You need to be connected to the internet and setup your Symbol File Path in windbg:
Mine is set to:so downloaded symbols are stored in D:\Symbols the first time they are downloaded, but you need the connection to the symbol server.Code:SRV*D:\Symbols*https://msdl.microsoft.com/download/symbols
Ive reinstalled windbg, set it up as per the instructions but its still giving me:
Unable to open image file: C:\Symbols\ntoskrnl.exe\521EA0355e5000\ntoskrnl.exe
The system cannot find the path specified.
many times, then when its finished it says:
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.wrong.symbols.exe ( nt_wrong_symbols!521EA0355E5000 )
Followup: MachineOwner
HELP!!
Zip up the dump you are working with and upload here so I can try it.
Actually, why don't you run the Beta log collector and upload the zip file it produces. That may yield some additional info to help. Is the dump you are trying to look at in C:\Windows\Minidump? If so it will be included in the dump. If not zip and upload it separ4ately.
Its about 400mb and its not mine so I wouldn't feel comfortable uploading it. It was on an SD card, I booted into a different partition (win 7) and checked eventvwr which reported one of the drives had NTFS issues and needed to be scanned. I'd had this error in win 10 on all drives before I flashed the BIOS. With it still reporting the issue I've decided to bin the motherboard and start again. I would like to getiwindbg running properly though for future problem solving.
Try running WinDBG as Administrator to set the Symbol path. ZTruker has his set to create the Symbols folder to D:/Symbols.
Windbg can be run with a database on the computer or using the live Microsoft database.
The later method is slower but more up to date.
See if you can download and install Windbg 1.0.1812.12001
I've been having a problem looking at any dump so I reloaded the most recent developer kit. Followed the instructions carefully but still I'm not getting the full expected output listed in Golden tutorial when you run the test dump.
The box with the initial bugcheck is missing.
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Maximus\Downloads\test\050114-17253-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:Kernel base = 0xfffff800`02a53000 PsLoadedModuleList = 0xfffff800`02c966d0
Debug session time: Thu May 1 22:07:27.580 2014 (UTC - 4:00)\
System Uptime: 0 days 0:04:04.718
Loading Kernel Symbols
.................................................................................................... ...........................................................
Loading User Symbols
Loading unloaded module list
.....
For analysis of this file, run !analyze -v
When I run against a dump in forum I get this
************* Symbol Loading Error Summary **************
Module name Error
ntoskrnl The system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
For analysis of this file, run !analyze -v
This is what I was getting before the reload. I checked tutorial again but I can't see the trees for the forest.
Thanks
Open another dump and results were better but still did not get what I will call the quick analysis box. Copied from tutorial so people will understand what I'm referencing.
There are two main options for symbols:
a) store on the computer
b) use the live Microsoft database
Windbg preview is not in the tutorial.
See if you can download and install: Windbg preview
https://docs.microsoft.com/en-us/win...download-tools
If the dump came from a zip file, look at it in the zip file, don't extract it first. For some strange reason, this works.
Double click on the zip file or right click on it, slide down to 7-zip then select Open archive.
Navigate like you would if in File Explorer, to Crash Dumps folder.
Double click on any dump. it should launch in windbg like it normally does, only symbol resolution works.
If you have a dump and symbol files won't resolve, zip it then look at the dump in the zip file, Works correctly now and symbol file resolution works as it should.
Quote
