windbg的若干问题求解？

[tserpent]

1. 第一，符号表，我的电脑XP SP3, 下载符号表WindowsXP-KB936929-SP3-x86-symbols-update-ENU.exe，安装完后，设置符号表目录D:\WINDOWS\Symbols（符号表安装在这里）， 总是提示符号表找不到，用anlyze -v说符号表不对？

2. 做了一个本地的测试，在一个窗口按钮OnBtnDel2():strcat()故意越界，用drwtsn32生产dump文件，想看堆栈信息，我将编译的pdb目录e:\vc\xxx\debug也放到符号表目录，e:\vc\xxx放到源文件目录，打开这个dump文件
但是用堆栈的几个命令都不能看到清晰的信息，和对应的文件行数之类，达不到理想效果，最好的是kd命令，还可看到OnBtnDel2()
0:000> kd
0012f614 00000000
0012f618 0012f800
0012f61c 00143be0
0012f620 00000000
0012f624 0000000a
0012f628 cccccccc
0012f62c cccccccc
0012f630 cccccccc
0012f634 cccccccc
0012f638 cccccccc
0012f63c cccccccc
0012f640 00000001
0012f644 00401050 WatchProc!ILT+75(?OnBtnDel2CWatchProcDlgIAEXXZ)
0012f648 0012f6a0
0012f64c 5f437b2b MFC42D!CCmdTarget::OnCmdMsg+0x274
0012f650 0012fde4
0012f654 000003ee
0012f658 00000000
0012f65c 00401050 WatchProc!ILT+75(?OnBtnDel2CWatchProcDlgIAEXXZ)
0012f660 00000000

3. 如果我的目标机（就是运行程序的机器是windows 2003）生成的dump文件，可以在我的主机（就是编译的机器xp)上进行分析不?需要做什么不？

[jingzhongrong]

在符号路径中添加MS的符号文件服务器吧
SRV*D:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols

加载完符号文件再analyze

[wenqinwuhai]

[Quote=引用 5 楼 jingzhongrong 的回复:]
在符号路径中添加MS的符号文件服务器吧
SRV*D:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols

加载完符号文件再analyze
[/Quote]一般从网上下载符号文件的。

[danxuezx]

在网上找《寒江独钓》第一章，里面有这块的详细介绍

[danxuezx]

我的资源里有那本书的前三章下载，您可以去看看

[MoXiaoRab]

[Quote=引用 5 楼 jingzhongrong 的回复:]
在符号路径中添加MS的符号文件服务器吧
SRV*D:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols

加载完符号文件再analyze
[/Quote]
这样设置是如果本机没有就去网上下载，直接写本地路径，不去网上找也行的

[MoXiaoRab]

lkd> .sympath D:\WINDOWS\Symbols
Symbol search path is: D:\WINDOWS\Symbols
lkd> !sym noisy
noisy mode - symbol prompts on
lkd> !lmi nt
Loaded Module Info: [nt]
Module: ntkrnlpa
Base Address: 804d8000
Image Name: ntkrnlpa.exe
Machine Type: 332 (I386)
Time Stamp: 45e53f9c Wed Feb 28 16:38:52 2007
Size: 1f6400
CheckSum: 1facf5
Characteristics: 12e
Debug Data Dirs: Type Size VA Pointer
CODEVIEW 25, 9540, 9540 RSDS - GUID: {F612363D-B38C-423C-B085-59DDBCA9F2F7}
Age: 1, Pdb: ntkrnlpa.pdb
Image Type: MEMORY - Image read successfully from loaded memory.
Symbol Type: EXPORT - PDB not found
Load Report: export symbols
lkd> .reload /f nt
SYMSRV: WinInet Interface using proxy server: 202.117.54.197:8080
SYMSRV: ntkrnlpa.pdb from http://msdl.microsoft.com/download/symbols: 394365 bytes copied
DBGHELP: nt - public symbols
D:\WINDOWS\Symbols\ntkrnlpa.pdb\F612363DB38C423CB08559DDBCA9F2F71\ntkrnlpa.pdb

[MoXiaoRab]

[Quote=引用 3 楼 tserpent 的回复:]
引用 1 楼 tr0j4n 的回复:
1、没有设置全局变量_NT_SYMBOL_PATH，值设为符号包的安装路径
2、

首先设置 符号路径Symbol Files Path，然后设置源文件路径Source Files Path，最后打开dmp文件就可以了

然后就可以analyze

能直接看到源代码哪一行出错，调用堆栈，错误帧等等


1. 环境变量，_NT_SYMBOL_PATH也设置成D:\WINDOWS\Symbols，结果还是说
Your debugger is not using the correct symbols

2. 符号路径Symbol Files Path，然后设置源文件路径Source Files Path都设置了，analyze后
0:000> analyze
*** WARNING: Unable to verify checksum for WatchProc.exe
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MSVCRTD.DLL -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for uxtheme.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for comctl32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MFCO42D.DLL -
*** ERROR: Module load completed but symbols could not be loaded for mfc42loc.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for lpk.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MSCTFIME.IME -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for usp10.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for MSCTF.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for imm32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ole32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for psapi.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for apphelp.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for comctl32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for version.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for msvcrt.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for user32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for advapi32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for rpcrt4.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for gdi32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for shlwapi.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for secur32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for kernel32.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for shell32.dll -

[/Quote]
无语，我让你analyze你就输入这个命令？命令应该是!analyze -v

[udknight]

首先输入
.sympath
.chain
看看路径对不对
然后输入
!sym noisy
!lmi nt
.reload /f nt

[MoXiaoRab]

1、没有设置全局变量_NT_SYMBOL_PATH，值设为符号包的安装路径
2、

首先设置 符号路径Symbol Files Path，然后设置源文件路径Source Files Path，最后打开dmp文件就可以了

然后就可以analyze

能直接看到源代码哪一行出错，调用堆栈，错误帧等等

[danxuezx]

一本教材：http://download.csdn.net/source/1643421

[tserpent]

[Quote=引用 1 楼 tr0j4n 的回复:]
1、没有设置全局变量_NT_SYMBOL_PATH，值设为符号包的安装路径
2、

首先设置 符号路径Symbol Files Path，然后设置源文件路径Source Files Path，最后打开dmp文件就可以了

然后就可以analyze

能直接看到源代码哪一行出错，调用堆栈，错误帧等等
[/Quote]

1. 环境变量，_NT_SYMBOL_PATH也设置成D:\WINDOWS\Symbols，结果还是说
Your debugger is not using the correct symbols

2. 符号路径Symbol Files Path，然后设置源文件路径Source Files Path都设置了，analyze后
0:000> analyze
*** WARNING: Unable to verify checksum for WatchProc.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for MSVCRTD.DLL -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for uxtheme.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for comctl32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for MFCO42D.DLL -
*** ERROR: Module load completed but symbols could not be loaded for mfc42loc.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for lpk.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for MSCTFIME.IME -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for usp10.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for MSCTF.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for imm32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ole32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for psapi.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for apphelp.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for comctl32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for version.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for msvcrt.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for user32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for advapi32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for rpcrt4.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for gdi32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for shlwapi.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for secur32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for kernel32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for shell32.dll -

[tserpent]

[Quote=引用 2 楼 danxuezx 的回复:]
一本教材：http://download.csdn.net/source/1643421
[/Quote]

下了看了，还是比较空泛，想要一点实际的，例子一类