Unable to load image ntoskrnl.exe的问题

最近在分析一个蓝屏dump时发现，nt模块加载不了符号表，其他系统驱动的符号表都能加载成功

3: kd> .reload /f nt
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

激活详细符号加载信息

3: kd> !sym noisy
noisy mode - symbol prompts on
3: kd> .reload /f nt
SYMSRV:  d:\mysymbol\ntoskrnl.exe\56BCC7865ec000\ntoskrnl.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/56BCC7865ec000/ntoskrnl.exe not found
SYMSRV:  d:\mysymbol\ntkrnlup.exe\56BCC7865ec000\ntkrnlup.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlup.exe/56BCC7865ec000/ntkrnlup.exe not found
SYMSRV:  d:\mysymbol\ntkrnlpa.exe\56BCC7865ec000\ntkrnlpa.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlpa.exe/56BCC7865ec000/ntkrnlpa.exe not found
SYMSRV:  d:\mysymbol\ntkrnlmp.exe\56BCC7865ec000\ntkrnlmp.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/56BCC7865ec000/ntkrnlmp.exe not found
SYMSRV:  d:\mysymbol\ntkrpamp.exe\56BCC7865ec000\ntkrpamp.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrpamp.exe/56BCC7865ec000/ntkrpamp.exe not found
DBGHELP: C:\Program Files (x86)\Debugging Tools for Windows (x86)\ntoskrnl.exe - file not found
DBGHELP: C:\Program Files (x86)\Debugging Tools for Windows (x86)\ntkrnlup.exe - file not found
DBGHELP: C:\Program Files (x86)\Debugging Tools for Windows (x86)\ntkrnlpa.exe - file not found
DBGHELP: C:\Program Files (x86)\Debugging Tools for Windows (x86)\ntkrnlmp.exe - file not found
DBGHELP: C:\Program Files (x86)\Debugging Tools for Windows (x86)\ntkrpamp.exe - file not found
SYMSRV:  D:\mysymbol\ntoskrnl.exe\56BCC7865ec000\ntoskrnl.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/56BCC7865ec000/ntoskrnl.exe not found
SYMSRV:  D:\mysymbol\ntkrnlup.exe\56BCC7865ec000\ntkrnlup.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlup.exe/56BCC7865ec000/ntkrnlup.exe not found
SYMSRV:  D:\mysymbol\ntkrnlpa.exe\56BCC7865ec000\ntkrnlpa.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlpa.exe/56BCC7865ec000/ntkrnlpa.exe not found
SYMSRV:  D:\mysymbol\ntkrnlmp.exe\56BCC7865ec000\ntkrnlmp.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/56BCC7865ec000/ntkrnlmp.exe not found
SYMSRV:  D:\mysymbol\ntkrpamp.exe\56BCC7865ec000\ntkrpamp.exe not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrpamp.exe/56BCC7865ec000/ntkrpamp.exe not found
DBGENG:  ntoskrnl.exe - Image mapping disallowed by non-local path.
Unable to load image ntoskrnl.exe, Win32 error 0n2
DBGENG:  ntoskrnl.exe - Partial symbol image load missing image info
DBGHELP: No header for ntoskrnl.exe.  Searching for dbg file
DBGHELP: .\ntoskrnl.dbg - file not found
DBGHELP: .\exe\ntoskrnl.dbg - path not found
DBGHELP: .\symbols\exe\ntoskrnl.dbg - path not found
DBGHELP: ntoskrnl.exe missing debug info.  Searching for pdb anyway
DBGHELP: Can't use symbol server for ntoskrnl.pdb - no header information available
DBGHELP: ntoskrnl.pdb - file not found
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
DBGHELP: nt - no symbols loaded

但是提取对方电脑上的ntoskrnl.exe用IDA分析，发现可以正确加载到符号表，于是我将提取到的ntoskrnl.exe放到windbg要找到的路径上去例如：

SYMSRV:  d:\mysymbol\ntoskrnl.exe\56BCC7865ec000\ntoskrnl.exe not found

结果这次终于正常加载上了

3: kd> .reload /f nt
DBGHELP: d:\mysymbol\ntoskrnl.exe\56BCC7865ec000\ntoskrnl.exe - OK
DBGENG:  d:\mysymbol\ntoskrnl.exe\56BCC7865ec000\ntoskrnl.exe - Mapped image memory
DBGHELP: nt - public symbols  d:\mysymbol\ntkrnlmp.pdb\D7EA2B6682984A0E8697620F5571B7BF2\ntkrnlmp.pdb

转载于:https://www.cnblogs.com/Potato-Eater/p/7611916.html

Unable to load image ntoskrnl.exe的问题相关推荐

ibm服务器安装2008系统蓝屏,WIN sever 2008 R2 64位系统 ntoskrnl.exe 蓝屏求解决方案
服务器不明原因重启,已排除软件安装, Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft ...
cmd运行php文件以及环境配置出现的问题、 php.exe不是内部或外部命令,也不是可运行的程序或批处理文件、PHP startup: Unable to load dynamic library
我用php.exe远行php文件出现了几个问题,先说一下怎么解决这些问题的,然后再说怎么运行首先是出现 'php.exe' 不是内部或外部命令,也不是可运行的程序或批处理文件,查了一下,是没有配置 ...
ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Loading Kernel Symbols
电脑蓝屏问题ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Loading Kernel S ...
至强服务器装2003系统蓝屏,Windows Server 2008 R2 ntoskrnl.exe 引起蓝屏故障，重新启动...
前不久在HP ProLiant DL360 G6的服务器上面安装了Windows Server 2008 R2,系统一到晚上凌晨就出现蓝屏.重启现象,并且在 C:\Windows\Minidump 目 ...
Unable to load print control in ReportingService
低版本出现报表无法打印的问题(客户端无法加载打印控件) SP2地址: http://www.microsoft.com/downloads/details.aspx?displaylang=zh-cn ...
wireshark/The NPF driver isn’t running./Unable to load WinPcap (wpcap.dll)
很久没使用wireshark后重新打开就出现警告: The NPF driver isn't running. You may have trouble capturing or listing in ...
java.lang.UnsatisfiedLinkError: Unable to load library ‘D:\dll\DwgOperInterface‘: 找不到指定的模块
执行代码 import com.sun.jna.Library; import com.sun.jna.Native; import com.sun.jna.ptr.IntByReference;pu ...
关于pycharm报错：Fatal Python error: Py_Initialize: unable to load the file system codec的解决
先上pycharm报错: Fatal Python error: Py_Initialize: unable to load the file system codec ModuleNotFoundE ...
Unable to load dll 应用程序配置不正确，程序无法启动的解决方法
现象:需要的dll已经存在,但就是找不到.提示信息例如: Unable to load dll 应用程序配置不正确,程序无法启动解决方法:安装Microsoft Visual C++ 2005 S ...

Unable to load image ntoskrnl.exe的问题

Unable to load image ntoskrnl.exe的问题相关推荐

最新文章

热门文章