Menu
- The Symbol File Ntdll Pdb Does Not Match The Module 2
- The Symbol File Ntdll Pdb Does Not Match The Module Pdf
Please check out the Community Guidelines in the Announcements and Administration Category.
PDB files, among others, contain information about structures and unions. These information can be very useful - for instance structures and unions from ntdll.dll or ntoskrnl.exe can be useful for experimenting with Windows internals. But information in the PDB files are limited only to the symbol name, member name, its type and offset. Dll ntdll.dbg - path not found DBGHELP:. Symbols dll ntdll.dbg - path not found DBGHELP: ntdll.dll missing debug info. Searching for pdb anyway DBGHELP: Can't use symbol server for ntdll.pdb - no header information available DBGHELP: ntdll.pdb - file not found. ERROR: Symbol file could not be found. Defaulted to export symbols. Yes, I do build the exe file, copy the exe to the smart device (an Intermec Mobile 5 wireless using Microsoft ActiveSync). I was hoping someone here has had similar experience, but obviously not. Thanks anyway. In some cases, the module name differs significantly from the file name. The symbol type immediately follows the module name. This column is not labeled. For more information about the various status values, see Symbol Status Abbreviations. If you have loaded symbols, the symbol file name follows this column. STACKTEXT: 000000`00000000 WRONGSYMBOLS!WRONGSYMBOLS+0x0 STACKCOMMAND:. Pseudo Context. ManagedPseudo. Value: 29d9f267040.; kb BUGCHECKCODE: b29ecf52 EXCEPTIONCODESTR: B29ECF52 EXCEPTIONSTR: WRONGSYMBOLS PROCESSNAME: ntdll.wrong.symbols.dll IMAGENAME: ntdll.wrong.symbols.dll MODULENAME: ntdllwrong.
The Symbol File Ntdll Pdb Does Not Match The Module 2
Thefree OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. Reitz foundations of electromagnetic theory solution manual. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
The Symbol File Ntdll Pdb Does Not Match The Module Pdf
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
in WINDBG
Hi, everyone
My process named Pollux.exe crashed on a user's machine. Unfortunately, I
didn't preserve the pdb file when I build the project.
So I rebuild the project now to get a pdb file. I do know the timestamp and
checksum is unmatched.
But it's hard to reproduce the bug. So I just try to use the command .reload
/i /f xxx.
0:001> .reload /i /f Pollux.exe
SYMSRV: C:symbolsPollux.exe48088ADB43000Pollux.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbol/Pollux.exe/48088ADB43000/Pollux.exenot
found
DBGHELP: G:xlPollux0927_um_dmpPollux.exe - OK
DBGENG: G:xlPollux0927_um_dmpPollux.exe - Mapped image memory
DBGHELP: No debug info for Pollux.exe. Searching for dbg file
SYMSRV: C:symbolsPollux.dbg48088ADB43000Pollux.dbg not found
SYMSRV:
http://msdl.microsoft.com/download/symbol/Pollux.dbg/48088ADB43000/Pollux.dbgnot
found
DBGHELP: G:xlPollux0927_um_dmpPollux.dbg - file not found
DBGHELP: G:xlPollux0927_um_dmpexePollux.dbg - path not found
DBGHELP: G:xlPollux0927_um_dmpsymbolsexePollux.dbg - path not found
DBGHELP: .Pollux.dbg - file not found
DBGHELP: .exePollux.dbg - path not found
DBGHELP: .symbolsexePollux.dbg - path not found
DBGHELP: Pollux.exe missing debug info. Searching for pdb anyway
DBGHELP: Can't use symbol server for Pollux.pdb - no header information
available
*** WARNING: Unable to verify checksum for Pollux.exe
DBGENG: Pollux.exe has mismatched symbols - type '.hh dbgerr003' for
details
DBGHELP: Pollux - public symbols
G:xlPollux0927_um_dmpPollux.pdb - unmatched
*Question 1: What does this line mean? a dump file problem or a pdb file
problem?*
Can't use symbol server for Pollux.pdb - no header information available
Windbg help file says:
The debugger identifies the proper symbols by examining the headers of the
relevant modules.
If these module headers are paged out, the debugger (and the symbol server)
ar unable to find the proper symbols.
When this occurs, 'No Header Information Available' is displayed within the
symbol error message.
