CODEWITHSUNDEEP
windbg
mitchellJ
mitchellJ

Reputation: 734

Bad symbols for NTDLL (error 3). Aborting

What could cause the error:

Bad symbols for NTDLL (error 3). Aborting.

While using !cs commands?

I'm analyzing a keyboard-forced complete dump and have set the symbol path to the MS symbol server.

lml does not list ntdll as loaded

.sym noisy and a reload shows:

3: kd> .reload ntdll

"ntdll" was not found in the image list.
Debugger will attempt to load "ntdll" at given base 00000000`00000000.

Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
DBGENG:  ntdll - Partial symbol image load missing image info
DBGHELP: No header for ntdll.  Searching for dbg file
DBGHELP: .\ntdll.dbg - file not found
DBGHELP: ntdll missing debug info.  Searching for pdb anyway
DBGHELP: Can't use symbol server for ntdll.pdb - no header information available
DBGHELP: ntdll.pdb - file not found

DBGHELP: ntdll - no symbols loaded
Unable to add module at 00000000`00000000
3: kd> .reload nt

DBGHELP: nt - public symbols  
        c:\symbols\ntkrnlmp.pdb\BF9E190359784C2D8796CF5537B238B42\ntkrnlmp.pdb

Should ntdll be listed in the lm commands? Is there something special needed to load the symbols or run these commands?

Additionally I am also curious why I cannot dump all threads in forced/complete system dumps:

3: kd> ~* k
   ^ Syntax error in '~* k'

Have I simply failed to set up my windbg correctly or are these commands meant for other types of dumps?

Upvotes: 2

Views: 1113

Answers (1)

Thomas Weller
Thomas Weller

Reputation: 59289

It seems you have done user mode debugging before. Now you're in kernel mode, which you can see from the x: kd> prompt.

Kernel mode debugging is somewhat different to user mode debugging. Most important IMHO: not all application memory (virtual memory) is available, just the part that was in RAM at the time of the dump (physical memory) aka. Working Set (physical memory of a particular process).

You can search for your executable using !process 0 0 <exename>

0: kd> !process 0 0 NotMyFault.exe
PROCESS ff3b58f0  SessionId: 0  Cid: 05ac    Peb: 7ffde000  ParentCid: 039c
    DirBase: 018c02e0  ObjectTable: e165d728  HandleCount:  35.
    Image: NotMyfault.exe

Unfortunately there is no wildcard search possible at this point. You can then switch to that process using .process <process>:

0: kd> .process ff3b58f0
Implicit process is now ff3b58f0

To see the threads use !process <process> 2:

0: kd> !process ff3b58f0 2
PROCESS ff3b58f0  SessionId: 0  Cid: 05ac    Peb: 7ffde000  ParentCid: 039c
    DirBase: 018c02e0  ObjectTable: e165d728  HandleCount:  35.
    Image: NotMyfault.exe

        THREAD ff1d4020  Cid 05ac.05b0  Teb: 7ffdd000 Win32Thread: e1c6e2b0 RUNNING on processor 0

Next, use !thread <thread> to get output similar to ~:

0: kd> !thread ff1d4020
THREAD ff1d4020  Cid 05ac.05b0  Teb: 7ffdd000 Win32Thread: e1c6e2b0 RUNNING on processor 0
IRP List:
    81942f68: (0006,0094) Flags: 40000000  Mdl: 00000000
Not impersonating
DeviceMap                 e169ffd0
Owning Process            0       Image:         <Unknown>
Attached Process          ff3b58f0       Image:         NotMyfault.exe
Wait Start TickCount      13575          Ticks: 0
Context Switch Count      653            IdealProcessor: 0                 LargeStack
UserTime                  00:00:00.000
KernelTime                00:00:00.078
Win32 Start Address NotMyfault (0x01002945)
Start Address kernel32!BaseProcessStartThunk (0x7c8106f5)
Stack Init f36f1000 Current f36f030c Base f36f1000 Limit f36ec000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 0 DecrementCount 16
ChildEBP RetAddr  Args to Child              
f36f0ad0 8052036a 00000050 81617000 00000001 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f36f0b38 80544578 00000001 81617000 00000000 nt!MmAccessFault+0x9a8 (FPO: [Non-Fpo])
f36f0b38 fca6161d 00000001 81617000 00000000 nt!KiTrap0E+0xd0 (FPO: [0,0] TrapFrame @ f36f0b50)
f36f0bd8 fca61a24 81942f68 f36f0c1c fca61b26 myfault+0x61d
f36f0be4 fca61b26 80fa7350 00000001 00000000 myfault+0xa24
f36f0c1c 804ef18f 80f7b600 81942f68 806e6428 myfault+0xb26
...

If you have trouble loading symbols, also try .reload /user after using the .process <process>.

Upvotes: 1

Related Questions