out (Peb.Ldr = 7ffd700c).  Type ".hh dbgerr001" for details
    Probably caused by : ntkrpamp.exe ( nt!Kei386EoiHelper+291c )

    Followup: MachineOwner
    ---------

    0: kd> !process 0 0
    **** NT ACTIVE PROCESS DUMP ****
    NT symbols are incorrect, please fix symbols

    还是不可以阿,还有红色部分是什么意思?


    Jacky_Deng
    2009年2月17日 8:22