Couldn't resolve error at 'ntdll!NtOpenProcess'

参考文章：

http://wingbao.blogbus.com/logs/28757738.html

http://blog.sina.com.cn/s/blog_a3e571160101iois.html

------------------------------------------------------------------------------------------------------------

刚开始用Windbg，看到网上有人敲如下命令：

u ntdll!NtOpenProcess

我照敲之后得到如下错误：

Couldn't resolve error at 'ntdll!NtOpenProcess'

------------------------------------------------------------------------------

错误原因：

从参考文章中得知是因为ntdll.dll属于应用层，windbg在调试内核时没有加载应用层的符号表文件，

因此也就有了错误：Couldn't resolve error at 'ntdll!NtOpenProcess'

还有种可能的原因就是Windbg的符号表路径没有设置正确。

-----------------------------------------------------------------------------------------------------

解放方法：

知道了错误原因，解决就简单了，让Windbg调试应用层的程序，然后我们重新载人符号表即可。

首先在虚拟机中打开应用层程序，记事本程序notepad.exe，然后按如下步骤做即可：

kd> !process 0 0 notepad.exe // 查看进程notepad.exe信息
PROCESS 81ff0020 SessionId: 0 Cid: 01c4 Peb: 7ffde000 ParentCid: 05dc
DirBase: 04b002a0 ObjectTable: e1a68528 HandleCount: 44.
Image: notepad.exe

kd> .process /p 81ff0020 // 讲调试进程切换为notepad.exe
Implicit process is now 81ff0020
.cache forcedecodeuser done
kd> .reload // 重新载人符号表
Connected to Windows XP 2600 x86 compatible target at (Sun Jun 28 19:49:44.283 2015 (UTC + 8:00)), ptr64 FALSE
DBGHELP: nt - public symbols
d:\winddk\symbols_ms\ntkrnlpa.pdb\D8AAE42A2C254CF0A6DECF483D44477A1\ntkrnlpa.pdb
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
............................
Loading unloaded module list
....................
SYMSRV: ntdll.dll from http://msdl.microsoft.com/download/symbols: 281828 bytes - copied
DBGHELP: d:\winddk\symbols_ms\ntdll.dll\4D00F28096000\ntdll.dll - OK
DBGENG: Partial symbol load found image d:\winddk\symbols_ms\ntdll.dll\4D00F28096000\ntdll.dll.
SYMSRV: ntdll.pdb from http://msdl.microsoft.com/download/symbols: 333688 bytes - copied
DBGHELP: ntdll - public symbols
d:\winddk\symbols_ms\ntdll.pdb\CEFC0863B1F84130A11E0F54180CD21A2\ntdll.pdb

kd> u ntdll!NtOpenProcess // 再次执行我们的命令，这下正常了吧
ntdll!NtOpenProcess:
7c92d5fe b87a000000 mov eax,7Ah
7c92d603 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d608 ff12 call dword ptr [edx]
7c92d60a c21000 ret 10h
7c92d60d 90 nop
ntdll!NtOpenProcessToken:
7c92d60e b87b000000 mov eax,7Bh
7c92d613 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d618 ff12 call dword ptr [edx]

Couldn't resolve error at 'ntdll!NtOpenProcess'相关推荐

Resolve error: unable to load resolver node src\main.js:1:1
✘ https://google.com/#q=import%2Fno-duplicates Resolve error: unable to load resolver "node&quo ...
How to resolve error message CRM_PRODUCT_SALES-E016 during product download
Created by Jerry Wang, last modified on Dec 18, 2014 该error message是在如下check FM里报出: 在line 66的table s ...
How to resolve error message Malformed URI literal syntax
在消费SAP Marketing Cloud API时,遇到如下错误: 解决方案是在发起http请求的头部添加content-type字段,类型为multipart/mixed: 要获取更多Jerry ...
how to resolve error message java.lang.ClassNotFoundException: org.springframework
Created by Wang, Jerry, last modified on Jul 23, 2016 solution: http://forum.spring.io/forum/spring- ...
WinDbg下载符号文件
文章目录一.符号文件的用处二.下载符号文件(微软官方符号服务器无法访问) 三.加载用户层的符号文件参考资料一.符号文件的用处符号文件即PBD(Program Debug DataBase)文 ...
ntdll.dll和ntoskrnl.exe中的NT*和ZW*函数区别
以NtOpenProcess和ZwOpenProcess为例,结合Windbg的lkd调试来说明 1.Q:ntdll.dll中的Nt*和Zw*区别? lkd> u ntdll!zwopenpro ...
“Error 1923 occurs when you try to update Adobe Acrobat DC or Acrobat Reader DC” 的解决办法
在尝试更新或者安装Adobe Acrobat DC或Acrobat Reader DC时,可能会遇到一个错误:"Error 1923: Service Adobe Acrobat Updat ...
资料整理——Oracle数据库错误消息列表（Database Error Messages）
问题: Oracle数据库中大概有多少条error message? 解答: 根据对Oracle官网资料(https://docs.oracle.com/cd/E11882_01/server.112 ...
windbg基本简单步骤
源码 #include <stdio.h> #include <string> typedef struct _st{ int a; int b; }ST; int fun(i ...

Couldn't resolve error at 'ntdll!NtOpenProcess'

Couldn't resolve error at 'ntdll!NtOpenProcess'相关推荐

最新文章

热门文章