嵌入 xp 的 Windbg，ntdll.dll 符号失败，其他符号受到影响吗？
我正在使用嵌入 xp 的 Windbg。尝试获取操作系统符号失败，并显示消息“找不到符号文件。默认导出 ntdll.dll 的符号”。 （这是 xp 嵌入式的典型情况吗？？？）
我在定位和加载我自己的代码的符号和源代码方面没有问题。然而，单步执行代码表明代码和符号文件之间存在严重不匹配，因为 dv 返回的内存中变量的位置似乎与实际内存内容不一致（例如分配一个变量，但随后，地址dv 声称与其对应的内容似乎没有变化）。
我的 sympath 首先列出符号目录，然后是缓存，然后是服务器，因此缓存的符号文件不应受到干扰。
这是未找到 ntdll 符号文件并使用另一个不正确匹配的符号文件的潜在影响，还是有其他原因可能导致此问题？
示例：
<代码> .sympath D:/符号
.symfix+
.srcpath D:/Symbols ** 是的，当前源位于符号中
.重新加载
**（默认导出ntdll.dll的符号，因为找不到符号文件）
bp 00401000（在构造函数处中断）
克
（程序运行直到遇到构造函数）
l+t
dv /i /t /V ** 查找此指针内存位置以检查构造函数
** 我们在 this 指针指向的位置调出一个内存窗口
** 单步执行代码，但该内存窗口中没有出现任何更改
** 此外，本地 LARGE_INTEGER 的值是使用 QueryPerformanceCounter
设置的 ** 调用后也显示不变
** 当构造函数返回时，我们分配
返回的内存地址 ** 全局指针的新手，我们用 dt 查找其内存地址，但是
** 调用后该地址中仍然有 0
谁能告诉我如何真正解决这个问题？
附带说明一下，我们实际上在 xp 嵌入式计算机上将 cdb 作为服务器运行，并使用 Windbg 的“连接到远程会话”选项。以上命令都是通过windbg执行的。
I am using windbg with xp embedded. Attempting to fetch the operating system symbols fails with the message "Symbol file could not be found. Defaulted to export symbols for ntdll.dll". (Is this typical for xp embedded???)
I have no problem locating and loading symbols and source for my own code. However stepping through the code suggests there is a severe mismatch between the code and the symbol file as the location of variables in memory as returned by dv does not appear to agree with the actual memory contents (e.g. assign a variable, but afterwards, the address that dv claims corresponds to it doesn't appears unchanged).
My sympath lists the symbol directory first, then the cache, then the server so cached symbol files shouldn't be interfering.
Is this a latent effect of not finding the ntdll symbol files and using another one that doesn't match correctly or is there something else that could be causing this?
Example:
.sympath D:/Symbols
.symfix+
.srcpath D:/Symbols ** Yes, currently the source is in with the symbols
.reload
** (defaults to export symbols for ntdll.dll since symbol file can't be found)
bp 00401000 (break at a constructor)
g
(program runs till it hits constructor)
l+t
dv /i /t /V ** look up this pointer memory location to check constructor
** We bring up a memory window at the location the this pointer refers to and
** step through the code, but no changes appear in that memory window
** moreover a local LARGE_INTEGER whose value is set with QueryPerformanceCounter
** also appears unchanged after the call
** when the constructor returns we assign the memory address returned by
** new to a global pointer, whose memory address we look up with dt, but
** after the call that address still has 0 in it
Can anyone tell me how to actually fix this?
As a side note we actually run cdb as a server on the xp embedded machine and use the "connect to remote session" option of windbg. The above commands are all executed through windbg.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在 .reload 之前执行 !sym busy 会让您知道为什么它没有找到 ntdll.dll 的符号。它们完全有可能没有在符号服务器上建立索引，这通常意味着您不走运（不幸的是，实际上没有人可以联系来解决此问题）。
至于您的其他符号问题：
1）这是您的代码的发布版本吗？如果是这样，则完全符合预期
2) 如果是调试版本，您是否 100% 确定您指向的源与目标机器匹配？在回答之前请确保你已经 100% :)
-scott
Executing !sym noisy before the .reload will let you know why it's not finding symbols for ntdll.dll. It's entirely possible that they're simply not indexed on the symbol server, which generally means you are out of luck (there really isn't anyone to contact to get this fixed unfortunately).
As for your other symbol issues:
1) Is this the release build of your code? If so, it's entirely expected
2) If it is the debug build, are you 100% sure that the source you're pointing to matches the target machine? Make sure you're 100% before answering :)
-scott