Quantcast
Channel: Python extension for WinDbg
Viewing all articles
Browse latest Browse all 1625

New Post: why getOffset always fails?

$
0
0
1)
try to reload symbols for nt manually in kd/windbg:
kd>!sym noisy
kd>.reload /f nt
kd>lmvm nt

Check output. May be symbols are unavailabale?

2)
There is one trick. I usefull for minidump analysis.
MSFT for win7 has one version of the NT kernel - ntkrnlpa.exe. It can be rename to ntkrpamp.exe, ntkrnlmp.exe or ntoskernl.exe at your system. But symstore has image only for ntkrnlpa.exe. You can copy file C:\symbols\ntkrnlpa.exe\4EC79850412000\ntkrnlpa.exe to C:\symbols\ntkrpamp.exe\4EC79850412000\ntkrpamp.exe. It may help.

Viewing all articles
Browse latest Browse all 1625

Trending Articles