使用 WinDbg 的符号问题

逆向工程 风袋
2021-06-12 23:36:37

我使用的是 Windows 7 Service Pack 1 x64,下载了符号并将它们安装到C:\Windows\Symbols.

我插入C:\Windows\SymbolsFile > Symbol File Path ..._NT_SYMBOL_PATH

0:000> .sympath
Symbol search path is: C:\Windows\Symbols
Expanded Symbol search path is: c:\windows\symbols

0:000> .reload
Reloading current modules
..................................
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\KERNELBASE.dll -

打开 EXE 时,我收到了一些错误消息:

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - 

0:000> !peb
PEB at 000007fffffda000
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***
*************************************************************************
error 3 InitTypeRead( nt!_PEB at 000007fffffda000).

我错过了什么吗?如果我没记错的话,我在 XP 中没有遇到过这样的问题。

1个回答

由于未匹配 PDB,您的特定 DLL 版本的符号似乎丢失(您可能应用了一些更新)。您可以改为使用 MS 符号服务器自动下载匹配的 PDB。试试这个:

.symfix+ c:\symcache
!sym noisy
.reload /f