I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically).
.symfix C:\debug\symbols .sympath+ C:\debug\mypdbs .reload /f
I re-opened the disassembly window and I still don't see the function names.
EDIT (answer to questions):
- Windbg Preview version:
Debugger client version: 1.0.2007.06001 Debugger engine version: 10.0.20153.1000
OS version of the guest:
Windows 10 x64 1909 (OS Build 18363.1082)
lm m cfs:
kd> lm m cfs Browse full module list start end module name fffff800`2abd0000 fffff800`2abd0c00 cfs (no symbols)
- The symbol path is set up with:
So I think it is loaded although in section 3 it wrote "no symbols".
I also run
.reload /f but it didn't help.
- Yes it works but only if I set breakpoint on the call itself:
kd> u fffff802`504a6460 nt!RtlInitUnicodeString: fffff802`504a6460 48c70100000000 mov qword ptr [rcx],0 fffff802`504a6467 48895108 mov qword ptr [rcx+8],rdx fffff802`504a646b 4885d2 test rdx,rdx fffff802`504a646e 7501 jne nt!RtlInitUnicodeString+0x11 (fffff802`504a6471) fffff802`504a6470 c3 ret fffff802`504a6471 48c7c0ffffffff mov rax,0FFFFFFFFFFFFFFFFh fffff802`504a6478 0f1f840000000000 nop dword ptr [rax+rax] fffff802`504a6480 48ffc0 inc rax
kd> ln fffff802`504a6460 Browse module Set bu breakpoint (fffff802`504a6460) nt!RtlInitUnicodeString | (fffff802`504a64b0) nt!KeEnterCriticalRegion Exact matches: nt!RtlInitUnicodeString (void)
They are being downloaded dynmaically:
In the environment varible I have it set:
- I am not sure what you mean, there are lots of modules, I need to go to each module and pass it?
Not sure how to do it.