CODEWITHSUNDEEP
windowsdebuggingwindbg
Raül Delgâdo Dę Luna
Raül Delgâdo Dę Luna

Reputation: 51

why am I not getting ntdll correctly loaded in windbg , but it is downloaded windbg x86?

I was trying to set up my debugging environment, but it works perfectly on windbg x64 10.0.17763.132, but however when I tried to use !address , !heap it doesn't work because No symbols for ntdll. Cannot continue.. I also tried to reinstall c++ redistributable , and debugging tools, and nothing seems to work. I got Windows 10 SDK, version 1809 (10.0.17763.0) , and maybe MS symbols server is having an issue with it

ntdll log 

0:000> lmvm ntdll
Browse full module list
start end module name
77370000 7750a000 ntdll (pdb symbols) c:\windbgsymbols\wntdll.pdb\D85FCE08D56038E2C69B69F29E11B5EE1\wntdll.pdb
Loaded symbol image file: C:\WINDOWS\SYSTEM32\ntdll.dll
Image path: ntdll.dll
Image name: ntdll.dll
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: A4208572 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00198081
ImageSize: 0019A000
File version: 10.0.18362.387
Product version: 10.0.18362.387
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntdll.dll
OriginalFilename: ntdll.dll
ProductVersion: 10.0.18362.387
FileVersion: 10.0.18362.387 (WinBuild.160101.0800)
FileDescription: NT Layer DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
0:000> !heap
Invalid type information
0:000> !address

No symbols for ntdll. Cannot continue.

proof

symbols

windbg

Upvotes: 4

Views: 2839

Answers (1)

Rodney Viana
Rodney Viana

Reputation: 544

This is how you see what is happening with symbol loading:

!sym noisy
.reload /f ntdll.dll

Upvotes: 1

Related Questions