Question

之前我曾经使用windbg进行用户模式调试，但我怀疑我对我的系统做了一些事情，因为我不记得使用例如扩展命令！堆之前有问题。

我可以清楚地看到ntdll是一个加载的模块：

77760000 778e0000   ntdll      (pdb symbols)          C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb

0:001> lmvm ntdll
start    end        module name
77760000 778e0000   ntdll      (pdb symbols)          C:\Program Files     (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb    \FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb
    Loaded symbol image file: C:\Windows\SysWOW64\ntdll.dll
    Image path: C:\Windows\SysWOW64\ntdll.dll
    Image name: ntdll.dll
    Timestamp:        Wed Jul 15 13:53:36 2015 (55A69E20)
    CheckSum:         00142A8B
    ImageSize:        00180000
    File version:     6.1.7601.18933
    Product version:  6.1.7601.18933
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntdll.dll
    OriginalFilename: ntdll.dll
    ProductVersion:   6.1.7601.18933
    FileVersion:      6.1.7601.18933 (win7sp1_gdr.150715-0600)
    FileDescription:  NT Layer DLL
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

和

0:001> !chksym ntdll

C:\Windows\SysWOW64\ntdll.dll
    Timestamp: 55A69E20
  SizeOfImage: 180000
          pdb: wntdll.pdb
      pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97
          age: 2

Loaded pdb is C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb

wntdll.pdb
      pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97
          age: 2

MATCH: wntdll.pdb and C:\Windows\SysWOW64\ntdll.dll<code>

当我尝试使用我的堆扩展时，我得到：

0:001> !heap -stat
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***

.symopt- 100无济于事

如果我尝试使用临界区扩展，我会收到类似的错误：

Bad symbols for NTDLL (error 3). Aborting.

我已经读过如果您在32位和64位之间存在不匹配，或者如果您根本没有正确设置符号但我已经使用.symfix并且可以强制使用我的符号，则会发生这种情况要使用.reload /f重新加载，我在x86进程或32位转储上使用x86调试器，所以我看不出这些问题是如何发挥作用的。

我已经完全开始了新的和卸载的windbg，并从MSDN重新安装了Windows的调试工具，但仍遇到同样的问题。当然我错过了一些明显的东西？

Answer 1

MS正在摆脱最新Windows 7 PDB中的所有类型信息。这打破了!heap。以下是关于它的推特谈话，由Alex Ionescu发起，他是“Windows Internals，Sixth Edition”的合着者：https://twitter.com/aionescu/status/634028737458114560

更新：2015年12月10日：使用PDB Type Theft python脚本可能的解决方法，该脚本将类型信息从一个PDB复制到另一个PDB。用法是从较旧的PDB复制类型信息，该PDB具有在以后的PDB中删除的类型信息。此链接包含所有详细信息：http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/PDB-Type-Theft/ba-p/6801065#.Vhv2gPm6fmE

更新时间：2015年10月22日：借助Microsoft补丁日（2015-10-13）和KB3088195，符号再次可用。但是，没有提供破损版本的符号，因此上述内容可能仍然有用。

Answer 2

似乎在20151013 上分发了Windows更新，堆信息再次可用。

0:018> !chksym ntdll

C:\Windows\SysWOW64\ntdll.dll
Timestamp: 56099FFA
SizeOfImage: 180000
      pdb: wntdll.pdb
  pdb sig: C2B37FDB-B631-4EA7-8A6D-7F51123F151E
      age: 2

Loaded pdb is microsoft\wntdll.pdb   \C2B37FDBB6314EA78A6D7F51123F151E2\wntdll.pdb

wntdll.pdb
  pdb sig: C2B37FDB-B631-4EA7-8A6D-7F51123F151E
      age: 2

MATCH: wntdll.pdb and C:\Windows\SysWOW64\ntdll.dll

和

0:018> lm v m *ntdll*
start    end        module name
77530000 776b0000   ntdll      (pdb symbols)        microsoft\wntdll.pdb\C2B37FDBB6314EA78A6D7F51123F151E2\wntdll.pdb
Loaded symbol image file: C:\Windows\SysWOW64\ntdll.dll
Image path: C:\Windows\SysWOW64\ntdll.dll
Image name: ntdll.dll
Timestamp:        Mon Sep 28 22:15:54 2015 (56099FFA)
CheckSum:         001412F8
ImageSize:        00180000
File version:     6.1.7601.23223
Product version:  6.1.7601.23223
File flags:       0 (Mask 3F)
File OS:          40004 NT Win32
File type:        2.0 Dll
File date:        00000000.00000000
Translations:     0409.04b0
CompanyName:      Microsoft Corporation
ProductName:      Microsoft® Windows® Operating System
InternalName:     ntdll.dll
OriginalFilename: ntdll.dll
ProductVersion:   6.1.7601.23223
FileVersion:      6.1.7601.23223 (win7sp1_ldr.150928-0600)
FileDescription:  NT Layer DLL
LegalCopyright:   © Microsoft Corporation. All rights reserved.

您可以安装更新，重建您的应用程序并重试吗？

ntdll模块在windbg中无法正确加载，但为什么？

2 个答案: