Setting breakpoints in own driver

WINDBG
1

I'm trying to debug my own driver, but I can't seem to resolve any
symbols for it.

E.g., trying to set a breakpoint gives the following error (after a long delay):

kd> bp sandbox!DriverEntry
*** ERROR: Module load completed but symbols could not be loaded for sandbox.sys
Couldn't resolve error at 'sandbox!DriverEntry'

Also tried bu as suggested in

http://www.osronline.com/showThread.cfm?link=96474

kd> bu sandbox!DriverEntry
Couldn't resolve error at 'sandbox!DriverEntry'

I load and start my driver using OSRLoader. My driver is called
sandbox - that's the TARGETNAME in SOURCES and the name in OSRLoader.
I went to File > Symbol File Path... and appended my own output
directory to the (already working) symbol path:

srv*c:\syms*\symbols\symbols*C:\Users\t-yanzh\Documents\work\drivers\sandbox\objchk_win7_x86\i386

Any hints? Thanks in advance.

Yang Zhang

2

Why you set the symbols path as "srv*c:\syms*\symbols\symbols"? Did you have an internal symbols server share called \symbols\symbols? If your intention is to load symbols of Windows modules, please point to Microsoft symbols store. You could use ".symfix" command for this.

The symbols path is incorrect, please change to the line below and give it a try.
srv*c:\syms*\symbols\symbols;C:\Users\t-yanzh\Documents\work\drivers\sandbox\objchk_win7_x86\i386

If this still fails, please run "!sym noisy" then ".reload /f sandbox.sys". Please copy/paste back the debugger spew.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Yang Zhang
Sent: Thursday, October 01, 2009 08:55 AM
To: Kernel Debugging Interest List
Cc: Jeremy Condit
Subject: [windbg] Setting breakpoints in own driver

I'm trying to debug my own driver, but I can't seem to resolve any
symbols for it.

E.g., trying to set a breakpoint gives the following error (after a long delay):

kd> bp sandbox!DriverEntry
*** ERROR: Module load completed but symbols could not be loaded for sandbox.sys
Couldn't resolve error at 'sandbox!DriverEntry'

Also tried bu as suggested in

http://www.osronline.com/showThread.cfm?link=96474

kd> bu sandbox!DriverEntry
Couldn't resolve error at 'sandbox!DriverEntry'

I load and start my driver using OSRLoader. My driver is called
sandbox - that's the TARGETNAME in SOURCES and the name in OSRLoader.
I went to File > Symbol File Path... and appended my own output
directory to the (already working) symbol path:

srv*c:\syms*\symbols\symbols*C:\Users\t-yanzh\Documents\work\drivers\sandbox\objchk_win7_x86\i386

Any hints? Thanks in advance.

Yang Zhang

WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:

To unsubscribe, visit the List Server section of OSR Online at ListServer/Forum

3

On Thu, Oct 1, 2009 at 10:02 AM, Jen-Lung Chiu wrote:
> Why you set the symbols path as “srvc:\syms\symbols\symbols”? Did you have an internal symbols server share called \symbols\symbols? If your intention is to load symbols of Windows modules, please point to Microsoft symbols store. You could use “.symfix” command for this.

Right, I believe there’s an internal symbols server at \symbols\symbols.

>
> The symbols path is incorrect, please change to the line below and give it a try.
> srvc:\syms\symbols\symbols;C:\Users\t-yanzh\Documents\work\drivers\sandbox\objchk_win7_x86\i386
>
> If this still fails, please run “!sym noisy” then “.reload /f sandbox.sys”. Please copy/paste back the debugger spew.

Thanks, that new path works. However, after updating the path, I saw:

kd> .reload
Connected to Windows 7 7600 x86 compatible target at (Thu Oct 1
10:20:37.193 2009 (GMT-7)), ptr64 FALSE
Loading Kernel Symbols
…
…
…
Loading User Symbols
…
Loading unloaded module list
… ERROR: Module load completed but symbols could not be
loaded for ntdll.dll

 ERROR: Symbol file could not be found. Defaulted to export
symbols for ole32.dll -
ERROR: Module load completed but symbols could not be loaded for
FastProx.dll
 ERROR: Module load completed but symbols could not be loaded for RPCRT4.dll

Any idea what this means?
–
Yang Zhang
http://www.mit.edu/~y_z/

4

Evidently you don’t have OS symbols at that share.

