Легенда:
 новое сообщение
 закрытая нитка
 новое сообщение
 в закрытой нитке
 старое сообщение
|
- Напоминаю, что масса вопросов по функционированию форума снимается после прочтения его описания.
- Новичкам также крайне полезно ознакомиться с данным документом.
Господа, будьте снисходительны, не бросайтесь сразу штрафовать за, как вам кажется, глупые вопросы - beginners на то и beginners.
Чё не так? 11.07.05 23:46 Число просмотров: 6865
Автор: Gor801 Статус: Незарегистрированный пользователь
|
1) Открыл дамп файл
2) Поскольку pdb для ядра не найдено
.symfix+ c:\downstream
и .reload /f ntoskrnl.exe
Символа загрузились, но некоторые файлы тулзы не смогли найти
3)analize -v Догрузились ещё символа
kd> analize -v
*** WARNING: Unable to verify timestamp for POP3FILT.DLL
*** ERROR: Module load completed but symbols could not be loaded for POP3FILT.DLL
*** WARNING: Unable to verify timestamp for DNSCACHE.DLL
*** ERROR: Module load completed but symbols could not be loaded for DNSCACHE.DLL
*** WARNING: Unable to verify timestamp for HTMLFILT.DLL
*** ERROR: Module load completed but symbols could not be loaded for HTMLFILT.DLL
*** WARNING: Unable to verify timestamp for HTTPFILT.DLL
*** ERROR: Module load completed but symbols could not be loaded for HTTPFILT.DLL
*** WARNING: Unable to verify timestamp for PROTECT.DLL
*** ERROR: Module load completed but symbols could not be loaded for PROTECT.DLL
*** WARNING: Unable to verify timestamp for FTPFILT.DLL
*** ERROR: Module load completed but symbols could not be loaded for FTPFILT.DLL
*** WARNING: Unable to verify timestamp for MAILFILT.DLL
*** ERROR: Module load completed but symbols could not be loaded for MAILFILT.DLL
*** WARNING: Unable to verify timestamp for spider.sys
*** ERROR: Module load completed but symbols could not be loaded for spider.sys
*** WARNING: Unable to verify timestamp for dump_IdeChnDr.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_IdeChnDr.sys
*** WARNING: Unable to verify timestamp for FILTNT.SYS
*** ERROR: Module load completed but symbols could not be loaded for FILTNT.SYS
*** ERROR: Symbol file could not be found. Defaulted to export symbols for win32k.sys -
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for ialmrnt5.dll
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for ialmdnt5.dll
*** WARNING: Unable to verify timestamp for ialmdev5.DLL
*** ERROR: Module load completed but symbols could not be loaded for ialmdev5.DLL
*** WARNING: Unable to verify timestamp for ialmdd5.DLL
*** ERROR: Module load completed but symbols could not be loaded for ialmdd5.DLL
*** WARNING: Unable to verify timestamp for Null.SYS
*** WARNING: Unable to verify timestamp for ADBLOCK.DLL
*** ERROR: Module load completed but symbols could not be loaded for ADBLOCK.DLL
*** WARNING: Unable to