How to Verify Windows NT Debug Symbols

• Microsoft Windows NT Workstation versions 3.5 and 3.51
• Microsoft Windows NT Server versions 3.5 and 3.51

SUMMARY

The Windows NT Debug Symbols must be verified after starting the kernel debugger (I386KD.EXE | WINDBG.EXE). The debugger may load and present a prompt, but if the symbols are incorrect, future debugging commands will not reference proper functions and variables which will lead to sporadic results. Listed below are a few red flags and a couple of methods to spot check validity of the symbols.

MORE INFORMATION

This article assumes that the kernel debugger is running and has loaded a MEMORY.DMP file or is connected to a remote machine. Commands presented will not be fully documented and only exerts from the output will be shown.

Article Contents

- Loading the Kernel Debugger - Checking Creation Time with !drivers - Using LINK.EXE to Check Creation Time - Unassembling a Function - Service Pack Symbols

Loading the Kernel Debugger

A normal load of the kernel debugger will display one of the following prompts.

     kd>      Uniprocessor System
  0: kd>      Multiprocessor System

Example:

Symbol search path is: C:\symbols kd: crash dump initialized [c:\dump\memory.dmp] cound not determine the current processor, using zero Kernel Version 1057 Free loaded @ 0x80100000 Bugcheck 0000001e : c0000005 80151d5b 00000000 00000001 *** Contents Deleted *** 16kd>

When the kernel debugger loads the MEMORY.DMP file. The Kernel Version as well as the Processor Count is display in the first few lines. Confirm that processor count corresponds with the appropriate kernel and HAL. Driver symbol information is displayed as either the symbols are loaded or deferred.

Sample Load:

Symbol search path is: C:\symbols kd: crash dump initialized [c:\dump\memory.dmp] Kernel Version 1057 Free loaded @ 0x80100000 Bugcheck 0000001e : c0000005 80151d5b 00000000 00000001 re-loading all kernel symbols KD: unloading symbols for "ntoskrnl.exe" KD: deferring symbol load for "ntoskrnl.exe" at 80100000 KD: Loaded (2248) fpo entries for image (ntoskrnl.exe) KD: "ntoskrnl.exe" loaded 4074 symbols (80100000-801bbb80) KD: loaded symbols for "ntoskrnl.exe" KD: deferring symbol load for "atapi.sys" at fc810000 KD: deferring symbol load for "diskdump.sys" at fc800000 KD: deferring symbol load for "hal.dll" at 80400000 KD: deferring symbol load for "atapi.sys" at 80010000 KD: deferring symbol load for "SCSIPORT.SYS" at 80013000 KD: deferring symbol load for "Atdisk.sys" at 80001000 KD: deferring symbol load for "Scsidisk.sys" at 8001b000 KD: deferring symbol load for "Fastfat.sys" at 80372000 Unable to read image header for Floppy.SYS at fc820000 - status c0000001 *** Contents Deleted *** KD: deferring symbol load for "srv.sys" at fc9e0000 KD: deferring symbol load for "ntdll.dll" at 77f80000 finished re-loading all kernel symbols NT!_PspUnhandledExceptionInSystemThread+0x18:

80131ff8 b801000000       mov     eax,0x1

Note that the kernel debugger was "Unable to read image header for Floppy.SYS at fc820000 - status c0000001." This message is normal since the particular driver header is not currently in memory.

Checking Creation Time with !drivers

Use the !drivers command to list the drivers currently loaded in memory. Make note of the dates and times of the drivers and whether or not they could be loaded. (The Code Size and Data Size columns have been removed to fit the width of the article.)

