I would like to set the value of the above variable to 0xFFFFFFFF using command line. I was exploring dbh.exe and believe it will atleast give some clues on where the symbol is. But when I try the following command, it gives "no symbol found":

dbh.exe name nt!Kd_DEFAULT_MASK

I may need to setup symbol path but is there a way other than this?

  • Your question is a bit confusing ... so you were exploring dbh.exe (fine) and you expect a symbol explicitly contained in the module nt (because that's what the name says) to be found inside dbh.exe why exactly? Did you simply try .symfix followed by .reload? ... still my initial concern remains. Could you please clarify?
    – 0xC0000022L
    May 28 '19 at 15:36
  • I want to retrieve the symbol address from module nt, not from dbh.exe. May 29 '19 at 5:14
C:\>dbh c:\Windows\System32\ntoskrnl.exe

ntoskrnl [1000000]: x nt!*kd*def*

ntoskrnl [1000000]: x *kd*def*

 index            address     name
     1            1423400 :   KdPrintDefaultCircularBuffer
     2            14dd5c0 :   Kd_DEFAULT_Mask

ntoskrnl [1000000]:

as can be seen above do not use module prefix

C:\>dbh c:\Windows\System32\ntoskrnl.exe

ntoskrnl [1000000]: n kd*def*m*

   name : Kd_DEFAULT_Mask
   addr :  14dd5c0
   size : 0
  flags : 0
   type : 0
modbase :  1000000
  value :        0
    reg : 0
  scope : SymTagPublicSymbol (a)
    tag : SymTagPublicSymbol (a)
  index : 1

ntoskrnl [1000000]:

my symbol path is set via _NT_SYMBOL_PATH environment variable asking dbh to be verbose about symbol loads I get this display check yours I can say it works properly as far as I remember

C:\>dbh -n c:\Windows\System32\ntoskrnl.exe
verbose mode on.
DBGHELP: No header for c:\Windows\System32\ntoskrnl.exe.  Searching for image on disk
DBGHELP: c:\Windows\System32\ntoskrnl.exe - OK
SYMSRV:  PATH: f:\symbols\ntkrnlmp.pdb\8CFB49428DC86A330CE257778E0C2F931\ntkrnlmp.pdb
SYMSRV:  RESULT: 0x00000000
DBGHELP: ntoskrnl - public symbols

ntoskrnl [1000000]: q


C:\>set _NT
  • I am unable to list symbols with the above method. I have set sympath SRVC:\ga\symbols_windmsdl.microsoft.com/download/symbols and tried the above command again and still see the message "no symbol found" May 29 '19 at 5:17
  • I edited in the symbol path details of my setup I can say it works properly for me as far as I can remember I am not sure what your error can be
    – blabb
    May 29 '19 at 12:29
  • I had accepted the answer. Yes, with symbol path details, it works. Oct 10 '19 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.