After !analyze -v, the cause is ExceptionCode: c0000005 (Access violation)
Here is the stack information:
STACK_TEXT:
00baf610 7c950d5c 003d0000 00000000 00baf6c8
ntdll!RtlpCoalesceFreeBlocks+0x36e
00baf6e4 7c34218a 003d0000 00000000 011a5018 ntdll!RtlFreeHeap+0x2e9
00baf72c 0040712a 011a5018 7c3ac1d1 00baf8ff msvcr71!free+0xc3
[f:vs70builds3052vccrtbldcrtsrcfree.c @ 103]
00baf760 7c3a1ccf 7c3a1ce3 5c2e5c5c 01003a43 Pollux+0x712a
00baf76c 01003a43 6231885e 004072e7 00440000
msvcp71!std::basic_string,std::allocator
>::_Tidy+0x31
WARNING: Stack unwind information not available. Following frames may be
wrong.
00baf780 7c3719e3 0118eb30 0118eb2c 00000000 rr_res+0x1a3a43
00baf87c 7c9505c8 00142098 00baf954 7c950551 msvcr71!mktime+0xc
[f:vs70builds3052vccrtbldcrtsrcmktime.c @ 71]
00baf8cc 72676f72 46206d61 73656c69 6e654c5c
ntdll!RtlpFreeToHeapLookaside+0x22
00baf950 7c95056d 7c80b7c9 00140000 00000000 0x72676f72
00bafa04 004289e8 004289e4 0118e6ac 00000204 ntdll!RtlFreeHeap+0x647
00bafa14 00000000 01181e00 00000010 000001f4 Pollux+0x289e8
*Question 2:*
*What can I get from the information : msvcp71!std::basic_string,
std::allocator, msvcr71!free+0xc3*
I guess the problem is caused by some codes like
Buff = malloc(ClusterSize);
for (r = 0; r < ClCount; r++, FileSize -= BlockSize)
{
Offset.QuadPart = ClusterSize * Clusters[r];
SetFilePointer(hDrive, Offset.LowPart, &Offset.HighPart,
FILE_BEGIN);
ReadFile(hDrive, Buff, ClusterSize, &Bytes, NULL);
BlockSize = FileSize < ClusterSize ? FileSize :
ClusterSize;
WriteFile(hFile, Buff, BlockSize, &Bytes, NULL);
}
free(Buff);
because before I added these codes, the system is OK.
How can I confirm this?
Here is the Windbg Output:
Loading Dump File [G:xlpollux0927_um_dmpl3a0003Pollux.exe.mdmp]
User Mini Dump File: Only registers, stack and portions of memory are
available
DBGHELP: Symbol Search Path: srv*C:symbols*
http://msdl.microsoft.com/download/symbol;G:xlpollux0927_um_dmp
Symbol search path is: srv*C:symbols*
http://msdl.microsoft.com/download/symbol;G:xlpollux0927_um_dmp
Executable search path is:
DBGHELP: SharedUserData - virtual symbol module
Windows XP Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Tue Sep 9 13:47:33.000 2008 (GMT+8)
System Uptime: not available
Process Uptime: 0 days 0:00:53.000
............................
DBGHELP: C:symbolskernel32.dll44AB9A99131000kernel32.dll - OK
DBGENG: C:symbolskernel32.dll44AB9A99131000kernel32.dll - Mapped image
memory
This dump file has an exception of interest stored in it.
?? what does this line mean?
The stored exception information can be accessed via .ecxr.
(8a8.8d0): Access violation - code c0000005 (first/second chance not
available)
eax=c0000005 ebx=80070000 ecx=00bab724 edx=00000000 esi=00000268
edi=00000000
eip=7c94eb94 esp=00ba95b4 ebp=00ba9618 iopl=0 nv up ei ng nz ac pe
cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000297
DBGHELP: C:symbolsntdll.dll411096559d000ntdll.dll - OK
DBGENG: C:symbolsntdll.dll411096559d000ntdll.dll - Mapped image memory
DBGHELP: ntdll - public symbols
C:symbolsntdll.pdb36515FB5D04345E491F672FA2E2878C02ntdll.pdb
ntdll!KiFastSystemCallRet:
7c94eb94 c3 ret
0:001> !analyze -v
*******************************************************************************
*
*
* Exception
Analysis *
*
*
*******************************************************************************
..omitted..
