WinDBG symbols

[Laith]

So right now i'm having symbol issues with WinDBG, i can't read dumps at all because it says i don't have the right symbols. Ever since i installed Windows 10 i've been having some issues with WinDBG. Can anyone please help?

 

[Hacb]

are you seeing something like this in the middle of the analysis:

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_WHEA_ERROR_RECORD_HEADER                  ***
***                                                                   ***
*************************************************************************

because that is happening to me like 8/10 times on my debugger.

 

[Laith]

No i see something like you don't have the equipped symbols to analyze this blahblahblah.

 

[Hacb]

oh, ok, never mind then.

 

[A Guy]

Have you seen this Laith?

WinDBG - Install & Configure - Windows 10 Forums

Remember we have a sister forum Ten Forums

I remember them having issues with earlier builds. Might as in the BSOD section there. A Guy

 

[Laith]

Still no success, i changed the path and deleted the old symbol folder and still same issue.

 

[z3r010]

Have you tried setting up WinDBG with the Windows 10 SDK?

 

[Laith]

No i haven't, but i think it's working now. I'll test with the dumps i can't analyze.

 

[Laith]

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_MMPTE                                     ***
***                                                                   ***
*************************************************************************

*sigh* I'll try your idea, John.

 

[Laith]

*sighs again* Same error message.

 

[z3r010]

Post a link to one of these dumps you are getting the error on so I can make sure they open fine for me.

 

[Laith]

Okay, there are many but i'll send one of them. This dump is made in 7-zip if you have trouble extracting the archive, i moved over to 7-zip from WinRAR when i installed Windows 10 because i was getting sick of seeing that i need to activate and stuff.

 

[z3r010]

That doesn't work for me either, but I've not had an issue opening any on the forums

 

[Laith]

It all started when i upgraded to Windows 10, i should have stayed at Windows 7...:huh:

 

[Anak]

Hi Laith,

Has this been happening on all of the .dmp's you've tried to open since your "upgrade" or is it just certain ones like your example?

I'm thinking in the same vein as John, and if you can open "other .dmp's" I wouldn't be so quick to blame it on win10:

That doesn't work for me either, but I've not had an issue opening any on the forums

When I open your example I get:

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

, but all the others open normally.


The clue here is the .pdb files, .pdb files are created when a developer writes his or her own code for a program and if you don't have access to that code; You are up a creek without the proverbial paddle.

The most important thing all developers need to know: PDB files are as important as source code! Yes, that’s red and bold on purpose. I’ve been to countless companies to help them debug those bugs costing hundreds of thousands of dollars and nobody can find the PDB files for the build running on a production server. Without the matching PDB files you just made your debugging challenge nearly impossible. With a huge amount of effort, my fellow Wintellectuals and I can find the problems without the right PDB files, but it will save you a lot of money if you have the right PDB files in the first place.

Source: PDB Files: What Every Developer Must Know

My interpretation of your and Hacb's problem is the both of you are trying to help members that have installed open source/freelanced, call it what you want programs that are causing the BSOD's and I would guide these members to uninstall, particularly, any recent programs that have been developed by lesser known entities.

 

[Hacb]

yep, that mesage looks like what i'm seeing sometimes.

 

[derekimo]

I've gotten that a couple times recently, over at TF and here.

Googling these,

nt!_MMPTE

nt!_KPRCB

Will get a lot of similar results, like this,

Solved Unable to make WinDBG analyze the Dump files

 

[Anak]

Good ol' Mr. Cranky Pants! That's the tack I saw:

IMO - start by assuming it's a 3rd party driver (non-Windows)
Once you rule that out, then start in on hardware problems/diagnostics
The last thing to check (assuming Windows is fully updated) is Windows.

But I am going to have to rethink this.

From Derek's link and searching myself, not only on the web but into my own HDD I found that I do have pdb files at C:\symbols, but are they the right ones to decipher Laith's sample file?

I tested using various cmds in the debugger cmd line that I found in the kernel_debugging_tutorial.doc (copy that .doc name into your search box) that accompanies the debugger when you install it, with no luck.

I did some testing in the symbols folder following this: Windbg Symbols for ntoskrnl.exe even creating a ntoskml.pdb folder and coping files to it:

to fix this, you need to go into
the SYMBOLS\EXE folder and copy file 'ntkrnlmp.pdb'
to 'ntoskrnl.pdb'.

with no success.

I'm going to do more reading and testing and see if I can come up with an answer. Like why don't I have ntoskml.pdb to begin with?

 

[Laith]

Exactly, why don't we have one?

On Windows 7 WinDBG worked like a charm with no errors, but with upgrading it gave me errors and all kinds o' stuff.

 

[derekimo]

On Windows 7 WinDBG worked like a charm with no errors, but with upgrading it gave me errors and all kinds o' stuff.

It had nothing to do with windows 10, we have three different OS's all getting the same thing.

This is still happening in quite a few dumps, I'm starting to think some update has altered something.



As soon as Microsoft gets enough complaints about this they will probably fix it.