Re: Child display driver ... adding PnP crashes!

Hello Maxim

Before I begin with your procedure, I should let you know that I am
trying .symfix, but this is what the debugger shows and then there is
no response

kd> .symfix D:/symbols
Symbol search path is:
SRV*D:/symbols*http://msdl.microsoft.com/download/symbols

So I had manually stored the symbols into my system. Now I am using the
graphical version of winDbg. So when I set the symbol path to the place
where I have downloaded the symbols, and then say lm, I get this

kd> lm
start end module name
804d7000 806fd000 nt (export symbols) ntkrnlmp.exe
806fd000 8071dd00 hal (deferred)
bf800000 bf9c1180 win32k (deferred)
bf9c2000 bf9d3580 dxg (deferred)
bf9d4000 bf9e1000 ialmrnt5 (deferred)
bf9e1000 bfa03000 ialmdnt5 (deferred)
bfa03000 bfa30e00 ialmdev5 (deferred)
bfa31000 bfaa7000 ialmdd5 (deferred)
ed1ad000 ed1d6f00 kmixer (deferred)
ed1d7000 ed1f1000 EraserUtilDrv10614 (deferred)
ed473000 ed484980 naveng (deferred)
ed485000 ed546b40 navex15 (deferred)
ed547000 ed59c000 savrt (deferred)
ed7f4000 ed834100 HTTP (deferred)
eddf5000 eddf7f60 SYMREDRV (deferred)
ee071000 ee074600 prepdrv (deferred)
ee3ca000 ee3de400 wdmaud (deferred)
ee597000 ee5e8300 srv (deferred)
ee619000 ee627d80 sysaudio (deferred)
ee799000 ee79cca0 multiice (deferred)
ee7a1000 ee7cd400 mrxdav (deferred)
ee7ce000 ee81e400 mvfs50 (deferred)
eeb33000 eeb36280 ndisuio (deferred)
eec2f000 eec46480 dump_atapi (deferred)
eec47000 eec99000 eeCtrl (deferred)
eecc1000 eed2f400 mrxsmb (deferred)
eed30000 eed5aa00 rdbss (deferred)
eed5b000 eed6f000 Savrtpel (deferred)
eed6f000 eed90d00 afd (deferred)
eed91000 eedb8c00 netbt (deferred)
eedb9000 eedd5be0 SYMEVENT (deferred)
eedd6000 eee15ce0 SYMTDI (deferred)
eee16000 eee6dd80 tcpip (deferred)
eee6e000 eee80400 ipsec (deferred)
eeea5000 eeea7900 Dxapi (deferred)
eef69000 eef84b60 ialmsbw (deferred)
eef85000 eef983a0 ialmkchw (deferred)
f7041000 f7074200 update (deferred)
f7075000 f70a5100 rdpdr (deferred)
f70a6000 f70b6e00 psched (deferred)
f70b7000 f70cd680 ndiswan (deferred)
f70ce000 f70f1980 portcls (deferred)
f70f2000 f717fd80 smwdm (deferred)
f71af000 f71d1680 ks (deferred)
f71d2000 f71e5900 parport (deferred)
f71e6000 f7209800 e100b325 (deferred)
f720a000 f722ce80 USBPORT (deferred)
f722d000 f72432e0 ialmnt5 (deferred)
f7244000 f7257780 VIDEOPRT (deferred)
f725c000 f725fc80 mssmbios (deferred)
f7278000 f727a580 ndistapi (deferred)
f72b1000 f72cb580 Mup (deferred)
f72cc000 f72f8a80 NDIS (deferred)
f72f9000 f7385480 Ntfs (deferred)
f7386000 f739c780 KSecDD (deferred)
f739d000 f73bb780 fltmgr (deferred)
f73bc000 f73d3480 atapi (deferred)
f73d4000 f73f9700 dmio (deferred)