FAULTING_IP:
ntdll!RtlpCoalesceFreeBlocks+36e
7c950f29 8b09 mov ecx,dword ptr [ecx]
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c950f29 (ntdll!RtlpCoalesceFreeBlocks+0x0000036e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: HEAP_CORRUPTION
PROCESS_NAME: Pollux.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - '0x%08lx'
READ_ADDRESS: 00000000
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 7c950d5c to 7c950f29
STACK_TEXT:
00baf610 7c950d5c 003d0000 00000000 00baf6c8
ntdll!RtlpCoalesceFreeBlocks+0x36e
00baf6e4 7c34218a 003d0000 00000000 011a5018 ntdll!RtlFreeHeap+0x2e9
00baf72c 0040712a 011a5018 7c3ac1d1 00baf8ff msvcr71!free+0xc3
[f:vs70builds3052vccrtbldcrtsrcfree.c @ 103]
00baf760 7c3a1ccf 7c3a1ce3 5c2e5c5c 01003a43 Pollux+0x712a
00baf76c 01003a43 6231885e 004072e7 00440000
msvcp71!std::basic_string,std::allocator
>::_Tidy+0x31
WARNING: Stack unwind information not available. Following frames may be
wrong.
00baf780 7c3719e3 0118eb30 0118eb2c 00000000 rr_res+0x1a3a43
00baf87c 7c9505c8 00142098 00baf954 7c950551 msvcr71!mktime+0xc
[f:vs70builds3052vccrtbldcrtsrcmktime.c @ 71]
00baf8cc 72676f72 46206d61 73656c69 6e654c5c
ntdll!RtlpFreeToHeapLookaside+0x22
00baf950 7c95056d 7c80b7c9 00140000 00000000 0x72676f72
00bafa04 004289e8 004289e4 0118e6ac 00000204 ntdll!RtlFreeHeap+0x647
00bafa14 00000000 01181e00 00000010 000001f4 Pollux+0x289e8
STACK_COMMAND: ~1s; .ecxr ; kb
ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer
FAULTING_THREAD: 000008d0
PRIMARY_PROBLEM_CLASS: HEAP_CORRUPTION
BUGCHECK_STR: APPLICATION_FAULT_HEAP_CORRUPTION_NULL_POINTER_READ
SYMBOL_NAME: heap_corruption!heap_corruption
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: heap_corruption
IMAGE_NAME: heap_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: heap_corruption!heap_corruption_c0000005_HEAP_CORRUPTION
BUCKET_ID:
APPLICATION_FAULT_HEAP_CORRUPTION_NULL_POINTER_READ_heap_corruption!heap_corruption
Followup: MachineOwner
---------
0:001> lml
start end module name
00400000 00443000 Pollux M (pdb symbols)
G:xlpollux0927_um_dmpPollux.pdb
00e60000 0108e000 rr_res T (no symbols)
683a0000 683b6000 faultrep T (pdb symbols)
C:symbolsfaultrep.pdb3894E0C34E6A43099670AE3EB5AFD94D1faultrep.pdb
76970000 76aad000 ole32 T (pdb symbols)
C:symbolsole32.pdb683B65B246F4418796D2EE6D4C55EB112ole32.pdb
77cf0000 77d7f000 user32 T (no symbols)
77d80000 77e29000 advapi32 T (pdb symbols)
C:symbolsadvapi32.pdb455D6C5F184D45BBB5C5F30F829751142advapi32.pdb
77e30000 77ec1000 rpcrt4 T (no symbols)
7c340000 7c396000 msvcr71 (private pdb symbols)
C:symbolsmsvcr71.pdb630C79175C1942C099C9BC4ED019C6092msvcr71.pdb
7c3a0000 7c41b000 msvcp71 (private pdb symbols)
C:symbolsmsvcp71.pdb27E1F58F3F1A4D02A42C6AB2665A8C3C2msvcp71.pdb
7c800000 7c931000 kernel32 (export symbols) kernel32.dll
7c940000 7c9dd000 ntdll (pdb symbols)
C:symbolsntdll.pdb36515FB5D04345E491F672FA2E2878C02ntdll.pdb
0:001> .reload /i /f Pollux.exe
SYMSRV: C:symbolsPollux.exe48088ADB43000Pollux.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbol/Pollux.exe/48088ADB43000/Pollux.exenot
found
DBGHELP: G:xlPollux0927_um_dmpPollux.exe - OK
DBGENG: G:xlPollux0927_um_dmpPollux.exe - Mapped image memory
DBGHELP: No debug info for Pollux.exe. Searching for dbg file
SYMSRV: C:symbolsPollux.dbg48088ADB43000Pollux.dbg not found
SYMSRV:
http://msdl.microsoft.com/download/symbol/Pollux.dbg/48088ADB43000/Pollux.dbgnot
found
DBGHELP: G:xlPollux0927_um_dmpPollux.dbg - file not found
DBGHELP: G:xlPollux0927_um_dmpexePollux.dbg - path not found
DBGHELP: G:xlPollux0927_um_dmpsymbolsexePollux.dbg - path not found
DBGHELP: .Pollux.dbg - file not found
DBGHELP: .exePollux.dbg - path not found
DBGHELP: .symbolsexePollux.dbg - path not found
DBGHELP: Pollux.exe missing debug info. Searching for pdb anyway
DBGHELP: Can't use symbol server for Pollux.pdb - no header information
available
?? Does this mean the dump file is not available?