verify timestamp for NNTPFILT.DLL
*** ERROR: Module load completed but symbols could not be loaded for NNTPFILT.DLL
*** WARNING: Unable to verify timestamp for IMAPFILT.DLL
*** ERROR: Module load completed but symbols could not be loaded for IMAPFILT.DLL
*** WARNING: Unable to verify timestamp for CONTENT.DLL
*** ERROR: Module load completed but symbols could not be loaded for CONTENT.DLL
*** WARNING: Unable to verify timestamp for GreaTaom.sys
*** ERROR: Module load completed but symbols could not be loaded for GreaTaom.sys
*** WARNING: Unable to verify timestamp for ALCXWDM.SYS
*** ERROR: Module load completed but symbols could not be loaded for ALCXWDM.SYS
*** WARNING: Unable to verify timestamp for e100b325.sys
*** WARNING: Unable to verify timestamp for ialmnt5.sys
*** ERROR: Module load completed but symbols could not be loaded for ialmnt5.sys
*** WARNING: Unable to verify timestamp for vcdmpdrv.SYS
*** ERROR: Module load completed but symbols could not be loaded for vcdmpdrv.SYS
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for AFS2K.SYS
*** ERROR: Module load completed but symbols could not be loaded for AFS2K.SYS
*** WARNING: Unable to verify timestamp for IdeChnDr.sys
*** ERROR: Module load completed but symbols could not be loaded for IdeChnDr.sys
*** WARNING: Unable to verify timestamp for ACPI.sys
*** WARNING: Unable to verify timestamp for SMBios.sys
*** ERROR: Module load completed but symbols could not be loaded for SMBios.sys
*** WARNING: Unable to verify timestamp for PxHelp20.sys
*** ERROR: Module load completed but symbols could not be loaded for PxHelp20.sys
*** WARNING: Unable to verify timestamp for fdc.sys
*** WARNING: Unable to verify timestamp for IdeBusDr.sys
*** ERROR: Module load completed but symbols could not be loaded for IdeBusDr.sys
*** WARNING: Unable to verify timestamp for klmc.sys
*** ERROR: Module load completed but symbols could not be loaded for klmc.sys
*** WARNING: Unable to verify timestamp for dmload.sys
*** WARNING: Unable to verify timestamp for Fs_Rec.SYS
*** WARNING: Unable to verify timestamp for drwebnet.sys
*** ERROR: Module load completed but symbols could not be loaded for drwebnet.sys
*** WARNING: Unable to verify timestamp for ParVdm.SYS
Couldn't resolve error at 'nalize -v'
лог
kd> lm
start end module name
804d4000 806c6400 nt # (pdb symbols) c:\downstream\ntoskrnl.pdb\8C0365A4579D46469E0B53A80062C0472\ntoskrnl.pdb
806c7000 806e6380 hal (pdb symbols) c:\downstream\halaacpi.pdb\3C3A1CB4FD7942FF82C1E36CB4641CA01\halaacpi.pdb
b1b71000 b1b94700 Fastfat (pdb symbols) c:\downstream\fastfat.pdb\C861D9AC9603495194EBF7C7965A28282\fastfat.pdb
b1b95000 b1bbbe80 kmixer (pdb symbols) c:\downstream\kmixer.pdb\E28A4B885E864D92AD6844FB1219B1041\kmixer.pdb
b2a0b000 b2a0d4e0 POP3FILT T (no symbols)
