0

I would like to set the value of the above variable to 0xFFFFFFFF using command line. I was exploring dbh.exe and believe it will atleast give some clues on where the symbol is. But when I try the following command, it gives "no symbol found":

dbh.exe name nt!Kd_DEFAULT_MASK

I may need to setup symbol path but is there a way other than this?

  • Your question is a bit confusing ... so you were exploring dbh.exe (fine) and you expect a symbol explicitly contained in the module nt (because that's what the name says) to be found inside dbh.exe why exactly? Did you simply try .symfix followed by .reload? ... still my initial concern remains. Could you please clarify? – 0xC0000022L May 28 at 15:36
  • I want to retrieve the symbol address from module nt, not from dbh.exe. – the sudhakar May 29 at 5:14
0
C:\>dbh c:\Windows\System32\ntoskrnl.exe

ntoskrnl [1000000]: x nt!*kd*def*


ntoskrnl [1000000]: x *kd*def*

 index            address     name
     1            1423400 :   KdPrintDefaultCircularBuffer
     2            14dd5c0 :   Kd_DEFAULT_Mask

ntoskrnl [1000000]:

as can be seen above do not use module prefix

C:\>dbh c:\Windows\System32\ntoskrnl.exe

ntoskrnl [1000000]: n kd*def*m*

   name : Kd_DEFAULT_Mask
   addr :  14dd5c0
   size : 0
  flags : 0
   type : 0
modbase :  1000000
  value :        0
    reg : 0
  scope : SymTagPublicSymbol (a)
    tag : SymTagPublicSymbol (a)
  index : 1

ntoskrnl [1000000]:

my symbol path is set via _NT_SYMBOL_PATH environment variable asking dbh to be verbose about symbol loads I get this display check yours I can say it works properly as far as I remember

C:\>dbh -n c:\Windows\System32\ntoskrnl.exe
verbose mode on.
DBGHELP: No header for c:\Windows\System32\ntoskrnl.exe.  Searching for image on disk
DBGHELP: c:\Windows\System32\ntoskrnl.exe - OK
SYMSRV:  BYINDEX: 0x1
         f:\symbols*https://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         8CFB49428DC86A330CE257778E0C2F931
SYMSRV:  PATH: f:\symbols\ntkrnlmp.pdb\8CFB49428DC86A330CE257778E0C2F931\ntkrnlmp.pdb
SYMSRV:  RESULT: 0x00000000
DBGHELP: ntoskrnl - public symbols
        f:\symbols\ntkrnlmp.pdb\8CFB49428DC86A330CE257778E0C2F931\ntkrnlmp.pdb

ntoskrnl [1000000]: q

goodbye

C:\>set _NT
_NT_SYMBOL_PATH=srv*f:\symbols*https://msdl.microsoft.com/download/symbols
  • I am unable to list symbols with the above method. I have set sympath SRVC:\ga\symbols_windmsdl.microsoft.com/download/symbols and tried the above command again and still see the message "no symbol found" – the sudhakar May 29 at 5:17
  • I edited in the symbol path details of my setup I can say it works properly for me as far as I can remember I am not sure what your error can be – blabb May 29 at 12:29
  • I had accepted the answer. Yes, with symbol path details, it works. – the sudhakar Oct 10 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.