Greetings ppl,
I am in a soup. We had shipped a package to the customer, the package
contains a windows LSP and some other components. Unfortunately the symbol
server crashed here and we lost our previous symbols. Now the customer has
come back with crash dumps. Is tehre any way of regenerating the symbols?
- It is a user land crash of the LSP
- I know the exact version number of build time of the component, I have
synced my code base to that date and build release label and tried
rebuilding the retail PDBs but when I try loading them all I get is access error> when I do a 'x modulename!’ . Here is output:
0:025> .reload appfilter.dll
“appfilter.dll” was not found in the image list.
Debugger will attempt to load “appfilter” at given base 00000000.
Please provide the full image name, including the extension (i.e.
kernel32.dll)
for more reliable results. Base address and size overrides can be given as
.reload <image.ext>=,.
Unable to load image appfilter, Win32 error 2
Unable to add module at 00000000
0:025> x appfilter!hLspHeap
** WARNING: Unable to verify timestamp for appfilter.dll
0486c0b4 appfilter!hLspHeap =
0:025> x appfilter!*
04866248 appfilter!__newclmap = unsigned char [384] “”
04866248 appfilter!__newclmap = unsigned char “”
0486c5dc appfilter!__lc_codepage =
0486cbc0 appfilter!_debugger_hook_dummy =
0486b148 appfilter!tzstd = char [64] “”
0486af00 appfilter!_cfltcvt_tab = *[10]
0486cd24 appfilter!__sse2_available =
0486aaf0 appfilter! ptmbcinfo =
0486cbc4 appfilter! sbh_initialized =
Is there a way to get this working?
–
- amitr0</image.ext>
I guess that there are two things to get it going:
- Make sure that you set the executable path on windbg to point to the
exactable (probably best to use the one that the user have).
- use reload /f /i xxx.dll to force a load of symbols even if the time
stamp doesn’t match.
thanks
Tzachi
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of amitr0
Sent: Friday, February 15, 2008 3:26 PM
To: Kernel Debugging Interest List
Subject: [windbg] Regenerating Symbols
Greetings ppl,
I am in a soup. We had shipped a package to the customer, the package
contains a windows LSP and some other components. Unfortunately the
symbol server crashed here and we lost our previous symbols. Now the
customer has come back with crash dumps. Is tehre any way of
regenerating the symbols?
- It is a user land crash of the LSP
- I know the exact version number of build time of the component, I
have synced my code base to that date and build release label and tried
rebuilding the retail PDBs but when I try loading them all I get is
when I do a 'x modulename!’ . Here is output:
0:025> .reload appfilter.dll
“appfilter.dll” was not found in the image list.
Debugger will attempt to load “appfilter” at given base 00000000.
Please provide the full image name, including the extension (i.e.
kernel32.dll)
for more reliable results. Base address and size overrides can be given
as
.reload <image.ext>=,.
Unable to load image appfilter, Win32 error 2
Unable to add module at 00000000
0:025> x appfilter!hLspHeap
** WARNING: Unable to verify timestamp for appfilter.dll
0486c0b4 appfilter!hLspHeap =
0:025> x appfilter!*
04866248 appfilter!__newclmap = unsigned char [384] “”
04866248 appfilter!__newclmap = unsigned char “”
0486c5dc appfilter!__lc_codepage =
0486cbc0 appfilter!_debugger_hook_dummy =
0486b148 appfilter!tzstd = char [64] “”
0486af00 appfilter!_cfltcvt_tab = *[10]
0486cd24 appfilter!__sse2_available =
0486aaf0 appfilter! ptmbcinfo =
0486cbc4 appfilter! sbh_initialized =
Is there a way to get this working?
–
- amitr0
— You are currently subscribed to windbg as: xxxxx@mellanox.co.il To
unsubscribe send a blank email to xxxxx@lists.osr.com</image.ext>
Tzachi,
thanks for the reply. What does point 1 mean. Does it mean setting the
Windbg Image path to point to the newly generated DLL? I did that and also
tried point 2. No luck. I don’t have access to the customer DLL as that came
in through MSFT as part of their crash dumps, I have no info who is using
it, but I know that that version crashes. 