b2a0f000 b2a11ce0 DNSCACHE T (no symbols)
b2a13000 b2a15aa0 HTMLFILT T (no symbols)
b2a17000 b2a1a0e0 HTTPFILT T (no symbols)
b2b0f000 b2b12b40 PROTECT T (no symbols)
b2b13000 b2b15100 FTPFILT T (no symbols)
b2b1b000 b2b1e700 MAILFILT T (no symbols)
b2beb000 b2c39a00 srv (pdb symbols) c:\downstream\srv.pdb\59955EA7E9BA49019382B6E33A253B3F1\srv.pdb
b2c8a000 b2cb4280 mrxdav (pdb symbols) c:\downstream\mrxdav.pdb\CBF153D53DA446098DF5F51B864575D31\mrxdav.pdb
b2dac000 b2dbee80 wdmaud (pdb symbols) c:\downstream\wdmaud.pdb\F7FA9B31C4A74A529E389D0975842D252\wdmaud.pdb
b2de2000 b2e02380 afd (pdb symbols) c:\downstream\afd.pdb\19D33D25EF6245A1B1CCFD3FF58227152\afd.pdb
b2e03000 b2e374c0 spider T (no symbols)
b2e38000 b2e4f660 dump_IdeChnDr T (no symbols)
b2e50000 b2ebb700 mrxsmb (pdb symbols) c:\downstream\mrxsmb.pdb\6BC4CF0A5B964C6C8B863F98FB86CF532\mrxsmb.pdb
b2ebc000 b2ee5880 rdbss (pdb symbols) c:\downstream\rdbss.pdb\BCD2FC8369874965984AF604C73767F22\rdbss.pdb
b2ee6000 b2f0a700 netbt (pdb symbols) c:\downstream\netbt.pdb\6B792C96F71944728FCDBFA16539FA831\netbt.pdb
b2f0b000 b2f251e0 FILTNT T (no symbols)
b2f26000 b2f79000 tcpip (pdb symbols) c:\downstream\tcpip.pdb\0CC1C22C97FD41C4944EE2782AD7697B2\tcpip.pdb
bf800000 bf9b6c00 win32k (export symbols) win32k.sys
bf9b7000 bf9c5000 ialmrnt5 T (no symbols)
bf9c5000 bf9e4000 ialmdnt5 T (no symbols)
bf9e4000 bfa0fa20 ialmdev5 T (no symbols)
bfa10000 bfaed000 ialmdd5 T (no symbols)
bff80000 bff90d80 dxg (pdb symbols) c:\downstream\dxg.pdb\C9029FD252104AFA917D4BB6A98062431\dxg.pdb
f2ee1000 f2ee5000 watchdog (pdb symbols) c:\downstream\watchdog.pdb\0D5DEACA672F4225ACAA451B3BD1FBF41\watchdog.pdb
f34a7000 f34a9900 Dxapi (pdb symbols) c:\downstream\dxapi.pdb\A63AA409BC33424F9C61C4743C15609B1\dxapi.pdb
f3909000 f390a000 Null M (pdb symbols) C:\Program Files\Debugging Tools for Windows\symbols\SYS\Null.pdb
f3987000 f3995900 Cdfs (pdb symbols) c:\downstream\cdfs.pdb\699BC95BB1F84DEA9B66B43221466F1F2\cdfs.pdb
f3997000 f399f880 Fips (pdb symbols) c:\downstream\fips.pdb\CD572ED242DA4016AA1777EB3F54BBB42\fips.pdb
f39b7000 f39bf180 netbios (pdb symbols) c:\downstream\netbios.pdb\A44BC600B0D64D4EB1EC7EE09C81A2DB1\netbios.pdb
f39c7000 f39cf080 ipfltdrv (pdb symbols) c:\downstream\ipfltdrv.pdb\03E92650120A42178A8FAF60DCD56B4D1\ipfltdrv.pdb
f39d7000 f39df200 wanarp (pdb symbols) c:\downstream\wanarp.pdb\706162F3D25F4541B9D5093D59360D531\wanarp.pdb
f39e7000 f39ef400 msgpc (pdb symbols) c:\downstream\msgpc.pdb\DEDAE03FFC7F47A193B6092ADA5AA1881\msgpc.pdb
f39f7000 f3a05280 ipsec (pdb symbols) c:\downstream\ipsec.pdb\CBE0CE4DBF20498BA42C85F10A20DE4F2\ipsec.pdb
f3cfe000 f3d0ab00 usbhub (pdb symbols) c:\downstream\usbhub.pdb\CDE3987194A740D596DE2A0C75FA4D201\usbhub.pdb
f5d68000 f5d6fe60 ADBLOCK T (no symbols)
f5dcb000 f5dcc860 NNTPFILT T (no symbols)
f5dcd000 f5dcea40 IMAPFILT T (no symbols)
f5dcf000 f5dd0140 CONTENT T (no symbols)
f6543000 f6543d00 dxgthk (pdb symbols) c:\downstream\dxgthk.pdb\ED52F57C00F5452FBEBABB7C5BA826DF1\dxgthk.pdb
f7347000 f7349280 rasacd (pdb symbols) c:\downstream\rasacd.pdb\20B90C6127114BDC88DE7FA31D8618701\rasacd.pdb
f7f68000 f7f6f880 GreaTaom T (no symbols)
f7f70000 f7f77380 Npfs (pdb symbols) c:\downstream\npfs.pdb\24ECE010A4E547CAAF831C464B64DEC81\npfs.pdb
f7f78000 f7f7c680 Msfs (pdb symbols) c:\downstream\msfs.pdb\FD651933D8424CC1843E9C46911876701\msfs.pdb
f7f80000 f7f84d00 vga (pdb symbols) c:\downstream\vga.pdb\D033FAFDE3594A8089E1F55CDB8F8AD31\vga.pdb
f7fa0000 f7fa4d00 flpydisk (pdb symbols) c:\downstream\flpydisk.pdb\FCE1A7AFD26B437F8721628908BD8A371\flpydisk.pdb
f8516000 f852c080 SCSIPORT (pdb symbols) c:\downstream\scsiport.pdb\3B7C65552DBC4769B7388386B48424E11\scsiport.pdb
f852d000 f854e780 update (pdb symbols) c:\downstream\update.pdb\EB0EC472948648EAB3EEEF7336B19FC92\update.pdb
f854f000 f857b880 rdpdr (pdb symbols) c:\downstream\rdpdr.pdb\3E6813E482A74D61AB96A669251971951\rdpdr.pdb
f857c000 f8591600 ndiswan (pdb symbols) c:\downstream\ndiswan.pdb\F111FE32693C4F239FFB816BA6C8EA822\ndiswan.pdb
f8592000 f85b2c80 portcls (pdb symbols) c:\downstream\portcls.pdb\8D0950F1AFCC4AFD8FAA108F620043852\portcls.pdb
f85b3000 f8695460 ALCXWDM T (no symbols)
f86be000 f86de280 ks (pdb symbols) c:\downstream\ks.pdb\122669B16F22426C9AFAF43D678060172\ks.pdb
f86df000 f86f1900 parport # (pdb symbols) c:\downstream\parport.pdb\24CA767AC3DA4B3A9B01CEE26271310A1\parport.pdb
f86f2000 f8715800 e100b325 M (pdb symbols) C:\Program Files\Debugging Tools for Windows\symbols\sys\e100b325.pdb
f8716000 f8737180 USBPORT (pdb symbols) c:\downstream\usbport.pdb\9BF5850086A74EF6AAA9AFC935A730201\usbport.pdb
f8c6a000 f8c7b500 VIDEOPRT (pdb symbols) c:\downstream\videoprt.pdb\9AA61F7F4CF74E4F8B3E73122A42BE821\videoprt.pdb
f8c7c000 f8d405a0 ialmnt5 T (no symbols)
f8d63000 f8d6ea40 vcdmpdrv T (no symbols)
f8d73000 f8d7c400 termdd (pdb symbols) c:\downstream\termdd.pdb\35323634989346EDB1F48329F56B58761\termdd.pdb
f8d83000 f8d8e480 raspptp (pdb symbols) c:\downstream\raspptp.pdb\6FFE8513943F4A6CAAAC2AA459610AC93\raspptp.pdb
f8d93000 f8d9c800 raspppoe (pdb symbols) c:\downstream\raspppoe.pdb\7D9D2D43B9FE4F31A9C37AC8B54D629F1\raspppoe.pdb
f8da3000 f8daed00 rasl2tp (pdb symbols) c:\downstream\rasl2tp.pdb\B6A01254A90C4B658D50AC979428E7A42\rasl2tp.pdb
f8db3000 f8dc1200 drmk T (no symbols)
f8dc3000 f8dd0d00 redbook # (pdb symbols) c:\downstream\redbook.pdb\510B611738F94CDFBB118AAAD33538281\redbook.pdb
f8dd3000 f8dde980 cdrom (pdb symbols) c:\downstream\cdrom.pdb\42509677CD1B412482C0254885787D1A1\cdrom.pdb
f8de3000 f8df0440 AFS2K T (no symbols)
f8df3000 f8dff780 i8042prt # (pdb symbols) c:\downstream\i8042prt.pdb\D2CCC32D6B7140FBB720A36AF96CC0BA2\i8042prt.pdb
f9116000 f912f680 Mup (pdb symbols) c:\downstream\mup.pdb\12155F60FF5D469E869CC7C65108C38C2\mup.pdb
f9130000 f9158e80 NDIS (pdb symbols) c:\downstream\ndis.pdb\B4F2B56027DA4FF6B8B65BE1481EEC5C2\ndis.pdb
f9159000 f91e2300 Ntfs (pdb symbols) c:\downstream\ntfs.pdb\E236541273E04837AC83A3E7C8C776B42\ntfs.pdb
f91e3000 f91f6780 KSecDD (pdb symbols) c:\downstream\ksecdd.pdb\2FE639F85B75497E96133E6BC871F0E51\ksecdd.pdb
f91f7000 f9207e80 sr # (pdb symbols) c:\downstream\sr.pdb\2B02113CE0B4419DBCA27D372A97ABA61\sr.pdb
f9208000 f921f660 IdeChnDr T (no symbols)
f9220000 f9235380 atapi (pdb symbols) c:\downstream\atapi.pdb\9C671BD9A0CB48FAB86E0D0D3D70D3AF1\atapi.pdb
f9236000 f9259b80 dmio (pdb symbols) c:\downstream\dmio.pdb\F0F51F6981D44FD1ADCA3BC2FDA55F3E1\dmio.pdb
f925a000 f9278880 ftdisk # (pdb symbols) c:\downstream\ftdisk.pdb\370ADA20D01E457AB6AC095AF8D099681\ftdisk.pdb
f9279000 f92a4c80 ACPI M (pdb symbols) C:\Program Files\Debugging Tools for Windows\symbols\sys\ACPI.pdb
f92c6000 f92d5600 pci # (pdb symbols) c:\downstream\pci.pdb\6352161374394AE2999E9C20AFBD5C771\pci.pdb
f92d6000 f92dec00 isapnp # (pdb symbols) c:\downstream\isapnp.pdb\40205FF7480844E98F62335DD78B4F8E1\isapnp.pdb
f92e6000 f92ef280 MountMgr (pdb symbols) c:\downstream\mountmgr.pdb\122D06AC070B41AEA8720333A6D47EC91\mountmgr.pdb
f92f6000 f9302000 VolSnap (pdb symbols) c:\downstream\volsnap.pdb\5609CB8CFA7C4B4BA882A58B816222A01\volsnap.pdb
f9306000 f930e400 disk (pdb symbols) c:\downstream\disk.pdb\4FCC75A033824E9099D6DD71C328BF921\disk.pdb
f9316000 f9321500 CLASSPNP (pdb symbols) c:\downstream\classpnp.pdb\DCEFE7FF58EE4E258775B21EB75AC4712\classpnp.pdb
f93a6000 f93b3e00 sysaudio (pdb symbols) c:\downstream\sysaudio.pdb\F3F481478DB3435FA4AC1E7813CD96AA2\sysaudio.pdb
f9436000 f943ee40 SMBios T (no symbols)
f94c6000 f94d5400 serial # (pdb symbols) c:\downstream\serial.pdb\20832F11DE594E61B959EA03C6381D812\serial.pdb
f94d6000 f94df480 NDProxy (pdb symbols) c:\downstream\ndproxy.pdb\EE437B1D5CC3470E9E89EFBEF9CD9B241\ndproxy.pdb
f9546000 f954bc80 PCIIDEX (pdb symbols) c:\downstream\pciidex.pdb\CC720163A6DC4271A298CF46ECA4370A1\pciidex.pdb
f954e000 f9552900 PartMgr (pdb symbols) c:\downstream\partmgr.pdb\2BF62287ECEE48DFB06FF92BF1D0514B2\partmgr.pdb
f9556000 f955abc0 PxHelp20 T (no symbols)
f9576000 f957d780 processr (pdb symbols) c:\downstream\processr.pdb\EF3FFD91A52E4831A2803BB21F2DDF001\processr.pdb
f959e000 f95a2b80 usbuhci (pdb symbols) c:\downstream\usbuhci.pdb\6022FFADAAA44D009FF0F89628315FB51\usbuhci.pdb
f95f6000 f95fab80 usbehci (pdb symbols) c:\downstream\usbehci.pdb\FA01D0118A084294A2CE9D150B4E160F1\usbehci.pdb
f95fe000 f95ff000 fdc M (pdb symbols) C:\Program Files\Debugging Tools for Windows\symbols\sys\fdc.pdb
f9606000 f960bb80 kbdclass # (pdb symbols) c:\downstream\kbdclass.pdb\4997AAFD421843E09E709EE5B9C0DB1C1\kbdclass.pdb
f960e000 f9613600 mouclass # (pdb symbols) c:\downstream\mouclass.pdb\95413B1C084A4222A71021DB21B0325C1\mouclass.pdb
f9616000 f961a580 ptilink (pdb symbols) c:\downstream\ptilink.pdb\776B55BE9F5846AA8E4590CB42866E6A1\ptilink.pdb
f961e000 f9622080 raspti (pdb symbols) c:\downstream\raspti.pdb\B3C31E3A63DE4E868C024FEBAFF83F761\raspti.pdb
f96d6000 f96d9000 BOOTVID (pdb symbols) c:\downstream\bootvid.pdb\3B7D83451\bootvid.pdb
f96da000 f96dd100 IdeBusDr T (no symbols)
f96de000 f96e0680 klmc T (no symbols)
f96e2000 f96e5f80 TDI (pdb symbols) c:\downstream\tdi.pdb\02E84156A9564C6896B94BF981EDC9211\tdi.pdb
f976e000 f9771000 ndisuio (pdb symbols) c:\downstream\ndisuio.pdb\F204DBF386D04A34A31AA54073BDEF551\ndisuio.pdb
f97ae000 f97b1a80 serenum (pdb symbols) c:\downstream\SerEnum.pdb\5D5EE01B3F4045D49981B808B6DAD9D41\SerEnum.pdb
f97b6000 f97b8580 ndistapi (pdb symbols) c:\downstream\ndistapi.pdb\BFF5A188A558494DAA310545F7A347031\ndistapi.pdb
f97c6000 f97c7b80 kdcom (pdb symbols) c:\downstream\kdcom.pdb\3B7D83461\kdcom.pdb
f97c8000 f97c9100 WMILIB (pdb symbols) c:\downstream\wmilib.pdb\E4C3A9A4158C4C51BC4E2B46CA108AA51\wmilib.pdb
f97ca000 f97cb280 intelide # (pdb symbols) c:\downstream\intelide.pdb\605A9B8E0CA04B06B2B7BAA2E94A023F1\intelide.pdb
f97cc000 f97cd000 dmload M (pdb symbols) C:\Program Files\Debugging Tools for Windows\symbols\sys\dmload.pdb
f980a000 f980b280 USBD (pdb symbols) c:\downstream\usbd.pdb\11D6688CD6BB464F9026586BE1CD28F81\usbd.pdb
f980c000 f980d000 Fs_Rec M (pdb symbols) C:\Program Files\Debugging Tools for Windows\symbols\SYS\Fs_Rec.pdb
f9810000 f9811080 mnmdd (pdb symbols) c:\downstream\mnmdd.pdb\9871421E8348450AA965551E05AEC4D21\mnmdd.pdb
f9812000 f9813080 RDPCDD (pdb symbols) c:\downstream\RDPCDD.pdb\770565601E554819A9670ADF167252531\RDPCDD.pdb
f9816000 f9817180 drwebnet T (no symbols)
f9838000 f9839000 ParVdm M (pdb symbols) C:\Program Files\Debugging Tools for Windows\symbols\SYS\ParVdm.pdb
f988e000 f988ed00 pciide # (pdb symbols) c:\downstream\pciide.pdb\87100ADD25D540C79421817F1CD098A41\pciide.pdb
f98a8000 f98a8c00 audstub (pdb symbols) c:\downstream\audstub.pdb\6B3BF8F0C8834E7E8EFE53B7A91E2A3F1\audstub.pdb
f98a9000 f98a9f00 swenum (pdb symbols) c:\downstream\swenum.pdb\1B45EAC4415B4DFAA9F981F2371DBD821\swenum.pdb
Unloaded modules:
b264c000 b2673000 kmixer.sys
b264c000 b2673000 kmixer.sys
b2d85000 b2dac000 kmixer.sys
f5f48000 f5f49000 drmkaud.sys
f93d6000 f93e3000 DMusic.sys
f93c6000 f93d4000 swmidi.sys
b2dbf000 b2de2000 aec.sys
f982e000 f9830000 splitter.sys
f39a7000 f39b1000 imapi.sys
f980e000 f9810000 Beep.SYS
f7f88000 f7f8d000 Cdaudio.SYS
f734b000 f734e000 Sfloppy.SYS
|
|
|
подробно о проекте
Анализ криптографических сетевых...
