Symbol file warnings in WinDbg 6.8.0004.0
I started using new WinDbg 6.8.4.0 and found that it prints the following message twice when I open a process dump or a complete memory dump where the current context is from some user mode process:
0:000> !analyze -v
...
...
...
***
*** Your debugger is not using the correct symbols
***
*** In order for this command to work properly, your symbol path
*** must point to .pdb files that have full type information.
***
*** Certain .pdb files (such as the public OS symbols) do not
*** contain the required information. Contact the group that
*** provided you with these symbols if you need this command to
*** work.
***
*** Type referenced: kernel32!pNlsUserInfo
***
Fortunately kernel32.dll symbols were loaded correctly despite the warning:
0:000> lmv m kernel32
start end module name
77e40000 77f42000 kernel32 (pdb symbols) c:\mssymbols\kernel32.pdb\DF4F569C743446809ACD3DFD1E9FA2AF2\kernel32.pdb
Loaded symbol image file: kernel32.dll
Image path: C:\WINDOWS\system32\kernel32.dll
Image name: kernel32.dll
Timestamp: Tue Jul 25 13:31:53 2006 (44C60F39)
CheckSum: 001059A9
ImageSize: 00102000
File version: 5.2.3790.2756
Product version: 5.2.3790.2756
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: kernel32
OriginalFilename: kernel32
ProductVersion: 5.2.3790.2756
FileVersion: 5.2.3790.2756 (srv03_sp1_gdr.060725-0040)
FileDescription: Windows NT BASE API Client DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
Also double checking return addresses on the stack trace shows that symbol mapping was correct (from another dump with the same message):
kd> dpu kernel32!pNlsUserInfo l1
77ecb0a8 77ecb760 "ENU"
kd> kv
ChildEBP RetAddr Args to Child
f552bbec f79e1743 000000e2 cccccccc 858a0470 nt!KeBugCheckEx+0x1b
WARNING: Stack unwind information not available. Following frames may be wrong.
f552bc38 8081d39d 85699390 8596fe78 860515f8 SystemDump+0x743
f552bc4c 808ec789 8596fee8 860515f8 8596fe78 nt!IofCallDriver+0x45
f552bc60 808ed507 85699390 8596fe78 860515f8 nt!IopSynchronousServiceTail+0x10b
f552bd00 808e60be 00000090 00000000 00000000 nt!IopXxxControlFile+0x5db
f552bd34 80882fa8 00000090 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
f552bd34 7c82ed54 00000090 00000000 00000000 nt!KiFastCallEntry+0xf8
0012efc4 7c8213e4 77e416f1 00000090 00000000 ntdll!KiFastSystemCallRet
0012efc8 77e416f1 00000090 00000000 00000000 ntdll!NtDeviceIoControlFile+0xc
0012f02c 00402208 00000090 9c400004 00947eb8 kernel32!DeviceIoControl+0×137
0012f884 00404f8e 0012fe80 00000001 00000000 SystemDump_400000+0×2208
kd> ub 77e416f1
kernel32!DeviceIoControl+0x11d:
77e416db lea eax,[ebp-28h]
77e416de push eax
77e416df push ebx
77e416e0 push ebx
77e416e1 push ebx
77e416e2 push dword ptr [ebp+8]
77e416e5 je kernel32!DeviceIoControl+0x131 (77e417f3)
77e416eb call dword ptr [kernel32!_imp__NtDeviceIoControlFile (77e4103c)]
So everything is allright and messages above shall be ignored. I also got e-mails from other people having the same problem so it seems to be related with this WinDbg release and not with my debugging environment.
- Dmitry Vostokov @ DumpAnalysis.org -
January 9th, 2009 at 10:10 pm
Also happens in WinDbg 6.10.3.233
Appears to be a known WinDbg problem that still needs to be fixed:
http://www.eggheadcafe.com/software/aspnet/33050264/symbols-mismatch.aspx
March 11th, 2009 at 7:22 am
Also Happens with windbg:6.11.0001.402 x86
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
but when i checked for symbols it was loaded.
0:000> lmv m kernel32
start end module name
77e40000 77f42000 kernel32 (pdb symbols) c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\kernel32.pdb
Loaded symbol image file: kernel32.dll
Image path: C:\WINNT\system32\kernel32.dll
Image name: kernel32.dll
Timestamp: Wed Apr 18 21:55:36 2007 (46264680)
CheckSum: 001083FC
ImageSize: 00102000
File version: 5.2.3790.4062
Product version: 5.2.3790.4062
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: kernel32
OriginalFilename: kernel32
ProductVersion: 5.2.3790.4062
FileVersion: 5.2.3790.4062 (srv03_sp2_gdr.070417-0203)
FileDescription: Windows NT BASE API Client DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
February 5th, 2012 at 12:00 am
I just ran into this and did an upgrade, and it does NOT happen with 6.12.0002.633. Yay!