NT symbols are incorrect, please fix symbols

原创

friendan 2023-01-26 13:00:00 博主文章分类：Windbg ©著作权

文章标签 windbg process 驱动 microsoft Image 文章分类 运维

©著作权归作者所有：来自51CTO博客作者friendan的原创作品，请联系作者获取转载授权，否则将追究法律责任

参考文章：http://wingbao.blogbus.com/logs/28757738.html

在Windbg敲命令!process出现如下错误：

kd> !process
NT symbols are incorrect, please fix symbols

-----------------------------------------------------------------------

解决方法：

按如下步骤敲命令即可

kd> .sympath SRV*D:\WinDDK\Symbols_ms*http://msdl.microsoft.com/download/symbols      // 设置符号表路径
Symbol search path is: SRV*D:\WinDDK\Symbols_ms*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*d:\winddk\symbols_ms*http://msdl.microsoft.com/download/symbols
kd> !process
NT symbols are incorrect, please fix symbols
kd> !sym noisy   // 希望WinDBG在获得符号的时候取得更多的信息
noisy mode - symbol prompts on
kd> !lmi nt     // 让WinDBG查看Windows的ntoskrnl模块
Loaded Module Info: [nt]
         Module: ntkrnlpa
   Base Address: 804d8000
     Image Name: ntkrnlpa.exe
   Machine Type: 332 (I386)
     Time Stamp: 4fa3cc44 Fri May 04 20:32:04 2012
           Size: 1f9100
       CheckSum: 1fca51
Characteristics: 12e
Debug Data Dirs: Type Size     VA Pointer
             CODEVIEW    25, 9588,    9588 RSDS - GUID: {D8AAE42A-2C25-4CF0-A6DE-CF483D44477A}
               Age: 1, Pdb: ntkrnlpa.pdb
     Image Type: MEMORY   - Image read successfully from loaded memory.
    Symbol Type: EXPORT   - PDB not found
    Load Report: export symbols

kd> .reload /f nt // 尝试获取ntoskrnl的符号
DBGHELP: nt - public symbols
d:\winddk\symbols_ms\ntkrnlpa.pdb\D8AAE42A2C254CF0A6DECF483D44477A1\ntkrnlpa.pdb
kd> !process // 可以执行我们的命令了

    PROCESS 80553aa0 SessionId: none Cid: 0000    Peb: 00000000 ParentCid: 0000
    DirBase: 00337000 ObjectTable: e1001bf8 HandleCount: 317.
    Image: Idle
    VadRoot 00000000 Vads 0 Clone 0 Private 0. Modified 0. Locked 0.
    DeviceMap 00000000
    Token                             e10007a0
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:39:13.625
    QuotaPoolUsage[PagedPool]         0
    QuotaPoolUsage[NonPagedPool]      0
    Working Set Sizes (now,min,max) (7, 50, 450) (28KB, 200KB, 1800KB)
    PeakWorkingSetSize                0
    VirtualSize                       0 Mb
    PeakVirtualSize                   0 Mb
    PageFaultCount                    0
    MemoryPriority                    BACKGROUND
    BasePriority                      0
    CommitCharge                      0