kd> !drivers

Base       Code Size Data Size  Driver Name        Creation Time
80100000                       ntoskrnl.exe   Fri May 26 18:18:36 1995
80400000                            hal.dll   Thu May 11 13:54:18 1995
80010000                          atapi.sys   Tue May 23 21:01:41 1995
80013000                       SCSIPORT.SYS   Fri May 05 23:11:06 1995
80001000                         Atdisk.sys   Fri May 05 23:10:40 1995
8001b000                       Scsidisk.sys   Fri May 05 23:11:01 1995
80372000                        Fastfat.sys   Mon May 22 23:57:13 1995
fc820000                         Floppy.SYS   Header Paged Out
fc830000                       Scsicdrm.SYS   Wed May 10 21:57:03 1995
fc840000                         Fs_Rec.SYS   Header Paged Out
fc850000                           Null.SYS   Header Paged Out
fc860000                           Beep.SYS   Header Paged Out
fc870000                       i8042prt.SYS   Fri May 05 23:10:42 1995
fc880000                       Mouclass.SYS   Fri May 05 23:10:45 1995
fc890000                       Kbdclass.SYS   Fri May 05 23:10:44 1995
fc8b0000                       VIDEOPRT.SYS   Fri May 05 23:10:05 1995
fc8a0000                             s3.SYS   Fri May 19 21:18:06 1995
fc8c0000                            vga.sys   Fri May 05 23:10:10 1995
fc8d0000                           Msfs.SYS   Fri May 05 23:11:57 1995
fc8e0000                           Npfs.SYS   Fri May 05 23:11:40 1995
fc900000                           NDIS.SYS   Mon May 22 20:23:18 1995
fc8f0000                          el59x.sys   Fri Feb 10 16:18:09 1995
fc940000                            TDI.SYS   Fri May 05 23:13:09 1995
fc920000                            nbf.sys   Mon May 08 15:00:47 1995
fc950000                        netbios.sys   Fri May 05 23:13:19 1995
fc960000                        Parport.SYS   Header Paged Out
fc970000                       Parallel.SYS   Header Paged Out
fc980000                         Serial.SYS   Fri May 05 23:11:20 1995
fc990000                            afd.sys   Header Paged Out
fc9a0000                            rdr.sys   Wed May 17 17:18:16 1995
fc9e0000                            srv.sys   Wed May 24 21:56:59 1995
TOTAL:   1ab460 (1709 kb)  3b7c0 ( 237 kb) (    0 kb     0 kb)

Note the Creation Time of the file which is the date the file was compiled. This date will be close to the Date\Time Stamp on the actual file when viewing the WINNT\SYSTEM32\DRIVERS subdirectory using file manager.

If you subscribe to the Microsoft Developers Network (MSDN) or have the Windows NT DDK (Device Driver Kit), the LINK.EXE utility can be used to confirm that they DBG file is the same file that was created when the driver was compiled. The "time date stamp" in the example below matches the "Create Time" of netbios.sys in the output above.

1. Use LINK.EXE to check the "time date stamp" of the DBG file.

        LINK -dump -headers \symbols\sys\netbios.dbg
   

Dump of file netbios.dbg

    4944 signature
       0 flags
     14C machine (i386)
     306 characteristics

    8D0B checksum of image
   10000 base of image
    70A0 size of image

If the !drivers command produces any lines which look like the following, than an important table in the dump is corrupt. Further analysis of the dump may not be possible.

Unable to read DosHeader at 0583002a - status 00000000 Unable to read DosHeader at 0587002a - status 00000000 Unable to read DosHeader at 0588002a - status 00000000 Unable to read DosHeader at 058a002a - status 00000000 Unable to read DosHeader at 058c002a - status 00000000

Unassembling a Function

The symbol files enable the kernel debugger to reference functions and global variables by name. Spot check a couple of unassembled functions to make sure they look proper. Many functions are compiler optimized and do not necessarily conform to the examples below. Compiler optimized functions can be identified by the FPO in parenthesis in the function name.

Functions normally begin with either "push ebp" or "mov eax, fs[000000000]." Basic knowledge of machine language and experience will enable one to recognize

1. List loaded modules

        x *!
   

     x nt!*

     u NT!_NtUnlockFile

Good Symbols

80156bd8 64a100000000     mov     eax,fs:[00000000]
80156bde 55               push    ebp
80156bdf 8bec             mov     ebp,esp
80156be1 6aff             push    0xff
80156be3 68200d1080       push    0x80100d20
80156be8 68304f1380       push    0x80134f30
80156bed 50               push    eax
80156bee 64892500000000   mov     fs:[00000000],esp

The unassembly of the function should look similar to the text above; however, the unassembly is subject to change. If the unassembly looks proper, we can assume that the symbols have loaded properly for this module.

The following unassembly begins with "jnz NT!_NTUnlockFile+0x22." Obviously, the beginning of a function would not start with a jump instruction code. Check the symbol tree once again.

Bad Symbols

801574a4 7520             jnz     NT!_NtUnlockFile+0x22 (801574c6)
801574a6 6a00             push    0x0
801574a8 8d45dc           lea     eax,[ebp-0x24]
801574ab 50               push    eax
801574ac 53               push    ebx
801574ad ff356c361480     push    dword ptr [NT!_CcNoDelay+0x4 (8014366c)]
801574b3 6a01             push    0x1
801574b5 ff7508           push    dword ptr [ebp+0x8]

Service Pack Symbols

There are times when it is difficult to match the symbols with a particular installation. At some point in time, a service could have been added which required copying files from the Windows NT Installation CD-ROM which copied over files which were updated with a Service Pack. Be sure to reapply the Service Pack and any 3rd Party Support Disks after changing system setup which copies files from the Windows NT Installation CD-ROM. The symbols should be applied in the same order as the installation.

ADDITIONAL INFORMATION

The Kernel Debug How To series of article can be found by searching on the keyword: debugref.