1

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with Debugging Tools For WIndows 10 installed. When i connect to the target machine, all the symbols are loaded correctly except for the win32 system ( win32k.sys/win32kbase.sys/win32kfull.sys ). I have the symbols defined in my user-environment variable like so :

_NT_SYMBOL_PATH=srv*c:\symbols*https://msdl.microsoft.com/download/symbols

When i choose load symbols in Ida modules menu i get the following output:

WINDBG>!sym noisy
noisy mode - symbol prompts on

Trying loadDataForExe with 14000000
loadDataForExe: 806d0012
Trying loadDataForExe with ffffffff
loadDataForExe: 806d0005
PDB: could not process file \SystemRoot\System32\win32kbase.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)

Trying loadDataForExe with 13dd0000
loadDataForExe: 806d0012
Trying loadDataForExe with ffffffff
loadDataForExe: 806d0005
PDB: could not process file \SystemRoot\System32\win32k.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)

Trying loadDataForExe with 14960000
loadDataForExe: 806d0012
Trying loadDataForExe with ffffffff
loadDataForExe: 806d0005
PDB: could not process file \SystemRoot\System32\win32kfull.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)

lmi output:

WINDBG>!lmi win32kbase
Loaded Module Info: [win32kbase] 
Cannot read Image header @ ffff81ce14000000
Load Report: export symbols

WINDBG>!lmi win32k
Loaded Module Info: [win32k] 
Cannot read Image header @ ffff81ce13dd0000
Load Report: public symbols , not source indexed 
                     c:\symbols\win32k.pdb\0383A6141581403B9E8426F05328D45F1\win32k.pdb

WINDBG>!lmi win32kfull
Loaded Module Info: [win32kfull] 
Cannot read Image header @ ffff81ce14960000
    Load Report: public symbols , not source indexed 
                 c:\symbols\win32kfull.pdb\A792B492035540D397D66128F30037B01\win32kfull.pdb

This is all really annoying, because sometimes the symbols just loads correctly, i do not know on what this depends, i found a similar topics in google here they had the same problem, but with the dumps. This is really annoying problem, maybe someone had the same problem, trying to do some reverse-engineering the win32k subsystem, and can help me.

  • Try switching to a pricess context like expkirer.exe and reload viz .process / p / r eproc-explorer.exe .reliad / f – blabb Dec 4 '16 at 10:10
  • @blabb It's sort of worked, but sometimes it doesnt recognize for example win32kbase.sys as x64 code module, and disassembles it as x86 code, which is not good.. but i think it is fixed too, by removing all the files in c:\symbols – Vlad Dec 5 '16 at 7:27
  • @blabb is there any other solutions? Because i tried to set some breakpoints and whenever i set a breakpoint and continue the os execution, it never gets hit, and all this module becomes mess again. – Vlad Dec 5 '16 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.