Are you sure that you shouldn’t be using the MS public symbol server at http://msdl.microsoft.com/download/symbols Instead of \symbols\symbols ?

N.B. You should always use !sym noisy when diagnosing symbols load issues as Jen specified.

  • S

-----Original Message-----
From: Yang Zhang
Sent: Thursday, October 01, 2009 11:46
To: Kernel Debugging Interest List
Cc: Jeremy Condit
Subject: Re: [windbg] Setting breakpoints in own driver

On Thu, Oct 1, 2009 at 10:02 AM, Jen-Lung Chiu wrote:
> Why you set the symbols path as “srvc:\syms\symbols\symbols”? Did you have an internal symbols server share called \symbols\symbols? If your intention is to load symbols of Windows modules, please point to Microsoft symbols store. You could use “.symfix” command for this.

Right, I believe there’s an internal symbols server at \symbols\symbols.

>
> The symbols path is incorrect, please change to the line below and give it a try.
> srvc:\syms\symbols\symbols;C:\Users\t-yanzh\Documents\work\drivers\sandbox\objchk_win7_x86\i386
>
> If this still fails, please run “!sym noisy” then “.reload /f sandbox.sys”. Please copy/paste back the debugger spew.

Thanks, that new path works. However, after updating the path, I saw:

kd> .reload
Connected to Windows 7 7600 x86 compatible target at (Thu Oct 1
10:20:37.193 2009 (GMT-7)), ptr64 FALSE
Loading Kernel Symbols
…
…
…
Loading User Symbols
…
Loading unloaded module list
… ERROR: Module load completed but symbols could not be
loaded for ntdll.dll

 ERROR: Symbol file could not be found. Defaulted to export
symbols for ole32.dll -
ERROR: Module load completed but symbols could not be loaded for
FastProx.dll
 ERROR: Module load completed but symbols could not be loaded for RPCRT4.dll

Any idea what this means?
–
Yang Zhang
http://www.mit.edu/~y_z/

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

The MS symbol server could also just be missing symbols for that version of
NTDLL (it does happen). As long as all of your kernel symbols are loaded
correctly you should be OK.

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Skywing” wrote in message
news:xxxxx@windbg…
Evidently you don’t have OS symbols at that share.

Are you sure that you shouldn’t be using the MS public symbol server at
http://msdl.microsoft.com/download/symbols Instead of \symbols\symbols ?

N.B. You should always use !sym noisy when diagnosing symbols load issues
as Jen specified.

- S

-----Original Message-----
From: Yang Zhang
Sent: Thursday, October 01, 2009 11:46
To: Kernel Debugging Interest List
Cc: Jeremy Condit
Subject: Re: [windbg] Setting breakpoints in own driver

On Thu, Oct 1, 2009 at 10:02 AM, Jen-Lung Chiu wrote:
> Why you set the symbols path as “srvc:\syms\symbols\symbols”? Did you
> have an internal symbols server share called \symbols\symbols? If your
> intention is to load symbols of Windows modules, please point to Microsoft
> symbols store. You could use “.symfix” command for this.

Right, I believe there’s an internal symbols server at \symbols\symbols.

>
> The symbols path is incorrect, please change to the line below and give it
> a try.
> srvc:\syms\symbols\symbols;C:\Users\t-yanzh\Documents\work\drivers\sandbox\objchk_win7_x86\i386
>
> If this still fails, please run “!sym noisy” then “.reload /f
> sandbox.sys”. Please copy/paste back the debugger spew.

Thanks, that new path works. However, after updating the path, I saw:

kd> .reload
Connected to Windows 7 7600 x86 compatible target at (Thu Oct 1
10:20:37.193 2009 (GMT-7)), ptr64 FALSE
Loading Kernel Symbols
…
…
…
Loading User Symbols
…
Loading unloaded module list
… ERROR: Module load completed but symbols could not be
loaded for ntdll.dll

 ERROR: Symbol file could not be found. Defaulted to export
symbols for ole32.dll -
ERROR: Module load completed but symbols could not be loaded for
FastProx.dll
 ERROR: Module load completed but symbols could not be loaded for
RPCRT4.dll

Any idea what this means?
–
Yang Zhang
http://www.mit.edu/~y_z/

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer