!process 0 0 - NT symbols are incorrect, please fix symbols

Question

!process 0 0 - NT symbols are incorrect, please fix symbols

I get the same error when using !process 0 0 every time - being in kernel debug mode or not doesn't seem to change anything.

Here's a command chain while opening notepad.exe

Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: C:\Windows\System32\notepad.exe

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
DBGHELP: Symbol Search Path: cache*;SRV*https://msdl.microsoft.com/download/symbols
Symbol search path is: srv*
Executable search path is: 
ModLoad: 00007ff6`27eb0000 00007ff6`27ee8000   notepad.exe
ModLoad: 00007ffe`fb890000 00007ffe`fba86000   ntdll.dll
ModLoad: 00007ffe`f9990000 00007ffe`f9a4d000   C:\WINDOWS\System32\KERNEL32.DLL
ModLoad: 00007ffe`f90b0000 00007ffe`f9379000   C:\WINDOWS\System32\KERNELBASE.dll
ModLoad: 00007ffe`fb820000 00007ffe`fb84a000   C:\WINDOWS\System32\GDI32.dll
ModLoad: 00007ffe`f8fd0000 00007ffe`f8ff2000   C:\WINDOWS\System32\win32u.dll
ModLoad: 00007ffe`f9580000 00007ffe`f968b000   C:\WINDOWS\System32\gdi32full.dll
ModLoad: 00007ffe`f9380000 00007ffe`f941d000   C:\WINDOWS\System32\msvcp_win.dll
ModLoad: 00007ffe`f9420000 00007ffe`f9520000   C:\WINDOWS\System32\ucrtbase.dll
ModLoad: 00007ffe`faff0000 00007ffe`fb190000   C:\WINDOWS\System32\USER32.dll
ModLoad: 00007ffe`fa110000 00007ffe`fa466000   C:\WINDOWS\System32\combase.dll
ModLoad: 00007ffe`fb440000 00007ffe`fb56b000   C:\WINDOWS\System32\RPCRT4.dll
ModLoad: 00007ffe`fadc0000 00007ffe`fae6e000   C:\WINDOWS\System32\shcore.dll
ModLoad: 00007ffe`fa4d0000 00007ffe`fa56e000   C:\WINDOWS\System32\msvcrt.dll
ModLoad: 00007ffe`e2d70000 00007ffe`e300b000   C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.746_none_ca02b4b61b8320a4\COMCTL32.dll
(1208.ff0): Break instruction exception - code 80000003 (first chance)
SYMSRV:  BYINDEX: 0x1
         C:\ProgramData\Dbg\sym
         ntdll.pdb
         432F2B8588C52E47219EE25E35F653491
SYMSRV:  PATH: C:\ProgramData\Dbg\sym\ntdll.pdb\432F2B8588C52E47219EE25E35F653491\ntdll.pdb
SYMSRV:  RESULT: 0x00000000
DBGHELP: ntdll - public symbols  
        C:\ProgramData\Dbg\sym\ntdll.pdb\432F2B8588C52E47219EE25E35F653491\ntdll.pdb
ntdll!LdrpDoDebuggerBreak+0x30:
00007ffe`fb960670 cc              int     3

The .sympath command :

0:000> .sympath 
Symbol search path is: srv*
Expanded Symbol search path is: cache*;SRV*https://msdl.microsoft.com/download/symbols

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred

The .reload command :

0:000> .reload
Reloading current modules
...............SYMSRV:  BYINDEX: 0x3
         C:\ProgramData\Dbg\sym
         ntdll.pdb
         432F2B8588C52E47219EE25E35F653491
SYMSRV:  PATH: C:\ProgramData\Dbg\sym\ntdll.pdb\432F2B8588C52E47219EE25E35F653491\ntdll.pdb
SYMSRV:  RESULT: 0x00000000
DBGHELP: ntdll - public symbols  
        C:\ProgramData\Dbg\sym\ntdll.pdb\432F2B8588C52E47219EE25E35F653491\ntdll.pdb

Finally the !process 0 0 command :

0:000> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
Could not get address of nt!KdVersionBlock.
unable to get nt!MmUserProbeAddress
NT symbols are incorrect, please fix symbols

I don't know what is going on. I tried deleting the sym\ntdll.pdb folder and re-downloading it but to no avail.

