I am using version 6.0.0017.0 on an XP pro. I am trying to kernel debug
a w2k pro sp3 free machine. Here’s a sample of my session:
kd> kd> .sympath
Symbol search path is:
c:\syms\w2kchk-sp3;c:\syms\w2kfre-sp3;c:\syms\w2kchk;c:\syms\w2kfre
kd> !sym noisy
Noisy mode on
kd> .reload -f ntoskrnl.exe
DBGHELP: ntoskrnl.exe is stripped. Searching for dbg file
DBGHELP: c:\syms\w2kchk-sp3\ntoskrnl.dbg - file not found
DBGHELP: c:\syms\w2kchk-sp3\symbols\exe\ntoskrnl.dbg - path not found
DBGHELP: c:\syms\w2kchk-sp3\exe\ntoskrnl.dbg - OK
DBGHELP: c:\syms\w2kchk-sp3\ntoskrnl.pdb - file not found
DBGHELP: c:\syms\w2kchk-sp3\symbols\exe\ntoskrnl.pdb - file not found
DBGHELP: c:\syms\w2kchk-sp3\exe\ntoskrnl.pdb - opened
*** WARNING: symbols timestamp is wrong 0x3d366b8b 0x3d362a71 for
ntoskrnl.exe
DBGHELP: nt - public symbols - c:\syms\w2kchk-sp3\exe\ntoskrnl.pdb
kd> lm mnt
start end module name
80400000 805a2140 nt # (pdb symbols)
c:\syms\w2kchk-sp3\exe\ntoskrnl.pdb
Unloaded modules:
kd>
To quote from the documentation, section “Setting Paths and Loading
Files”:
“However, since symbol files all have date and time stamps, there is no
danger that the debugger will use the wrong symbols just because they
are found first in this sequence. The debugger will always look for the
symbols which match the time stamp on the binaries it is debugging.”
I was under the impression that the debugger would look at all the
available symbol files in my search path and select the one that fits
the best. However, from this noisy trace, it appears that it doesn’t
even attempt to look at the rest of my symbol path once it has located
the first ntoskrnl.pdb, even though it is the wrong one and the correct
one is further down the path. Is there something that I am missing
here? Thanks.