*** WARNING: Unable to verify checksum for Pollux.exe
DBGENG: Pollux.exe has mismatched symbols - type '.hh dbgerr003' for
details
DBGHELP: Pollux - public symbols
G:xlPollux0927_um_dmpPollux.pdb - unmatched
Thanks for you concern~~
--
gxl
My process named Pollux.exe crashed on a user's machine. Unfortunately, I
didn't preserve the pdb file when I build the project.
So I rebuild the project now to get a pdb file. I do know the timestamp and
checksum is unmatched.
But it's hard to reproduce the bug. So I just try to use the command .reload
/i /f xxx.
0:001> .reload /i /f Pollux.exe
SYMSRV: C:symbolsPollux.exe48088ADB43000Pollux.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbol/Pollux.exe/48088ADB43000/Pollux.exenot
found
DBGHELP: G:xlPollux0927_um_dmpPollux.exe - OK
DBGENG: G:xlPollux0927_um_dmpPollux.exe - Mapped image memory
DBGHELP: No debug info for Pollux.exe. Searching for dbg file
SYMSRV: C:symbolsPollux.dbg48088ADB43000Pollux.dbg not found
SYMSRV:
http://msdl.microsoft.com/download/symbol/Pollux.dbg/48088ADB43000/Pollux.dbgnot
found
DBGHELP: G:xlPollux0927_um_dmpPollux.dbg - file not found
DBGHELP: G:xlPollux0927_um_dmpexePollux.dbg - path not found
DBGHELP: G:xlPollux0927_um_dmpsymbolsexePollux.dbg - path not found
DBGHELP: .Pollux.dbg - file not found
DBGHELP: .exePollux.dbg - path not found
DBGHELP: .symbolsexePollux.dbg - path not found
DBGHELP: Pollux.exe missing debug info. Searching for pdb anyway
DBGHELP: Can't use symbol server for Pollux.pdb - no header information
available
*** WARNING: Unable to verify checksum for Pollux.exe
DBGENG: Pollux.exe has mismatched symbols - type '.hh dbgerr003' for
details
DBGHELP: Pollux - public symbols
G:xlPollux0927_um_dmpPollux.pdb - unmatched
*Question 1: What does this line mean? a dump file problem or a pdb file
problem?*
Can't use symbol server for Pollux.pdb - no header information available
Windbg help file says:
The debugger identifies the proper symbols by examining the headers of the
relevant modules.
If these module headers are paged out, the debugger (and the symbol server)
ar unable to find the proper symbols.
When this occurs, 'No Header Information Available' is displayed within the
symbol error message.
After !analyze -v, the cause is ExceptionCode: c0000005 (Access violation)
Here is the stack information:
STACK_TEXT:
00baf610 7c950d5c 003d0000 00000000 00baf6c8
ntdll!RtlpCoalesceFreeBlocks+0x36e
00baf6e4 7c34218a 003d0000 00000000 011a5018 ntdll!RtlFreeHeap+0x2e9
00baf72c 0040712a 011a5018 7c3ac1d1 00baf8ff msvcr71!free+0xc3
[f:vs70builds3052vccrtbldcrtsrcfree.c @ 103]
00baf760 7c3a1ccf 7c3a1ce3 5c2e5c5c 01003a43 Pollux+0x712a
00baf76c 01003a43 6231885e 004072e7 00440000
msvcp71!std::basic_string,std::allocator
>::_Tidy+0x31
WARNING: Stack unwind information not available. Following frames may be
wrong.
