我正在尝试在仅与系统一起运行的Powershell脚本中使用 windbg / cdb / kd 调试工具来分析MEMORY.DMP帐户。 我已经提供了符号文件路径,并且显示“ !sym noisy ”提示。
"SRV*c:\symbols*http://msdl.microsoft.com/download/symbols"
以管理员身份运行时,我能够在 windbg / cdb / kd 中下载并加载符号。
SYMSRV: File: ntkrnlmp.exe
SYMSRV: Get File Path: download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe
SYMSRV: Notifies the client application that a proxy has been detected.
SYMSRV: Connecting to the Server: http://msdl.microsoft.com/download/symbols.
SYMSRV: Waiting for the server to respond to a request.
SYMSRV: Successfully received a response from the server.
SYMSRV: Successfully received a copied
copied
DBGHELP: c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe - OK
但是在同一台计算机上以“ NT Authority / System ”运行时,我无法在windbg / cdb / kd中下载和加载符号。
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
SYMSRV: c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe not found
SYMSRV: c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe not found
SYMSRV: c:\symbols\ntoskrnl.exe\5C8C79C8708000\ntoskrnl.exe not found
SYMSRV: c:\symbols\ntoskrnl.exe\5C8C79C8708000\ntoskrnl.exe not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/5C8C79C8708000/ntoskrnl.exe not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/5C8C79C8708000/ntoskrnl.exe not found
为什么调试工具无法使用系统帐户加载符号?如果不可能,是否还有其他解决方法?
答案 0 :(得分:1)