On Fri, Feb 15, 2008 at 7:07 PM, Tzachi Dar wrote:
> I guess that there are two things to get it going:
> 1) Make sure that you set the executable path on windbg to point to the
> exactable (probably best to use the one that the user have).
> 2) use reload /f /i xxx.dll to force a load of symbols even if the time
> stamp doesn’t match.
>
> thanks
> Tzachi
>
> ------------------------------
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] On Behalf Of amitr0
> Sent: Friday, February 15, 2008 3:26 PM
> To: Kernel Debugging Interest List
> Subject: [windbg] Regenerating Symbols
>
> Greetings ppl,
>
> I am in a soup. We had shipped a package to the customer, the package
> contains a windows LSP and some other components. Unfortunately the symbol
> server crashed here and we lost our previous symbols. Now the customer has
> come back with crash dumps. Is tehre any way of regenerating the symbols?
>
> 1. It is a user land crash of the LSP
> 2. I know the exact version number of build time of the component, I have
> synced my code base to that date and build release label and tried
> rebuilding the retail PDBs but when I try loading them all I get is > access error> when I do a 'x modulename!’ . Here is output:
>
> 0:025> .reload appfilter.dll
>
>
>
>
>
> “appfilter.dll” was not found in the image list.
>
> Debugger will attempt to load “appfilter” at given base 00000000.
>
>
>
> Please provide the full image name, including the extension (i.e.
> kernel32.dll)
>
> for more reliable results. Base address and size overrides can be given as
>
> .reload <image.ext>=,.
>
> Unable to load image appfilter, Win32 error 2
>
> Unable to add module at 00000000
>
>
>
> 0:025> x appfilter!hLspHeap
>
> *** WARNING: Unable to verify timestamp for appfilter.dll
>
> 0486c0b4 appfilter!hLspHeap =
>
> 0:025> x appfilter!
>
> 04866248 appfilter!__newclmap = unsigned char [384] “”
>
> 04866248 appfilter!__newclmap = unsigned char “”
>
> 0486c5dc appfilter!__lc_codepage =
>
> 0486cbc0 appfilter!_debugger_hook_dummy =
>
> 0486b148 appfilter!tzstd = char [64] “”
>
> 0486af00 appfilter!_cfltcvt_tab = *[10]
>
> 0486cd24 appfilter!__sse2_available =
>
> 0486aaf0 appfilter! ptmbcinfo =
>
> 0486cbc4 appfilter! sbh_initialized =
>
>
> Is there a way to get this working?
>
>
> –
>
> - amitr0
> — You are currently subscribed to windbg as: xxxxx@mellanox.co.il To
> unsubscribe send a blank email to xxxxx@lists.osr.com
> —
> You are currently subscribed to windbg as: unknown lmsubst tag argument:
> ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
–
- amitr0</image.ext>
You can try adding the base address in the reload statement, but I think
that you are SOL here. If you’re really desperate, you can try
reconstructing the dll from the in memory image, or perhaps dumping your
pdf information in to a map file and using sdbgext from Skywing to load
the map file. I have no idea if that will work, but it might give you
something to work with.
Good luck,
mm
amitr0 wrote:
Tzachi,
thanks for the reply. What does point 1 mean. Does it mean setting the
Windbg Image path to point to the newly generated DLL? I did that and
also tried point 2. No luck. I don’t have access to the customer DLL as
that came in through MSFT as part of their crash dumps, I have no info
who is using it, but I know that that version crashes.
On Fri, Feb 15, 2008 at 7:07 PM, Tzachi Dar > mailto:xxxxx> wrote:
>
> I guess that there are two things to get it going:
> 1) Make sure that you set the executable path on windbg to point to
> the exactable (probably best to use the one that the user have).
> 2) use reload /f /i xxx.dll to force a load of symbols even if the
> time stamp doesn’t match.
>
> thanks
> Tzachi
>
> ------------------------------------------------------------------------
> From: xxxxx@lists.osr.com
> mailto:xxxxx
> [mailto:xxxxx@lists.osr.com
> mailto:xxxxx] On Behalf Of amitr0
> Sent: Friday, February 15, 2008 3:26 PM
> To: Kernel Debugging Interest List
> Subject: [windbg] Regenerating Symbols
>
> Greetings ppl,
>
> I am in a soup. We had shipped a package to the customer, the
> package contains a windows LSP and some other components.