00baf780 7c3719e3 0118eb30 0118eb2c 00000000 rr_res+0x1a3a43
00baf87c 7c9505c8 00142098 00baf954 7c950551 msvcr71!mktime+0xc
[f:vs70builds3052vccrtbldcrtsrcmktime.c @ 71]
00baf8cc 72676f72 46206d61 73656c69 6e654c5c
ntdll!RtlpFreeToHeapLookaside+0x22
00baf950 7c95056d 7c80b7c9 00140000 00000000 0x72676f72
00bafa04 004289e8 004289e4 0118e6ac 00000204 ntdll!RtlFreeHeap+0x647
00bafa14 00000000 01181e00 00000010 000001f4 Pollux+0x289e8
*Question 2:*
*What can I get from the information : msvcp71!std::basic_string,
std::allocator, msvcr71!free+0xc3*
I guess the problem is caused by some codes like
Buff = malloc(ClusterSize);
for (r = 0; r < ClCount; r++, FileSize -= BlockSize)
{
Offset.QuadPart = ClusterSize * Clusters[r];
SetFilePointer(hDrive, Offset.LowPart, &Offset.HighPart,
FILE_BEGIN);
ReadFile(hDrive, Buff, ClusterSize, &Bytes, NULL);
BlockSize = FileSize < ClusterSize ? FileSize :
ClusterSize;
WriteFile(hFile, Buff, BlockSize, &Bytes, NULL);
}
free(Buff);
because before I added these codes, the system is OK.
How can I confirm this?
Here is the Windbg Output:
Loading Dump File [G:xlpollux0927_um_dmpl3a0003Pollux.exe.mdmp]
User Mini Dump File: Only registers, stack and portions of memory are
available
DBGHELP: Symbol Search Path: srv*C:symbols*
http://msdl.microsoft.com/download/symbol;G:xlpollux0927_um_dmp
Symbol search path is: srv*C:symbols*
http://msdl.microsoft.com/download/symbol;G:xlpollux0927_um_dmp
Executable search path is:
DBGHELP: SharedUserData - virtual symbol module
Windows XP Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Tue Sep 9 13:47:33.000 2008 (GMT+8)
System Uptime: not available
Process Uptime: 0 days 0:00:53.000
............................
DBGHELP: C:symbolskernel32.dll44AB9A99131000kernel32.dll - OK
DBGENG: C:symbolskernel32.dll44AB9A99131000kernel32.dll - Mapped image
memory
This dump file has an exception of interest stored in it.
?? what does this line mean?
The stored exception information can be accessed via .ecxr.
(8a8.8d0): Access violation - code c0000005 (first/second chance not
available)
eax=c0000005 ebx=80070000 ecx=00bab724 edx=00000000 esi=00000268
edi=00000000
eip=7c94eb94 esp=00ba95b4 ebp=00ba9618 iopl=0 nv up ei ng nz ac pe
cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000297
DBGHELP: C:symbolsntdll.dll411096559d000ntdll.dll - OK
DBGENG: C:symbolsntdll.dll411096559d000ntdll.dll - Mapped image memory
DBGHELP: ntdll - public symbols
C:symbolsntdll.pdb36515FB5D04345E491F672FA2E2878C02ntdll.pdb
ntdll!KiFastSystemCallRet:
7c94eb94 c3 ret
0:001> !analyze -v
*******************************************************************************
*
*
* Exception
Analysis *
*
*
*******************************************************************************
..omitted..
FAULTING_IP:
ntdll!RtlpCoalesceFreeBlocks+36e
7c950f29 8b09 mov ecx,dword ptr [ecx]
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c950f29 (ntdll!RtlpCoalesceFreeBlocks+0x0000036e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: HEAP_CORRUPTION
PROCESS_NAME: Pollux.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - '0x%08lx'
READ_ADDRESS: 00000000
APPLICATION_VERIFIER_FLAGS: 0
LAST_CONTROL_TRANSFER: from 7c950d5c to 7c950f29
STACK_TEXT:
00baf610 7c950d5c 003d0000 00000000 00baf6c8
ntdll!RtlpCoalesceFreeBlocks+0x36e
00baf6e4 7c34218a 003d0000 00000000 011a5018 ntdll!RtlFreeHeap+0x2e9
00baf72c 0040712a 011a5018 7c3ac1d1 00baf8ff msvcr71!free+0xc3
[f:vs70builds3052vccrtbldcrtsrcfree.c @ 103]
00baf760 7c3a1ccf 7c3a1ce3 5c2e5c5c 01003a43 Pollux+0x712a
00baf76c 01003a43 6231885e 004072e7 00440000
msvcp71!std::basic_string,std::allocator
>::_Tidy+0x31
WARNING: Stack unwind information not available. Following frames may be
wrong.
