1

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with Debugging Tools For WIndows 10 installed. When i connect to the target machine, all the symbols are loaded correctly except for the win32 system ( win32k.sys/win32kbase.sys/win32kfull.sys ). I have the symbols defined in my user-environment variable like so :

_NT_SYMBOL_PATH=srv*c:\symbols*https://msdl.microsoft.com/download/symbols

When i choose load symbols in Ida modules menu i get the following output:

WINDBG>!sym noisy
noisy mode - symbol prompts on

Trying loadDataForExe with 14000000
loadDataForExe: 806d0012
Trying loadDataForExe with ffffffff
loadDataForExe: 806d0005
PDB: could not process file \SystemRoot\System32\win32kbase.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)

Trying loadDataForExe with 13dd0000
loadDataForExe: 806d0012
Trying loadDataForExe with ffffffff
loadDataForExe: 806d0005
PDB: could not process file \SystemRoot\System32\win32k.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)

Trying loadDataForExe with 14960000
loadDataForExe: 806d0012
Trying loadDataForExe with ffffffff
loadDataForExe: 806d0005
PDB: could not process file \SystemRoot\System32\win32kfull.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)

lmi output:

WINDBG>!lmi win32kbase
Loaded Module Info: [win32kbase] 
Cannot read Image header @ ffff81ce14000000
Load Report: export symbols

WINDBG>!lmi win32k
Loaded Module Info: [win32k] 
Cannot read Image header @ ffff81ce13dd0000
Load Report: public symbols , not source indexed 
                     c:\symbols\win32k.pdb\0383A6141581403B9E8426F05328D45F1\win32k.pdb

WINDBG>!lmi win32kfull
Loaded Module Info: [win32kfull] 
Cannot read Image header @ ffff81ce14960000
    Load Report: public symbols , not source indexed 
                 c:\symbols\win32kfull.pdb\A792B492035540D397D66128F30037B01\win32kfull.pdb

This is all really annoying, because sometimes the symbols just loads correctly, i do not know on what this depends, i found a similar topics in google here they had the same problem, but with the dumps. This is really annoying problem, maybe someone had the same problem, trying to do some reverse-engineering the win32k subsystem, and can help me.

  • Try switching to a pricess context like expkirer.exe and reload viz .process / p / r eproc-explorer.exe .reliad / f – blabb Dec 4 '16 at 10:10
  • @blabb It's sort of worked, but sometimes it doesnt recognize for example win32kbase.sys as x64 code module, and disassembles it as x86 code, which is not good.. but i think it is fixed too, by removing all the files in c:\symbols – Vlad Dec 5 '16 at 7:27
  • @blabb is there any other solutions? Because i tried to set some breakpoints and whenever i set a breakpoint and continue the os execution, it never gets hit, and all this module becomes mess again. – Vlad Dec 5 '16 at 8:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.