> Unfortunately the symbol server crashed here and we lost our
> previous symbols. Now the customer has come back with crash dumps.
> Is tehre any way of regenerating the symbols?
>
> 1. It is a user land crash of the LSP
> 2. I know the exact version number of build time of the component, I
> have synced my code base to that date and build release label and
> tried rebuilding the retail PDBs but when I try loading them all I
> get is when I do a 'x modulename!’ . Here is
> output:
>
> 0:025> .reload appfilter.dll
>
>
>
>
>
> “appfilter.dll” was not found in the image list.
>
> Debugger will attempt to load “appfilter” at given base 00000000.
>
>
>
> Please provide the full image name, including the extension (i.e.
> kernel32.dll)
>
> for more reliable results. Base address and size overrides can be
> given as
>
> .reload <image.ext>=,.
>
> Unable to load image appfilter, Win32 error 2
>
> Unable to add module at 00000000
>
>
>
>
> 0:025> x appfilter!hLspHeap
>
> *** WARNING: Unable to verify timestamp for appfilter.dll
>
> 0486c0b4 appfilter!hLspHeap =
>
> 0:025> x appfilter!
>
> 04866248 appfilter!__newclmap = unsigned char [384] “”
>
> 04866248 appfilter!__newclmap = unsigned char “”
>
> 0486c5dc appfilter!__lc_codepage =
>
> 0486cbc0 appfilter!_debugger_hook_dummy =
>
> 0486b148 appfilter!tzstd = char [64] “”
>
> 0486af00 appfilter!_cfltcvt_tab = *[10]
>
> 0486cd24 appfilter!__sse2_available =
>
> 0486aaf0 appfilter! ptmbcinfo =
>
> 0486cbc4 appfilter! sbh_initialized =
>
>
>
> Is there a way to get this working?
>
>
> –
>
> - amitr0
> — You are currently subscribed to windbg as:
> xxxxx@mellanox.co.il mailto:xxxxx To
> unsubscribe send a blank email to xxxxx@lists.osr.com
> mailto:xxxxx
> —
> You are currently subscribed to windbg as: unknown lmsubst tag
> argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> mailto:xxxxx
>
>
>
>
> –
>
> - amitr0</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></image.ext></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>
thats some nice new ideas mat. thanks, let me see if smething can be done.
On Sun, Feb 17, 2008 at 7:26 AM, Martin O’Brien
wrote:
> You can try adding the base address in the reload statement, but I think
> that you are SOL here. If you’re really desperate, you can try
> reconstructing the dll from the in memory image, or perhaps dumping your
> pdf information in to a map file and using sdbgext from Skywing to load
> the map file. I have no idea if that will work, but it might give you
> something to work with.
>
> Good luck,
>
> mm
>
>
> amitr0 wrote:
> > Tzachi,
> >
> > thanks for the reply. What does point 1 mean. Does it mean setting the
> > Windbg Image path to point to the newly generated DLL? I did that and
> > also tried point 2. No luck. I don’t have access to the customer DLL as
> > that came in through MSFT as part of their crash dumps, I have no info
> > who is using it, but I know that that version crashes.
> >
> >
> >
> >
> > On Fri, Feb 15, 2008 at 7:07 PM, Tzachi Dar > > mailto:xxxxx> wrote:
> >
> > I guess that there are two things to get it going:
> > 1) Make sure that you set the executable path on windbg to point to
> > the exactable (probably best to use the one that the user have).
> > 2) use reload /f /i xxx.dll to force a load of symbols even if the
> > time stamp doesn’t match.
> >
> > thanks
> > Tzachi
> >
> >
> ------------------------------------------------------------------------
> > From: xxxxx@lists.osr.com
> > mailto:xxxxx
> > [mailto:xxxxx@lists.osr.com
> > mailto:xxxxx] On Behalf Of amitr0
> > Sent: Friday, February 15, 2008 3:26 PM
> > To: Kernel Debugging Interest List
> > Subject: [windbg] Regenerating Symbols
> >
> > Greetings ppl,
> >
> > I am in a soup. We had shipped a package to the customer, the
> > package contains a windows LSP and some other components.
