参考文章:
http://wingbao.blogbus.com/logs/28757738.html
http://blog.sina.com.cn/s/blog_a3e571160101iois.html
------------------------------------------------------------------------------------------------------------
刚开始用Windbg,看到网上有人敲如下命令:
u ntdll!NtOpenProcess
我照敲之后得到如下错误:
Couldn't resolve error at 'ntdll!NtOpenProcess'
------------------------------------------------------------------------------
错误原因:
从参考文章中得知是因为ntdll.dll属于应用层,windbg在调试内核时没有加载应用层的符号表文件,
因此也就有了错误:Couldn't resolve error at 'ntdll!NtOpenProcess'
还有种可能的原因就是Windbg的符号表路径没有设置正确。
-----------------------------------------------------------------------------------------------------
解放方法:
知道了错误原因,解决就简单了,让Windbg调试应用层的程序,然后我们重新载人符号表即可。
首先在虚拟机中打开应用层程序,记事本程序notepad.exe,然后按如下步骤做即可:
kd> !process 0 0 notepad.exe // 查看进程notepad.exe信息
PROCESS 81ff0020 SessionId: 0 Cid: 01c4 Peb: 7ffde000 ParentCid: 05dc
DirBase: 04b002a0 ObjectTable: e1a68528 HandleCount: 44.
Image: notepad.exe
kd> .process /p 81ff0020 // 讲调试进程切换为notepad.exe
Implicit process is now 81ff0020
.cache forcedecodeuser done
kd> .reload // 重新载人符号表
Connected to Windows XP 2600 x86 compatible target at (Sun Jun 28 19:49:44.283 2015 (UTC + 8:00)), ptr64 FALSE
DBGHELP: nt - public symbols
d:\winddk\symbols_ms\ntkrnlpa.pdb\D8AAE42A2C254CF0A6DECF483D44477A1\ntkrnlpa.pdb
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
............................
Loading unloaded module list
....................
SYMSRV: ntdll.dll from http://msdl.microsoft.com/download/symbols: 281828 bytes - copied
DBGHELP: d:\winddk\symbols_ms\ntdll.dll\4D00F28096000\ntdll.dll - OK
DBGENG: Partial symbol load found image d:\winddk\symbols_ms\ntdll.dll\4D00F28096000\ntdll.dll.
SYMSRV: ntdll.pdb from http://msdl.microsoft.com/download/symbols: 333688 bytes - copied
DBGHELP: ntdll - public symbols
d:\winddk\symbols_ms\ntdll.pdb\CEFC0863B1F84130A11E0F54180CD21A2\ntdll.pdb
kd> u ntdll!NtOpenProcess // 再次执行我们的命令,这下正常了吧
ntdll!NtOpenProcess:
7c92d5fe b87a000000 mov eax,7Ah
7c92d603 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d608 ff12 call dword ptr [edx]
7c92d60a c21000 ret 10h
7c92d60d 90 nop
ntdll!NtOpenProcessToken:
7c92d60e b87b000000 mov eax,7Bh
7c92d613 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d618 ff12 call dword ptr [edx]