f73fa000 f7418880 ftdisk (deferred)
f7419000 f7436480 pcmcia (deferred)
f7437000 f7447a80 pci (deferred)
f7448000 f7475d80 ACPI (deferred)
f7497000 f749fc00 isapnp (deferred)
f74a7000 f74b1500 MountMgr (deferred)
f74b7000 f74c3c80 VolSnap (deferred)
f74c7000 f74cfe00 disk (deferred)
f74d7000 f74e3200 CLASSPNP (deferred)
f74e7000 f74f0c80 FileHook (deferred)
f7517000 f751fd00 intelppm (deferred)
f7527000 f7533e00 i8042prt (deferred)
f7537000 f7543180 cdrom (deferred)
f7547000 f7555080 redbook (deferred)
f7557000 f7565b80 drmk (deferred)
f7567000 f7573880 rasl2tp (deferred)
f7577000 f7581200 raspppoe (deferred)
f7587000 f7592d00 raspptp (deferred)
f7597000 f759f900 msgpc (deferred)
f75c7000 f75d0f00 termdd (deferred)
f75d7000 f75e0480 NDProxy (deferred)
f7607000 f7615100 usbhub (deferred)
f7617000 f761f700 netbios (deferred)
f7667000 f766f880 Fips (deferred)
f7677000 f767f700 wanarp (deferred)
f7687000 f768fd80 HIDCLASS (deferred)
f76e7000 f76f6900 Cdfs (deferred)
f7717000 f771d200 PCIIDEX (deferred)
f771f000 f77230e0 winroute (deferred)
f7727000 f772b900 PartMgr (deferred)
f77af000 f77b3500 watchdog (deferred)
f77f7000 f77fd000 kbdclass (deferred)
f77ff000 f7804a00 mouclass (deferred)
f7807000 f780c000 usbuhci (deferred)
f780f000 f7815800 usbehci (deferred)
f7817000 f781e000 GEARAspiWDM (deferred)
f781f000 f7823880 TDI (deferred)
f7827000 f782b580 ptilink (deferred)
f782f000 f7833080 raspti (deferred)
f783f000 f7845180 HIDPARSE (deferred)
f7847000 f784c200 vga (deferred)
f784f000 f7853a80 Msfs (deferred)
f7857000 f785e880 Npfs (deferred)
f785f000 f7863100 safandrv (deferred)
f7867000 f786ef80 SFRes (deferred)
f7897000 f789e000 KernelWDC_I2C (no symbols)
f78a7000 f78aa000 BOOTVID (deferred)
f7953000 f7955280 rasacd (deferred)
f7957000 f795ac80 SFReg (deferred)
f796b000 f796e240 OMCI (deferred)
f797b000 f797d580 hidusb (deferred)
f797f000 f7981f80 mouhid (deferred)
f7997000 f7998b80 kdcom (deferred)
f7999000 f799a100 WMILIB (deferred)
f799b000 f799c700 dmload (deferred)
f79af000 f79b0a80 ParVdm (deferred)
f79eb000 f79ec100 dump_WMILIB (deferred)
f79f3000 f79f4300 kbstuff5 (deferred)
f79f5000 f79f6180 SFkbd (deferred)
f79f7000 f79f8280 SFMouse (deferred)
f79f9000 f79faa00 SFScsi (deferred)
f79fb000 f79fc120 aeaudio (deferred)
f79ff000 f7a00100 swenum (deferred)
f7a01000 f7a02280 USBD (deferred)
f7a03000 f7a04f00 Fs_Rec (deferred)
f7a05000 f7a06080 Beep (deferred)
f7a07000 f7a08080 mnmdd (deferred)
f7a09000 f7a0a080 RDPCDD (deferred)
f7a5f000 f7a5fd00 pciide (deferred)
f7a82000 f7a82840 idisw2km (deferred)
f7a93000 f7a93c00 audstub (deferred)
f7aaa000 f7aaad00 dxgthk (deferred)
f7ae6000 f7ae6a00 mc21 (deferred)
f7bb6000 f7bb6b80 Null (deferred)