Edit - more info on request :

0:000> !lmi nt
Loaded Module Info: [nt] 
DBGHELP: SharedUserData - virtual symbol module
nt not found
0:000> vertarget
Windows 10 Version 19042 MP (16 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Build layer:            -> 
Build layer:            -> 
Build layer:            -> 
Machine Name:
Debug session time: Wed Mar 10 18:26:22.757 2021 (UTC + 1:00)
System Uptime: 0 days 14:38:24.474
Process Uptime: 0 days 0:00:51.162
  Kernel time: 0 days 0:00:00.015
  User time: 0 days 0:00:00.000


0:000> lm
start             end                 module name
00007ff6`54910000 00007ff6`54948000   notepad    (deferred)             
00007ffe`f9c40000 00007ffe`f9eda000   COMCTL32   (deferred)             
00007fff`09350000 00007fff`09372000   win32u     (deferred)             
00007fff`09540000 00007fff`095dd000   msvcp_win   (deferred)             
00007fff`09690000 00007fff`09959000   KERNELBASE   (deferred)             
00007fff`099e0000 00007fff`09ae0000   ucrtbase   (deferred)             
00007fff`09b30000 00007fff`09c3b000   gdi32full   (deferred)             
00007fff`09c70000 00007fff`09d0e000   msvcrt     (deferred)             
00007fff`09e20000 00007fff`09ece000   shcore     (deferred)             
00007fff`0a8d0000 00007fff`0a98d000   KERNEL32   (deferred)             
00007fff`0aa60000 00007fff`0aa8a000   GDI32      (deferred)             
00007fff`0aad0000 00007fff`0ac70000   USER32     (deferred)             
00007fff`0ad00000 00007fff`0ae2b000   RPCRT4     (deferred)             
00007fff`0b810000 00007fff`0bb65000   combase    (deferred)             
00007fff`0bc10000 00007fff`0be05000   ntdll      (pdb symbols)          C:\ProgramData\Dbg\sym\ntdll.pdb\53F12BFE149A2F50205C8D5D66290B481\ntdll.pdb
0:000> .reload /f nt

"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000`00000000.

Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
SYMSRV:  BYINDEX: 0xD
         C:\ProgramData\Dbg\sym
         nt
         FFFFFFFE
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\nt - path not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\n_ - path not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\file.ptr - path not found
SYMSRV:  RESULT: 0x80070003
SYMSRV:  BYINDEX: 0xE
         C:\ProgramData\Dbg\sym*https://msdl.microsoft.com/download/symbols
         nt
         FFFFFFFE
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\nt - path not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\n_ - path not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\file.ptr - path not found
SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/nt
SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/n_
SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/file.ptr
SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  RESULT: 0x80190194
DBGHELP: C:\WINDOWS\system32\nt - file not found
SYMSRV:  BYINDEX: 0xF
         https://msdl.microsoft.com/download/symbols
         nt
         FFFFFFFE
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\nt - path not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\n_ - path not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\file.ptr - path not found
SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/nt
SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/n_
SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/file.ptr
SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  RESULT: 0x80190194
DBGENG:  nt - Image mapping disallowed by non-local path.
DBGHELP: No header for nt.  Searching for dbg file
DBGHELP: .\nt.dbg - file not found
DBGHELP: nt missing debug info.  Searching for pdb anyway
DBGHELP: Can't use symbol server for nt.pdb - no header information available
DBGHELP: nt.pdb - file not found
*** WARNING: Unable to verify timestamp for nt
*** ERROR: Module load completed but symbols could not be loaded for nt
DBGHELP: nt_0 - no symbols loaded
Unable to add module at 00000000`00000000

windows-10

windbg

asked on Stack Overflow Mar 9, 2021 by

PinkTurtle • edited Mar 10, 2021 by

PinkTurtle

1 Answer

!process 0 0 will only work in Attach to kernel mode with Windows kernel debugging turned on.

To use !pte with a process, one has to set the process context with .process /p pid - the pid is a process id listed with !process 0 0.

To use !vtop, one has to specify the process directoryBase [along with a virtual address] which is also listed with !process 0 0.

answered on Stack Overflow Mar 10, 2021 by

PinkTurtle

User contributions licensed under CC BY-SA 3.0