以系统帐户身份运行时,“ windbg”无法加载符号

时间:2019-06-19 11:11:39

标签: windows debugging windbg

我正在尝试在仅与系统一起运行的Powershell脚本中使用 windbg / cdb / kd 调试工具来分析MEMORY.DMP帐户。 我已经提供了符号文件路径,并且显示“ !sym noisy ”提示。

  • 符号文件路径:
"SRV*c:\symbols*http://msdl.microsoft.com/download/symbols"

管理员身份运行时,我能够在 windbg / cdb / kd 中下载并加载符号。


SYMSRV:  File: ntkrnlmp.exe

SYMSRV:  Get File Path: download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe


SYMSRV:  Notifies the client application that a proxy has been detected.
SYMSRV:  Connecting to the Server: http://msdl.microsoft.com/download/symbols.

SYMSRV:  Waiting for the server to respond to a request.
SYMSRV:  Successfully received a response from the server.
SYMSRV:  Successfully received a  copied         
 copied         
DBGHELP: c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe - OK

但是在同一台计算机上以“ NT Authority / System ”运行时,我无法在windbg / cdb / kd中下载和加载符号。

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

SYMSRV:  c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe not found
SYMSRV:  c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe not found
SYMSRV:  c:\symbols\ntoskrnl.exe\5C8C79C8708000\ntoskrnl.exe not found
SYMSRV:  c:\symbols\ntoskrnl.exe\5C8C79C8708000\ntoskrnl.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/5C8C79C8708000/ntoskrnl.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/5C8C79C8708000/ntoskrnl.exe not found

为什么调试工具无法使用系统帐户加载符号?如果不可能,是否还有其他解决方法?

1 个答案:

答案 0 :(得分:1)