Couldn't resolve error at 'ntdll!NtOpenProcess'

参考文章：

http://wingbao.blogbus.com/logs/28757738.html

http://blog.sina.com.cn/s/blog_a3e571160101iois.html

------------------------------------------------------------------------------------------------------------

刚开始用Windbg，看到网上有人敲如下命令：

u ntdll!NtOpenProcess 

我照敲之后得到如下错误：

Couldn't resolve error at 'ntdll!NtOpenProcess'

------------------------------------------------------------------------------

错误原因：

      从参考文章中得知是因为ntdll.dll属于应用层，windbg在调试内核时没有加载应用层的符号表文件，

因此也就有了错误：Couldn't resolve error at 'ntdll!NtOpenProcess'

      还有种可能的原因就是Windbg的符号表路径没有设置正确。

-----------------------------------------------------------------------------------------------------

解放方法：

      知道了错误原因，解决就简单了，让Windbg调试应用层的程序，然后我们重新载人符号表即可。

首先在虚拟机中打开应用层程序，记事本程序notepad.exe，然后按如下步骤做即可：

kd> !process 0 0 notepad.exe     //  查看进程notepad.exe信息
PROCESS 81ff0020  SessionId: 0  Cid: 01c4    Peb: 7ffde000  ParentCid: 05dc
    DirBase: 04b002a0  ObjectTable: e1a68528  HandleCount:  44.
    Image: notepad.exe


kd> .process /p 81ff0020     // 讲调试进程切换为notepad.exe
Implicit process is now 81ff0020
.cache forcedecodeuser done
kd> .reload                           // 重新载人符号表
Connected to Windows XP 2600 x86 compatible target at (Sun Jun 28 19:49:44.283 2015 (UTC + 8:00)), ptr64 FALSE
DBGHELP: nt - public symbols  
         d:\winddk\symbols_ms\ntkrnlpa.pdb\D8AAE42A2C254CF0A6DECF483D44477A1\ntkrnlpa.pdb
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
............................
Loading unloaded module list
....................
SYMSRV:  ntdll.dll from http://msdl.microsoft.com/download/symbols: 281828 bytes - copied         
DBGHELP: d:\winddk\symbols_ms\ntdll.dll\4D00F28096000\ntdll.dll - OK
DBGENG:  Partial symbol load found image d:\winddk\symbols_ms\ntdll.dll\4D00F28096000\ntdll.dll.
SYMSRV:  ntdll.pdb from http://msdl.microsoft.com/download/symbols: 333688 bytes - copied         
DBGHELP: ntdll - public symbols  
         d:\winddk\symbols_ms\ntdll.pdb\CEFC0863B1F84130A11E0F54180CD21A2\ntdll.pdb


kd> u ntdll!NtOpenProcess     //  再次执行我们的命令，这下正常了吧
ntdll!NtOpenProcess:
7c92d5fe b87a000000      mov     eax,7Ah
7c92d603 ba0003fe7f      mov     edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d608 ff12            call    dword ptr [edx]
7c92d60a c21000          ret     10h
7c92d60d 90              nop
ntdll!NtOpenProcessToken:
7c92d60e b87b000000      mov     eax,7Bh
7c92d613 ba0003fe7f      mov     edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d618 ff12            call    dword ptr [edx]