windows – ntdll模块在windbg中无法正确加载,但为什么?
之前我曾经使用windbg进行用户模式调试,但我怀疑我对我的系统做了一些事情,因为我不记得使用例如扩展命令!堆之前有问题.
我可以清楚地看到ntdll是一个加载的模块: 77760000 778e0000 ntdll (pdb symbols) C:Program Files (x86)Windows Kits8.1Debuggersx86symwntdll.pdbFA9C48F9C11D4E0894B8970DECD92C972wntdll.pdb 0:001> lmvm ntdll start end module name 77760000 778e0000 ntdll (pdb symbols) C:Program Files (x86)Windows Kits8.1Debuggersx86symwntdll.pdb FA9C48F9C11D4E0894B8970DECD92C972wntdll.pdb Loaded symbol image file: C:WindowsSysWOW64ntdll.dll Image path: C:WindowsSysWOW64ntdll.dll Image name: ntdll.dll Timestamp: Wed Jul 15 13:53:36 2015 (55A69E20) CheckSum: 00142A8B ImageSize: 00180000 File version: 6.1.7601.18933 Product version: 6.1.7601.18933 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft? Windows? Operating System InternalName: ntdll.dll OriginalFilename: ntdll.dll ProductVersion: 6.1.7601.18933 FileVersion: 6.1.7601.18933 (win7sp1_gdr.150715-0600) FileDescription: NT Layer DLL LegalCopyright: ? Microsoft Corporation. All rights reserved. 和 0:001> !chksym ntdll C:WindowsSysWOW64ntdll.dll Timestamp: 55A69E20 SizeOfImage: 180000 pdb: wntdll.pdb pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97 age: 2 Loaded pdb is C:Program Files (x86)Windows Kits8.1Debuggersx86symwntdll.pdbFA9C48F9C11D4E0894B8970DECD92C972wntdll.pdb wntdll.pdb pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97 age: 2 MATCH: wntdll.pdb and C:WindowsSysWOW64ntdll.dll<code> 当我尝试使用我的堆扩展时,我得到: 0:001> !heap -stat ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol,or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname,or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly,your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: ntdll!_PEB *** *** *** .symopt- 100也没有帮助 如果我尝试使用临界区扩展,我会收到类似的错误: Bad symbols for NTDLL (error 3). Aborting. 我已经读过如果你在32位和64位之间不匹配,或者如果你没有在第一位正确设置符号但我已经使用.symfix并且可以强制我的符号重新加载.reload / f,我在x86进程或32位转储上使用x86调试器,所以我看不出这些问题是如何发挥作用的. 我已经完全开始了新的和卸载的windbg,并从MSDN重新安装了Windows的调试工具,但仍然遇到了同样的问题.当然我错过了一些明显的东西?
MS正在摆脱最新Windows 7 PDB中的所有类型信息.这打破了!堆.这是关于它的推特谈话,由Alex Ionescu发起,他是“Windows Internals,Sixth Edition”的合着者:
https://twitter.com/aionescu/status/634028737458114560
更新:2015年10月12日:使用PDB Type Theft python脚本可能的解决方法,该脚本将类型信息从一个PDB复制到另一个PDB.用法是从较旧的PDB复制类型信息,该PDB具有在以后的PDB中删除的类型信息.此链接包含所有详细信息:http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/PDB-Type-Theft/ba-p/6801065#.Vhv2gPm6fmE 更新时间:2015年10月22日:在Microsoft补丁日(2015-10-13)和KB3088195中,符号再次可用.但是,没有提供破损版本的符号,因此上述内容可能仍然有用. (编辑:李大同) 【声明】本站内容均来自网络,其相关言论仅代表作者个人观点,不代表本站立场。若无意侵犯到您的权利,请及时与联系站长删除相关内容! |
- 已知MS Windows不符合RFC3927或我们遇到了错误吗?
- Windows上的透明缓存 – 到期时间
- winforms – 有更简单的方法来合并Windows Forms .Designer
- windows-server-2012 – Windows Server 2012:添加/删除程
- windows-phone-7 – 以编程方式将按钮的背景设置为图像
- windows-xp – 无法播放24bit音频
- 开始使用BouncyCastle加密dll c#
- $(window).scroll in vanilla JavaScript
- 有没有人听说过标准Windows消息框的这个奇怪的错误?
- windows-phone-8 – 从IsolatedStorage播放视频