I think my symbol is ok
lkd> lmvm nt
start end module name
804d8000 806d0480 nt (pdb symbols) c:\windows\symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
(80554fc0) nt!PsLoadedModuleList | (80554fe0) nt!PsLoadedModuleResource
Exact matches:
Python 2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
lkd> lmvm nt
start end module name
804d8000 806d0480 nt (pdb symbols) c:\windows\symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Mon Apr 14 02:31:06 2008 (4802516A)
CheckSum: 002050D3
ImageSize: 001F8480
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0804.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Windows(R) Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: (C) Microsoft Corporation. All rights reserved.
lkd> ln PsLoadedModuleList(80554fc0) nt!PsLoadedModuleList | (80554fe0) nt!PsLoadedModuleResource
Exact matches:
nt!PsLoadedModuleList = <no type information>
lkd> !pycmdPython 2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
and I tested in a clear xp sp3getOffset("PsLoadedModuleList")
Traceback (most recent call last):
File "<console>", line 1, in <module>
SymbolException: failed to find module for symbol: PsLoadedModuleList