Unloaded modules:
ed1ad000 ed1d7000 kmixer.sys
ed1ad000 ed1d7000 kmixer.sys
ed1ad000 ed1d7000 kmixer.sys
ed1f1000 ed21b000 kmixer.sys
ee37d000 ee3a7000 kmixer.sys
f7b89000 f7b8a000 drmkaud.sys
ee4d7000 ee4e4000 DMusic.sys
ee4e7000 ee4f5000 swmidi.sys
ee3a7000 ee3ca000 aec.sys
f79bd000 f79bf000 splitter.sys
ed473000 ed485000 naveng.sys
ed485000 ed547000 navex15.sys
ed473000 ed485000 naveng.sys
ed485000 ed547000 navex15.sys
f7657000 f7662000 imapi.sys
f7637000 f7640000 processr.sys
f7627000 f7637000 serial.sys
f794f000 f7953000 kbdhid.sys
f7837000 f783c000 Cdaudio.SYS
f794b000 f794e000 Sfloppy.SYS

Clearly indiacting that my kernel symbols have not been loaded. Why
does symfix not work for me? Do I need to upgrade WinDbg ( Current
version 6.3.003.3)

Thanks
Abhishek


Maxim S. Shatskih wrote:
.symfix is used this way:

- create a temporary directory for a cache, where the downloaded symbol
files will be put. Note: if you are analyzing the dump, the OS binaries
(NTOSKRNL and others) are also downloaded from the Symbol Server.
- then:
.symfix ThisCacheDirectory
- then
lm
to look at loaded modules and their symbol status.
- if the symbol status for some module is wrong ("no symbols" or "export
symbols"), then
.reload modulename.sys
or
.reload nt
for the kernel itself
- to check that the symbols are loaded OK, use:
x ModuleName!*
it must dump all functions from the module and their addresses.

Now about your driver symbols:
- create one more temporary directory for symbols.
- on each rebuild, copy the SYS/DBG/PDB files of your driver there.
- after .symfix, add it to the symbol path of the debugger before the
Symbol Server's path - either using File/Symbol File Path, or using:
.sympath + NewDir
- then do the same - first try:
x DriverName!*
if this has issues, say:
lm
and look at symbol load status of your driver.

".sym noisy" turns on the tracing for symbol loading. Can be helpful. Also
note - you can save a workspace after setting up the symbol path, and then will
not need to ever print ".symfix" or ".sympath +."

Note: the symbol files are monopolistically locked by the debugger - I
think it maps them to memory. So, do not try to load your driver's symbols from
the build target path itself - you will not be able to rebuild with the
debugger running.

To unload the symbols from the debugger:
- reboot the target using the Windows features on the target or using
".reboot" from the debugger, NOT using the target's Reset switch on the front
panel. This forces the debugger to unload all symbols.
OR
- .reload /u ModuleName.sys
OR
- close the debugger at all and reopen it :-)

Usually, my sequence of driver rebuild is:
- build -c
- arrow-up+Enter in the command line, this invokes the "copy" command of
SYS file to the target using SMB
- reboot the target using its UI
- wait for WinDbg to say "Unloaded all symbol tables" on target reboot
- arrow-up+Enter in the command line, this invokes the "copy" command of
the symbols to the WinDbg's temporary symbol directory. This can be done fast
enough so the target's kernel will not load yet.

With such an approach, I have no issues with source files too. The source
file full pathnames are embedded to the PDB file, so, with checked build, no
problems at all. The only problem which was in the old WinDbg version was the
nasty collision between 2 source files with the same short name, but in
different build dirs (like "dir1\internal.c" and "dir2\internal.c").

With all of these, I never had any WinDbg symbol issues for years.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@xxxxxxxxxxxxxxxx
http://www.storagecraft.com

.

Relevant Pages

  • Re: Child display driver ... adding PnP crashes!
    ... Try the `!sym noisy' command and then the `.reload nt' command and posting ... but this is what the debugger shows and then there is ... copy the SYS/DBG/PDB files of your driver there. ... the build target path itself - you will not be able to rebuild with the ...
    (microsoft.public.development.device.drivers)
  • Re: Child display driver ... adding PnP crashes!
    ... create one more temporary directory for symbols. ... copy the SYS/DBG/PDB files of your driver there. ... the symbol files are monopolistically locked by the debugger - I ... the build target path itself - you will not be able to rebuild with the ...
    (microsoft.public.development.device.drivers)
  • Re: Problem attaching WinDbg to target after WDK7600 upgrade
    ... version of the debugger all the way back to 6.6.3.5 with no success. ... My target host controller is banged out with a code 31 as was the case ... you may need to disable the 1394 host ... Checking 1394 debug driver version. ...
    (microsoft.public.development.device.drivers)
  • Enabling busenum.dll makes application exit difficult
    ... by disabling touch driver and spi driver. ... PB Debugger Kernel debugger connected. ... FILESYS: Waiting for kernel to be ready to launch apps ... !AFD: ...
    (microsoft.public.windowsce.platbuilder)
  • Re: CTooltipCtrl with custom paint causing SYSTEM CRASH!!!!!
    ... you probably have a bad driver. ... you might have found a bug in the kernel. ... If you copy the output from!analyze -v and post it here, I'll take a stab at analyzing ... If the kernel debugger is connected and running when watchdog detects ...
    (microsoft.public.vc.mfc)