WinDbg is a debugging-driven tool, in fact, it has been configured for him, can be remote debugging through the VM, but the process has forgotten, as if it was also a mess, and then suddenly found good, but the original system reinstall, the results are again reconfigured, the result now, even symbol has problems , found some information, finally took care of. Write down the process so as not to forget it. I set "Reload" in the "symbol File Path" and the following issue occurs:
lkd> .reload Unable to read head of debugger data list Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlpa.exe - Loading Kernel Symbols .................................................................................................................................................. Loading User Symbols ............................................................................................................ Loading unloaded module list .........................
|
Also thought that the real operating system is AMD64 bit, and the virtual machine is a single-core CPU, the symbol file is not the same, but my virtual machine system is Windows XP+SP2 32bit, and the symbol file is the corresponding version, should not be wrong.
Use some commands, such as: U keattachprocess, there is no problem, should be for these functions are exported, but I use: U pspterminateprocess, then display error, Unresovle, it seems to be the problem of symbol, then set the " Symbol file path ":
C:\WINDOWS\Symbols; Srv*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
My symbol file is placed in the C:\WINDOWS\Symbols directory and the environment variables are added:
In My Computer properties--advanced--system variables are set up there
Variable name: _NT_SYMBOL_PATH
Variable Value: C:\WINDOWS\Symbols
Then reload, the following prompt appears:
lkd> .reload Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE Loading Kernel Symbols ................................................................................................................ Loading User Symbols ................................................................... Loading unloaded module list ..........
|
Then enter the command: U pspterminateprocess, finally have the result:
805c863e 8bff mov edi,edi 805c8640 55 push ebp 805c8641 8bec mov ebp,esp 805c8643 56 push esi 805c8644 64a124010000 mov eax,dword ptr fs:[00000124h] 805c864a 8b7508 mov esi,dword ptr [ebp+8] 805c864d 3b7044 cmp esi,dword ptr [eax+44h] 805c8650 7507 jne nt!PspTerminateProcess+0x1b (805c8659)
|
Configuration issues for WinDbg paths