can't find symbols

WINDBG
1

Hi,
I have a memory dump for a dual-cpu NT 4.0 machine. Windb 6.0.0017.0
cannot find the kernel symbols on Symbol server. Here’s the message I get
after turning on !sym noisy -
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/FFFFFFFEdf000/ntoskrnl.exe
not found
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/FFFFFFFEdf000/ntoskrnl.ex_
not found
Have the symbols been removed or some problem in my config ?
Thanks
Amit

2

For NT 4.0 kernel symbols, you need to point specifically to the correct
symbols. As explained to me, this had to do with in-memory changes to the NT
4.0 kernel so the signature doesn’t match the signature in the symbol
server.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@hotmail.com [mailto:xxxxx@hotmail.com]
Sent: Thursday, October 03, 2002 3:47 AM
To: Kernel Debugging Interest List
Subject: [windbg] can’t find symbols

Hi,
I have a memory dump for a dual-cpu NT 4.0 machine. Windb 6.0.0017.0
cannot find the kernel symbols on Symbol server. Here’s the message I get
after turning on !sym noisy -
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/FFFFFFFEdf000/ntoskr
nl.exe
not found
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/FFFFFFFEdf000/ntoskr
nl.ex_
not found
Have the symbols been removed or some problem in my config ?
Thanks
Amit

You are currently subscribed to windbg as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%

3

NT4 symbols should be on the Microsoft Internet Symbol Server. Sorry,
we don’t have a single downloadable package for NT4 with all symbols.

The problem below appears to be that some memory with the kernel image
header is paged out so the debugger doesn’t have enough info to track
down the right image or symbol file. I think you can work around this
by finding another NT4 SP6 target machine like the one the dump was
generated from and using it to get the right ntoskrnl.exe (or pull it
off your NT4 SP6 CD if you have one). Then place the ntoskrnl.exe in a
directory and prepend the directory to your symbol path (.sympath) for
the troublesome dump below. Then run .symopt+0x40 and .reload nt. This
time the debugger will ignore the fact that it can’t find the header
information and match the first ntoskrnl. I’m not sure if you will have
to set .exepath to this directory too in order to get the debugger to
read the image header. You may also have to do “.reload
ntoskrnl.exe=8010000” to make it work. Your goal is to trick the
debugger into finding the right kernel image header.

You don’t want to use this .symopt feature usually.

-----Original Message-----
From: Tony Mason [mailto:xxxxx@osr.com]
Sent: Thursday, October 03, 2002 5:10 AM
To: Kernel Debugging Interest List
Subject: [windbg] RE: can’t find symbols

For NT 4.0 kernel symbols, you need to point specifically to the correct
symbols. As explained to me, this had to do with in-memory changes to
the NT 4.0 kernel so the signature doesn’t match the signature in the
symbol server.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@hotmail.com [mailto:xxxxx@hotmail.com]
Sent: Thursday, October 03, 2002 3:47 AM
To: Kernel Debugging Interest List
Subject: [windbg] can’t find symbols

Hi,
I have a memory dump for a dual-cpu NT 4.0 machine. Windb 6.0.0017.0
cannot find the kernel symbols on Symbol server. Here’s the message I
get after turning on !sym noisy -
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/FFFFFFFEdf000/nt
oskr
nl.exe
not found
SYMSRV:
http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/FFFFFFFEdf000/nt
oskr
nl.ex_
not found
Have the symbols been removed or some problem in my config ? Thanks
Amit

You are currently subscribed to windbg as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to windbg as: xxxxx@microsoft.com To
unsubscribe send a blank email to %%email.unsub%%

4

David
Thanks a lot. I think you got the correct idea… I am trying to debug a
out of virtual memory problem.
Thanks,
Amit