之前我曾经使用windbg进行用户模式调试,但我怀疑我对我的系统做了一些事情,因为我不记得使用例如扩展命令！堆之前有问题.
我可以清楚地看到ntdll是一个加载的模块：
77760000 778e0000 ntdll (pdb symbols) C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb
0:001> lmvm ntdll
start end module name
77760000 778e0000 ntdll (pdb symbols) C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb \FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb
Loaded symbol image file: C:\Windows\SysWOW64\ntdll.dll
Image path: C:\Windows\SysWOW64\ntdll.dll
Image name: ntdll.dll
Timestamp: Wed Jul 15 13:53:36 2015 (55A69E20)
CheckSum: 00142A8B
ImageSize: 00180000
File version: 6.1.7601.18933
Product version: 6.1.7601.18933
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntdll.dll
OriginalFilename: ntdll.dll
ProductVersion: 6.1.7601.18933
FileVersion: 6.1.7601.18933 (win7sp1_gdr.150715-0600)
FileDescription: NT Layer DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
和
0:001> !chksym ntdll
C:\Windows\SysWOW64\ntdll.dll
Timestamp: 55A69E20
SizeOfImage: 180000
pdb: wntdll.pdb
pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97
age: 2
Loaded pdb is C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb
wntdll.pdb
pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97
age: 2
MATCH: wntdll.pdb and C:\Windows\SysWOW64\ntdll.dll<code>
当我尝试使用我的堆扩展时,我得到：
0:001> !heap -stat ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol,or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname,or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly,your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: ntdll!_PEB *** *** ***
.symopt- 100也没有帮助
如果我尝试使用临界区扩展,我会收到类似的错误：
Bad symbols for NTDLL (error 3). Aborting.
我已经读过如果你在32位和64位之间不匹配,或者如果你没有在第一位正确设置符号但我已经使用.symfix并且可以强制我的符号重新加载.reload / f,我在x86进程或32位转储上使用x86调试器,所以我看不出这些问题是如何发挥作用的.
我已经完全开始了新的和卸载的windbg,并从MSDN重新安装了Windows的调试工具,但仍然遇到了同样的问题.当然我错过了一些明显的东西？
MS正在摆脱最新Windows 7 PDB中的所有类型信息.这打破了！堆.这是关于它的推特谈话,由Alex Ionescu发起,他是“Windows Internals,Sixth Edition”的合着者：
https://twitter.com/aionescu/status/634028737458114560
更新：2015年10月12日：使用PDB Type Theft python脚本可能的解决方法,该脚本将类型信息从一个PDB复制到另一个PDB.用法是从较旧的PDB复制类型信息,该PDB具有在以后的PDB中删除的类型信息.此链接包含所有详细信息：http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/PDB-Type-Theft/ba-p/6801065#.Vhv2gPm6fmE
更新时间：2015年10月22日：在Microsoft补丁日(2015-10-13)和KB3088195中,符号再次可用.但是,没有提供破损版本的符号,因此上述内容可能仍然有用.
