More info NT 4 Post SP6a ntoskrnl symbols

WINDBG
1

Crash dump that fails to load symbols:
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntkrnlmp.dbg/3B2800C0e0000/ntkrnl
mp.dbg/ntkrnlmp.dbg not found.
80100000 c60c0 ( 793 k) 23600 (142 k) ntoskrnl.exe Wed Jun 13 17:09:36
2001

My test NT 4 with SP6a, plus SRP update loads symbols okay:
DBGHELP: nt - cv symbols loaded from
c:\symbols\symserver\ntkrnlmp.dbg\3B2800C0e9a40\ntkrnlmp.dbg.
80100000 c60c0 ( 793 k) 23600 (142 k) ntoskrnl.exe Wed Jun 13 17:09:36
2001

Note the timestamps reported by ?!drivers? command are the same but the
symbol
loader is looking for two different timestamps.

Anyone any clues or have the symbols for this first timestamp kernel?

Thanks
Steve

-----Original Message-----
From: Lousy Brit [mailto:xxxxx@interwoven.com]
Sent: Thursday, May 30, 2002 1:30 PM
To: xxxxx@lists.osr.com
Subject: NT 4 Post SP6a ntoskrnl symbols

It appears that the version of ntoskrnl.exe is not
on the MS symbol server website dated June 13th 17:09:36 2001

Does anyone know where to get the symbols for this?

Thanks
Steve

2

One of the mangled kernels that people like executive sw (diskkeeper) or
citrix make our lives miserable with?

Cheers,
Felix.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lousy Brit
Sent: Thursday, 30 May, 2002 23:54
To: Kernel Debugging Interest List
Subject: [windbg] More info NT 4 Post SP6a ntoskrnl symbols

Crash dump that fails to load symbols:
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntkrnlmp.dbg/3B2800C0e0000/nt
krnlmp.dbg/ntkrnlmp.dbg not found.
80100000 c60c0 ( 793 k) 23600 (142 k) ntoskrnl.exe Wed Jun 13 17:09:36
2001

My test NT 4 with SP6a, plus SRP update loads symbols okay:
DBGHELP: nt - cv symbols loaded from
c:\symbols\symserver\ntkrnlmp.dbg\3B2800C0e9a40\ntkrnlmp.dbg.
80100000 c60c0 ( 793 k) 23600 (142 k) ntoskrnl.exe Wed Jun 13 17:09:36
2001

Note the timestamps reported by ?!drivers? command are the same but the
symbol
loader is looking for two different timestamps.

Anyone any clues or have the symbols for this first timestamp kernel?

Thanks
Steve

-----Original Message-----
From: Lousy Brit [mailto:xxxxx@interwoven.com]
Sent: Thursday, May 30, 2002 1:30 PM
To: xxxxx@lists.osr.com
Subject: NT 4 Post SP6a ntoskrnl symbols

It appears that the version of ntoskrnl.exe is not
on the MS symbol server website dated June 13th 17:09:36 2001

Does anyone know where to get the symbols for this?

Thanks
Steve

You are currently subscribed to windbg as: xxxxx@mvps.org
To unsubscribe send a blank email to %%email.unsub%%

3

This is a “known problem” with NT 4.0 as I understand it. Something about
how the in-memory headers are modified so that the signature of the
in-memory kernel does not match the signature of the original binary (and
hence it doesn’t match the symbols, either). The solution here is to point
to explicit paths for the NT 4.0 kernel files.

Symbols ship in the MSDN package; they used to be available for download as
well, but I haven’t done so in a LONG time (look for SP6a and you may find
the symbols to match it on Microsoft’s web site.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Hope to see you at the next OSR file systems class in San Jose, CA September
16, 2002!

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lousy Brit
Sent: Thursday, 30 May, 2002 23:54
To: Kernel Debugging Interest List
Subject: [windbg] More info NT 4 Post SP6a ntoskrnl symbols

Crash dump that fails to load symbols:
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntkrnlmp.dbg/3B2800C0e0000/nt
krnlmp.dbg/ntkrnlmp.dbg not found.
80100000 c60c0 ( 793 k) 23600 (142 k) ntoskrnl.exe Wed Jun 13 17:09:36
2001

My test NT 4 with SP6a, plus SRP update loads symbols okay:
DBGHELP: nt - cv symbols loaded from
c:\symbols\symserver\ntkrnlmp.dbg\3B2800C0e9a40\ntkrnlmp.dbg.
80100000 c60c0 ( 793 k) 23600 (142 k) ntoskrnl.exe Wed Jun 13 17:09:36
2001

Note the timestamps reported by “!drivers” command are the same but the
symbol
loader is looking for two different timestamps.

Anyone any clues or have the symbols for this first timestamp kernel?

Thanks
Steve

-----Original Message-----
From: Lousy Brit [mailto:xxxxx@interwoven.com]
Sent: Thursday, May 30, 2002 1:30 PM
To: xxxxx@lists.osr.com
Subject: NT 4 Post SP6a ntoskrnl symbols

It appears that the version of ntoskrnl.exe is not
on the MS symbol server website dated June 13th 17:09:36 2001

Does anyone know where to get the symbols for this?

Thanks
Steve