00baf780 7c3719e3 0118eb30 0118eb2c 00000000 rr_res+0x1a3a43
00baf87c 7c9505c8 00142098 00baf954 7c950551 msvcr71!mktime+0xc
[f:vs70builds3052vccrtbldcrtsrcmktime.c @ 71]
00baf8cc 72676f72 46206d61 73656c69 6e654c5c
ntdll!RtlpFreeToHeapLookaside+0x22
00baf950 7c95056d 7c80b7c9 00140000 00000000 0x72676f72
00bafa04 004289e8 004289e4 0118e6ac 00000204 ntdll!RtlFreeHeap+0x647
00bafa14 00000000 01181e00 00000010 000001f4 Pollux+0x289e8
STACK_COMMAND: ~1s; .ecxr ; kb
ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer
FAULTING_THREAD: 000008d0
PRIMARY_PROBLEM_CLASS: HEAP_CORRUPTION
BUGCHECK_STR: APPLICATION_FAULT_HEAP_CORRUPTION_NULL_POINTER_READ
SYMBOL_NAME: heap_corruption!heap_corruption
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: heap_corruption
IMAGE_NAME: heap_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: heap_corruption!heap_corruption_c0000005_HEAP_CORRUPTION
BUCKET_ID:
APPLICATION_FAULT_HEAP_CORRUPTION_NULL_POINTER_READ_heap_corruption!heap_corruption
Followup: MachineOwner
---------
0:001> lml
start end module name
00400000 00443000 Pollux M (pdb symbols)
G:xlpollux0927_um_dmpPollux.pdb
00e60000 0108e000 rr_res T (no symbols)
683a0000 683b6000 faultrep T (pdb symbols)
C:symbolsfaultrep.pdb3894E0C34E6A43099670AE3EB5AFD94D1faultrep.pdb
76970000 76aad000 ole32 T (pdb symbols)
C:symbolsole32.pdb683B65B246F4418796D2EE6D4C55EB112ole32.pdb
77cf0000 77d7f000 user32 T (no symbols)
77d80000 77e29000 advapi32 T (pdb symbols)
C:symbolsadvapi32.pdb455D6C5F184D45BBB5C5F30F829751142advapi32.pdb
77e30000 77ec1000 rpcrt4 T (no symbols)
7c340000 7c396000 msvcr71 (private pdb symbols)
C:symbolsmsvcr71.pdb630C79175C1942C099C9BC4ED019C6092msvcr71.pdb
7c3a0000 7c41b000 msvcp71 (private pdb symbols)
C:symbolsmsvcp71.pdb27E1F58F3F1A4D02A42C6AB2665A8C3C2msvcp71.pdb
7c800000 7c931000 kernel32 (export symbols) kernel32.dll
7c940000 7c9dd000 ntdll (pdb symbols)
C:symbolsntdll.pdb36515FB5D04345E491F672FA2E2878C02ntdll.pdb
0:001> .reload /i /f Pollux.exe
SYMSRV: C:symbolsPollux.exe48088ADB43000Pollux.exe not found
SYMSRV:
http://msdl.microsoft.com/download/symbol/Pollux.exe/48088ADB43000/Pollux.exenot
found
DBGHELP: G:xlPollux0927_um_dmpPollux.exe - OK
DBGENG: G:xlPollux0927_um_dmpPollux.exe - Mapped image memory
DBGHELP: No debug info for Pollux.exe. Searching for dbg file
SYMSRV: C:symbolsPollux.dbg48088ADB43000Pollux.dbg not found
SYMSRV:
http://msdl.microsoft.com/download/symbol/Pollux.dbg/48088ADB43000/Pollux.dbgnot
found
DBGHELP: G:xlPollux0927_um_dmpPollux.dbg - file not found
DBGHELP: G:xlPollux0927_um_dmpexePollux.dbg - path not found
DBGHELP: G:xlPollux0927_um_dmpsymbolsexePollux.dbg - path not found
DBGHELP: .Pollux.dbg - file not found
DBGHELP: .exePollux.dbg - path not found
DBGHELP: .symbolsexePollux.dbg - path not found
DBGHELP: Pollux.exe missing debug info. Searching for pdb anyway
DBGHELP: Can't use symbol server for Pollux.pdb - no header information
available
?? Does this mean the dump file is not available?
*** WARNING: Unable to verify checksum for Pollux.exe
DBGENG: Pollux.exe has mismatched symbols - type '.hh dbgerr003' for
details
DBGHELP: Pollux - public symbols
G:xlPollux0927_um_dmpPollux.pdb - unmatched
Thanks for you concern~~
--
gxl