> > Unfortunately the symbol server crashed here and we lost our
> > previous symbols. Now the customer has come back with crash dumps.
> > Is tehre any way of regenerating the symbols?
> >
> > 1. It is a user land crash of the LSP
> > 2. I know the exact version number of build time of the component, I
> > have synced my code base to that date and build release label and
> > tried rebuilding the retail PDBs but when I try loading them all I
> > get is when I do a 'x modulename!’ . Here is
> > output:
> >
> > 0:025> .reload appfilter.dll
> >
> >
> >
> >
> >
> > “appfilter.dll” was not found in the image list.
> >
> > Debugger will attempt to load “appfilter” at given base 00000000.
> >
> >
> >
> > Please provide the full image name, including the extension (i.e.
> > kernel32.dll)
> >
> > for more reliable results. Base address and size overrides can be
> > given as
> >
> > .reload <image.ext>=,.
> >
> > Unable to load image appfilter, Win32 error 2
> >
> > Unable to add module at 00000000
> >
> >
> >
> >
> > 0:025> x appfilter!hLspHeap
> >
> > *** WARNING: Unable to verify timestamp for appfilter.dll
> >
> > 0486c0b4 appfilter!hLspHeap =
> >
> > 0:025> x appfilter!
> >
> > 04866248 appfilter!__newclmap = unsigned char [384] “”
> >
> > 04866248 appfilter!__newclmap = unsigned char “”
> >
> > 0486c5dc appfilter!__lc_codepage =
> >
> > 0486cbc0 appfilter!_debugger_hook_dummy =
> >
> > 0486b148 appfilter!tzstd = char [64] “”
> >
> > 0486af00 appfilter!_cfltcvt_tab = *[10]
> >
> > 0486cd24 appfilter!__sse2_available =
> >
> > 0486aaf0 appfilter! ptmbcinfo =
> >
> > 0486cbc4 appfilter! sbh_initialized =
> >
> >
> >
> > Is there a way to get this working?
> >
> >
> > –
> >
> > - amitr0
> > — You are currently subscribed to windbg as:
> > xxxxx@mellanox.co.il mailto:xxxxx To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> > mailto:xxxxx
> > —
> > You are currently subscribed to windbg as: unknown lmsubst tag
> > argument: ‘’
> > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> > mailto:xxxxx
> >
> >
> >
> >
> > –
> >
> > - amitr0
>
> —
> You are currently subscribed to windbg as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
–
- amitr0</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></image.ext></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>
I forgot (twice):
http://www.nynaeve.net/?p=94
http://www.valhallalegends.com/skywing/files/SDbgExt/SDbgExt.zip
Good luck,
mm
Martin O’Brien wrote:
I hope it helps.
Good luck,
mm
amitr0 wrote:
> thats some nice new ideas mat. thanks, let me see if smething can be
> done.
>
>
>
>
> On Sun, Feb 17, 2008 at 7:26 AM, Martin O’Brien
> > wrote:
>>
>> You can try adding the base address in the reload statement, but I
>> think
>> that you are SOL here. If you’re really desperate, you can try
>> reconstructing the dll from the in memory image, or perhaps
>> dumping your
>> pdf information in to a map file and using sdbgext from Skywing to
>> load
>> the map file. I have no idea if that will work, but it might give
>> you
>> something to work with.
>>
>> Good luck,
>>
>> mm
>>
>>
>> amitr0 wrote:
>> > Tzachi,
>> >
>> > thanks for the reply. What does point 1 mean. Does it mean
>> setting the
>> > Windbg Image path to point to the newly generated DLL? I did
>> that and
>> > also tried point 2. No luck. I don’t have access to the customer
>> DLL as
>> > that came in through MSFT as part of their crash dumps, I have no
>> info
>> > who is using it, but I know that that version crashes.
>> >
>> >
>> >
>> >
>> > On Fri, Feb 15, 2008 at 7:07 PM, Tzachi Dar
>>
>> > mailto:xxxxx>>
>> wrote:
>> >
>> > I guess that there are two things to get it going:
>> > 1) Make sure that you set the executable path on windbg to
>> point to
>> > the exactable (probably best to use the one that the user
>> have).
