ntdll模块不正确加载windbg,但为什么?

我之前使用过windbg进行用户模式debugging,但是我怀疑我对系统做了些什么,因为我没记得使用例如以前的扩展命令!heap。

我可以清楚地看到ntdll是一个加载模块:

77760000 778e0000 ntdll (pdb symbols) C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb 0:001> lmvm ntdll start end module name 77760000 778e0000 ntdll (pdb symbols) C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb \FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb Loaded symbol image file: C:\Windows\SysWOW64\ntdll.dll Image path: C:\Windows\SysWOW64\ntdll.dll Image name: ntdll.dll Timestamp: Wed Jul 15 13:53:36 2015 (55A69E20) CheckSum: 00142A8B ImageSize: 00180000 File version: 6.1.7601.18933 Product version: 6.1.7601.18933 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: ntdll.dll OriginalFilename: ntdll.dll ProductVersion: 6.1.7601.18933 FileVersion: 6.1.7601.18933 (win7sp1_gdr.150715-0600) FileDescription: NT Layer DLL LegalCopyright: © Microsoft Corporation. All rights reserved. 

 0:001> !chksym ntdll C:\Windows\SysWOW64\ntdll.dll Timestamp: 55A69E20 SizeOfImage: 180000 pdb: wntdll.pdb pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97 age: 2 Loaded pdb is C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb wntdll.pdb pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97 age: 2 MATCH: wntdll.pdb and C:\Windows\SysWOW64\ntdll.dll<code> 

当我尝试使用我的堆扩展时,我得到:

 0:001> !heap -stat ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: ntdll!_PEB *** *** *** 

.symopt- 100也没有帮助

如果我尝试使用临界区扩展,我得到一个类似的错误:

 Bad symbols for NTDLL (error 3). Aborting. 

我读过这可能会发生,如果你有一个32位和64位不匹配或者如果你根本没有正确设置符号,但我已经使用.symfix ,可以强制我的符号重新加载.reload /f ,我在x86进程或32位转储上使用x86debugging器,所以我没有看到这些问题在发挥作用。

我已经完全新鲜地卸载了windbg,并重新安装了MSDN的windowsdebugging工具,但仍遇到同样的问题。 当然,我错过了明显的东西?

MS正在摆脱最新的Windows 7 PDB中的所有类型的信息。 这打破了!heap 。 这是关于它由“Windows内部,第六版”的共同作者Alex Ionescu开始的一个推特谈话: https : //twitter.com/aionescu/status/634028737458114560

更新:10/12/2015 :可能的解决方法使用PDB类型的盗版python脚本,从一个PDB复制类型信息到另一个。 用法是从具有在以后的PDB中删除的类型信息的较旧的PDB复制类型信息。 这个链接有所有的细节: http : //h30499.www3.hp.com/t5/HP-Security-Research-Blog/PDB-Type-Theft/ba-p/6801065#.Vhv2gPm6fmE

更新:10/22/2015 :微软补丁日(2015-10-13)和KB3088195 ,符号再次可用。 然而,破碎版本的符号还没有提供,所以上面可能仍然有用。

似乎在20151013年分发的Windows更新中,堆信息再次可用。

 0:018> !chksym ntdll C:\Windows\SysWOW64\ntdll.dll Timestamp: 56099FFA SizeOfImage: 180000 pdb: wntdll.pdb pdb sig: C2B37FDB-B631-4EA7-8A6D-7F51123F151E age: 2 Loaded pdb is microsoft\wntdll.pdb \C2B37FDBB6314EA78A6D7F51123F151E2\wntdll.pdb wntdll.pdb pdb sig: C2B37FDB-B631-4EA7-8A6D-7F51123F151E age: 2 MATCH: wntdll.pdb and C:\Windows\SysWOW64\ntdll.dll 

 0:018> lm vm *ntdll* start end module name 77530000 776b0000 ntdll (pdb symbols) microsoft\wntdll.pdb\C2B37FDBB6314EA78A6D7F51123F151E2\wntdll.pdb Loaded symbol image file: C:\Windows\SysWOW64\ntdll.dll Image path: C:\Windows\SysWOW64\ntdll.dll Image name: ntdll.dll Timestamp: Mon Sep 28 22:15:54 2015 (56099FFA) CheckSum: 001412F8 ImageSize: 00180000 File version: 6.1.7601.23223 Product version: 6.1.7601.23223 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: ntdll.dll OriginalFilename: ntdll.dll ProductVersion: 6.1.7601.23223 FileVersion: 6.1.7601.23223 (win7sp1_ldr.150928-0600) FileDescription: NT Layer DLL LegalCopyright: © Microsoft Corporation. All rights reserved. 

你可以安装更新,重建你的应用程序,然后再试一次?