ntdll 模块在windbg 中没有正确加载，但是为什么呢？

Question

我以前使用过 windbg 进行用户模式调试，但我怀疑我对我的系统做了一些事情，因为我不记得之前使用扩展命令 !heap 时遇到过问题。

我可以清楚地看到ntdll是一个加载的模块：

77760000 778e0000   ntdll      (pdb symbols)          C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb

0:001> lmvm ntdll
start    end        module name
77760000 778e0000   ntdll      (pdb symbols)          C:\Program Files     (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb    \FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb
    Loaded symbol image file: C:\Windows\SysWOW64\ntdll.dll
    Image path: C:\Windows\SysWOW64\ntdll.dll
    Image name: ntdll.dll
    Timestamp:        Wed Jul 15 13:53:36 2015 (55A69E20)
    CheckSum:         00142A8B
    ImageSize:        00180000
    File version:     6.1.7601.18933
    Product version:  6.1.7601.18933
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntdll.dll
    OriginalFilename: ntdll.dll
    ProductVersion:   6.1.7601.18933
    FileVersion:      6.1.7601.18933 (win7sp1_gdr.150715-0600)
    FileDescription:  NT Layer DLL
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

和

0:001> !chksym ntdll

C:\Windows\SysWOW64\ntdll.dll
    Timestamp: 55A69E20
  SizeOfImage: 180000
          pdb: wntdll.pdb
      pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97
          age: 2

Loaded pdb is C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\sym\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb

wntdll.pdb
      pdb sig: FA9C48F9-C11D-4E08-94B8-970DECD92C97
          age: 2

MATCH: wntdll.pdb and C:\Windows\SysWOW64\ntdll.dll<code>

当我尝试使用我的堆扩展时，我得到：

0:001> !heap -stat
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***

.symopt- 100 也无济于事

如果我尝试使用临界区扩展，我会收到类似的错误：

Bad symbols for NTDLL (error 3). Aborting.

我了解到，如果您的 32 位和 64 位不匹配，或者您根本没有正确设置符号，但我使用了 .symfix 并且可以强制我的符号重新加载，则可能会发生这种情况对于 .reload /f，我在 x86 进程或 32 位转储上使用 x86 调试器，所以我看不出这些问题是如何发生的。

我重新开始并完全卸载了windbg，并从MSDN重新安装了Windows调试工具，但仍然遇到同样的问题。我肯定遗漏了一些明显的东西吗？

Answer 1

MS 正在删除最新的 Windows 7 PDB 中的所有类型信息。这打破了!heap。这是由“Windows Internals, Sixth Edition”的合著者 Alex Ionescu 发起的关于它的 Twitter 对话：https://twitter.com/aionescu/status/634028737458114560

更新：2015 年 10 月 12 日：使用 PDB Type Theft python 脚本的可能解决方法，该脚本将类型信息从一个 PDB 复制到另一个 PDB。用法是从较旧的 PDB 复制类型信息，该 PDB 具有在以后的 PDB 中删除的类型信息。此链接包含所有详细信息：http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/PDB-Type-Theft/ba-p/6801065#.Vhv2gPm6fmE

更新：2015 年 10 月 22 日：随着 Microsoft 补丁日 (2015-10-13) 和 KB3088195，符号再次可用。但是，没有提供损坏版本的符号，所以上面可能仍然有用。

Answer 2

似乎随着20151013 上分发的 Windows 更新，堆信息再次可用。

0:018> !chksym ntdll

C:\Windows\SysWOW64\ntdll.dll
Timestamp: 56099FFA
SizeOfImage: 180000
      pdb: wntdll.pdb
  pdb sig: C2B37FDB-B631-4EA7-8A6D-7F51123F151E
      age: 2

Loaded pdb is microsoft\wntdll.pdb   \C2B37FDBB6314EA78A6D7F51123F151E2\wntdll.pdb

wntdll.pdb
  pdb sig: C2B37FDB-B631-4EA7-8A6D-7F51123F151E
      age: 2

MATCH: wntdll.pdb and C:\Windows\SysWOW64\ntdll.dll

和

0:018> lm v m *ntdll*
start    end        module name
77530000 776b0000   ntdll      (pdb symbols)        microsoft\wntdll.pdb\C2B37FDBB6314EA78A6D7F51123F151E2\wntdll.pdb
Loaded symbol image file: C:\Windows\SysWOW64\ntdll.dll
Image path: C:\Windows\SysWOW64\ntdll.dll
Image name: ntdll.dll
Timestamp:        Mon Sep 28 22:15:54 2015 (56099FFA)
CheckSum:         001412F8
ImageSize:        00180000
File version:     6.1.7601.23223
Product version:  6.1.7601.23223
File flags:       0 (Mask 3F)
File OS:          40004 NT Win32
File type:        2.0 Dll
File date:        00000000.00000000
Translations:     0409.04b0
CompanyName:      Microsoft Corporation
ProductName:      Microsoft® Windows® Operating System
InternalName:     ntdll.dll
OriginalFilename: ntdll.dll
ProductVersion:   6.1.7601.23223
FileVersion:      6.1.7601.23223 (win7sp1_ldr.150928-0600)
FileDescription:  NT Layer DLL
LegalCopyright:   © Microsoft Corporation. All rights reserved.

您可以安装更新、重建您的应用程序并重试吗？