>> > 2) use reload /f /i xxx.dll to force a load of symbols even
>> if the
>> > time stamp doesn’t match.
>> >
>> > thanks
>> > Tzachi
>> >
>> >
>> ------------------------------------------------------------------------
>> > From: xxxxx@lists.osr.com
>> mailto:xxxxx
>> > mailto:xxxxx>> mailto:xxxxx>
>> > [mailto:xxxxx@lists.osr.com
>> mailto:xxxxx
>> > mailto:xxxxx>> mailto:xxxxx>] On Behalf Of amitr0
>> > Sent: Friday, February 15, 2008 3:26 PM
>> > To: Kernel Debugging Interest List
>> > Subject: [windbg] Regenerating Symbols
>> >
>> > Greetings ppl,
>> >
>> > I am in a soup. We had shipped a package to the customer, the
>> > package contains a windows LSP and some other components.
>> > Unfortunately the symbol server crashed here and we lost our
>> > previous symbols. Now the customer has come back with crash
>> dumps.
>> > Is tehre any way of regenerating the symbols?
>> >
>> > 1. It is a user land crash of the LSP
>> > 2. I know the exact version number of build time of the
>> component, I
>> > have synced my code base to that date and build release
>> label and
>> > tried rebuilding the retail PDBs but when I try loading them
>> all I
>> > get is when I do a 'x modulename!’ .
>> Here is
>> > output:
>> >
>> > 0:025> .reload appfilter.dll
>> >
>> >
>> >
>> >
>> >
>> > “appfilter.dll” was not found in the image list.
>> >
>> > Debugger will attempt to load “appfilter” at given base
>> 00000000.
>> >
>> >
>> >
>> > Please provide the full image name, including the extension
>> (i.e.
>> > kernel32.dll)
>> >
>> > for more reliable results. Base address and size overrides
>> can be
>> > given as
>> >
>> > .reload <image.ext>=,.
>> >
>> > Unable to load image appfilter, Win32 error 2
>> >
>> > Unable to add module at 00000000
>> >
>> >
>> >
>> >
>> > 0:025> x appfilter!hLspHeap
>> >
>> > *** WARNING: Unable to verify timestamp for appfilter.dll
>> >
>> > 0486c0b4 appfilter!hLspHeap =
>> >
>> > 0:025> x appfilter!
>> >
>> > 04866248 appfilter!__newclmap = unsigned char [384] “”
>> >
>> > 04866248 appfilter!__newclmap = unsigned char “”
>> >
>> > 0486c5dc appfilter!__lc_codepage =
>> >
>> > 0486cbc0 appfilter!_debugger_hook_dummy = >> error>
>> >
>> > 0486b148 appfilter!tzstd = char [64] “”
>> >
>> > 0486af00 appfilter!_cfltcvt_tab = *[10]
>> >
>> > 0486cd24 appfilter!__sse2_available =
>> >
>> > 0486aaf0 appfilter! ptmbcinfo =
>> >
>> > 0486cbc4 appfilter! sbh_initialized =
>> >
>> >
>> >
>> > Is there a way to get this working?
>> >
>> >
>> > –
>> >
>> > - amitr0
>> > — You are currently subscribed to windbg as:
>> > xxxxx@mellanox.co.il mailto:xxxxx
>> mailto:xxxxx> To
>> > unsubscribe send a blank email to
>> xxxxx@lists.osr.com
>> mailto:xxxxx
>> > mailto:xxxxx>> mailto:xxxxx>
>> > —
>> > You are currently subscribed to windbg as: unknown lmsubst tag
>> > argument: ‘’
>> > To unsubscribe send a blank email to
>> > xxxxx@lists.osr.com
>> mailto:xxxxx
>> > mailto:xxxxx>> mailto:xxxxx>
>> >
>> >
>> >
>> >
>> > –
>> >
>> > - amitr0
>>
>> —
>> You are currently subscribed to windbg as: xxxxx@gmail.com
>> mailto:xxxxx
>> To unsubscribe send a blank email to
>> xxxxx@lists.osr.com
>> mailto:xxxxx
>>
>>
>>
>>
>> –
>>
>> - amitr0
></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></image.ext></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>