windows - WinDbg 窗口符号

Question

我正在尝试调试我编写的应用程序的转储文件。

我将以下符号路径添加到 WinDbg

我假设这会下载调试它所必需的 Windows 符号。

然后我在 WinDbg 中运行以下命令“!analyze -v”

这开始分析，然后由于找不到符号而失败。

当我查看 C:\MyServerSymbols 时，我看到以下内容

我希望看到的不仅仅是 kernelbase.dll

分析命令提示找不到 ntdll 符号。

下面是它给我的完整输出。

有谁知道如何获取它需要的符号吗？

0:001> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: $ntdllsym!_CONTEXT                            ***
***                                                                   ***
*************************************************************************
***** OS symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_CONTEXT                                   ***
***                                                                   ***
*************************************************************************

DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT:  (.ecxr)
rax=0000015d205000b8 rbx=0000000000000400 rcx=000000003f800000
rdx=000000004001000a rsi=00000040bb2cc3a0 rdi=00007ff6fd43cbe8
rip=00007ffa9b617788 rsp=00000040bb2cba20 rbp=00007ff6fd490690
 r8=00000040bb2cb500  r9=0000015d00000000 r10=0000015d205000b8
r11=0000000000000000 r12=00000000ffffffff r13=0000000000000000
r14=00007ff6fd43cbe8 r15=0000015d362a6b30
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
KERNELBASE+0x17788:
00007ffa`9b617788 488b8c24c0000000 mov     rcx,qword ptr [rsp+0C0h] ss:00000040`bb2cbae0=00007feb67d9e224
Resetting default scope

FAULTING_IP: 
KERNELBASE+17788
00007ffa`9b617788 488b8c24c0000000 mov     rcx,qword ptr [rsp+0C0h]

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffa9b617788 (KERNELBASE+0x0000000000017788)
   ExceptionCode: 00000001
  ExceptionFlags: 00000000
NumberParameters: 0

PROCESS_NAME:  ntdll.wrong.symbols.dll

WRONG_SYMBOLS_TIMESTAMP: 5825887f

WRONG_SYMBOLS_SIZE: 1d1000

FAULTING_MODULE: 00007ffa9ef60000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP:  5825887f

ADDITIONAL_DEBUG_TEXT:  
You can run '.symfix; .reload' to try to fix the symbol path and load symbols. ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

LAST_CONTROL_TRANSFER:  from 0000000000000000 to 0000000000000000

ANALYSIS_SESSION_HOST:  L5R5MHC2C16

ANALYSIS_SESSION_TIME:  02-01-2017 10:17:19.0325

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

STACK_TEXT:  
00000000`00000000 00000000`00000000 WRONG_SYMBOLS!WRONG_SYMBOLS+0x0


STACK_COMMAND:  .ecxr ; kb ; ** Pseudo Context ** ; kb

THREAD_SHA1_HASH_MOD_FUNC:  2a06fe893fc51638e55bcc8ee02bcdf6f10cbc26

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  214d5e958d92c59434e5414a89d1e95c2f82d12a

THREAD_SHA1_HASH_MOD:  79d1e41e8e0e291e73ec18352c568efa4ef4b5ab

SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

BUGCHECK_STR:  5825887F

EXCEPTION_CODE: (NTSTATUS) 0x5825887f - <Unable to get error code text>

EXCEPTION_CODE_STR:  5825887F

EXCEPTION_STR:  PRIVATE_SYMBOLS

IMAGE_NAME:  ntdll.wrong.symbols.dll

MODULE_NAME: ntdll_wrong_symbols

SYMBOL_NAME:  ntdll_wrong_symbols!5825887F1D1000

BUCKET_ID:  PRIVATE_SYMBOLS_X64_10.0.14393.206_(rs1_release.160915-0644)_TIMESTAMP_161111-085943

DEFAULT_BUCKET_ID:  PRIVATE_SYMBOLS_X64_10.0.14393.206_(rs1_release.160915-0644)_TIMESTAMP_161111-085943

PRIMARY_PROBLEM_CLASS:  PRIVATE_SYMBOLS

FAILURE_BUCKET_ID:  PRIVATE_SYMBOLS_X64_10.0.14393.206_(rs1_release.160915-0644)_TIMESTAMP_161111-085943_5825887F_ntdll.wrong.symbols.dll!5825887F1D1000

FAILURE_EXCEPTION_CODE:  5825887F

FAILURE_IMAGE_NAME:  ntdll.wrong.symbols.dll

BUCKET_ID_IMAGE_STR:  ntdll.wrong.symbols.dll

FAILURE_MODULE_NAME:  ntdll_wrong_symbols

BUCKET_ID_MODULE_STR:  ntdll_wrong_symbols

FAILURE_FUNCTION_NAME:  5825887F1D1000

BUCKET_ID_FUNCTION_STR:  5825887F1D1000

BUCKET_ID_OFFSET:  0

BUCKET_ID_MODTIMEDATESTAMP:  0

BUCKET_ID_MODCHECKSUM:  0

BUCKET_ID_MODVER_STR:  0.0.0.0

BUCKET_ID_PREFIX_STR:  PRIVATE_SYMBOLS_X64_10.0.14393.206_(rs1_release.160915-0644)_TIMESTAMP_161111-085943

FAILURE_PROBLEM_CLASS:  PRIVATE_SYMBOLS_X64_10.0.14393.206_(rs1_release.160915-0644)_TIMESTAMP_161111-085943

FAILURE_SYMBOL_NAME:  ntdll.wrong.symbols.dll!5825887F1D1000

TARGET_TIME:  2017-01-30T03:25:43.000Z

OSBUILD:  14393

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  768

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt SingleUserTS Personal

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2016-07-15 22:21:29

BUILDDATESTAMP_STR:  160915-0644

BUILDLAB_STR:  rs1_release

BUILDOSVER_STR:  10.0.14393.206

ANALYSIS_SESSION_ELAPSED_TIME: f73

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:private_symbols_x64_10.0.14393.206_(rs1_release.160915-0644)_timestamp_161111-085943_5825887f_ntdll.wrong.symbols.dll!5825887f1d1000

FAILURE_ID_HASH:  {018e4f21-5e50-795f-89a0-0abfdc0c2abc}

Followup:     MachineOwner
---------

Answer 1

在运行 !analyze -v 之前使用 .symfix 和 .reload 命令