PRB: Debugger Reports "WARNING: symbols checksum is wrong"

ID: Q148220

The information in this article applies to:

Microsoft Win32 Software Development Kit (SDK), used with:
- Microsoft Windows NT, versions 3.51, 4.00

SYMPTOMS

When debugging a Win32 application on the uniprocessor version of Windows NT, WinDbg displays warning messages that say:

*** WARNING: symbols checksum is wrong 0x0005e382 0x00062261 for D:\WINNT\symbols\dll\NTDLL.DBG.

The actual path for Ntdll.dbg will vary depending on where Windows NT is installed on your system. This warning may be generated for symbol files of other system files such as Kernel32.dll also.

CAUSE

WinDbg verifies that the checksum of the DLL matches the checksum stored in the corresponding debugging symbol (.dbg) file to warn you when your debugging symbols don't match the modules being debugged. If the symbols truly are mismatched, then WinDbg will show incorrect function names when you obtain stack traces and set breakpoints.

During installation, Windows NT runs with the multiprocessing kernel and system files. At the end of the installation procedure on uniprocessor Intel x86 machines, the setup program modifies the kernel and other system files to remove spin lock code needed only on multiprocessor systems.

Because the debugging symbol files were created with the multiprocessing system files, this modification causes the checksums of system files to differ from the checksums in the debugging symbol files. It does not change the file size of the system DLLs, any system code, or the addresses of system entry points. The symbol files are still correct, but because the checksums differ, WinDbg reports a warning.

RESOLUTION

The warning describes a benign condition, so you may safely ignore it.

STATUS

This behavior is by design.

Additional query words: 4.00 3.51 KERNEL32

Keywords : TlsWindbg
Version : 3.51 4.00
Platform : NT WINDOWS
Issue type :