When loading Ntoskrnl.exe in IDA Free (7.7) certain functions such as SwapContext are not displayed

Question

I'm just having some fun learning IDA 7.7 Free and how context switching works both on Windows 8.1. I've loaded ntoskrnl.exe into IDA, but I cannot find the following two functions names or symbols: KiSwapContext and SwapContext. I've included the screenshots on loading ntoskrnl.exe and the output details as follows:

>     Possible file format: Portable executable for AMD64 (PE) (C:\Program Files\IDA Freeware 7.7\loaders\pe64.dll)
> 
>   bytes   pages size description
> --------- ----- ---- --------------------------------------------  29450240  3595 8192 allocating memory for b-tree...  29450240  3595
> 8192 allocating memory for virtual array...    262144    32 8192
> allocating memory for name pointers...
> -----------------------------------------------------------------  59162624            total memory allocated
> 
> Loading processor module C:\Program Files\IDA Freeware
> 7.7\procs\pc64.dll for metapc...Initializing processor module metapc...OK Autoanalysis subsystem has been initialized. Loading file
> 'C:\Users\AUSER\Documents\Visual Studio 2019\Reversing\ntoskrnl.exe'
> into database... Detected file format: Portable executable for AMD64
> (PE)
>   0. Creating a new segment  (0000000140001000-0000000140289000) ... ... OK
>   1. Creating a new segment  (0000000140289000-000000014028C000) ... ... OK
>   2. Creating a new segment  (000000014028C000-000000014028F000) ... ... OK
>   3. Creating a new segment  (000000014028F000-0000000140290000) ... ... OK
>   4. Creating a new segment  (0000000140290000-0000000140291000) ... ... OK
>   5. Creating a new segment  (0000000140291000-0000000140305000) ... ... OK
>   6. Creating a new segment  (0000000140305000-0000000140343000) ... ... OK
>   7. Creating a new segment  (0000000140343000-0000000140346000) ... ... OK
>   8. Creating a new segment  (0000000140346000-000000014034E000) ... ... OK
>   9. Creating a new segment  (000000014034E000-0000000140361000) ... ... OK
>  10. Creating a new segment  (0000000140361000-000000014037B000) ... ... OK
>  11. Creating a new segment  (000000014037B000-0000000140658000) ... ... OK
>  12. Creating a new segment  (0000000140658000-000000014065D000) ... ... OK
>  13. Creating a new segment  (000000014065D000-0000000140685000) ... ... OK
>  14. Creating a new segment  (0000000140685000-0000000140688000) ... ... OK
>  15. Creating a new segment  (0000000140688000-000000014068F000) ... ... OK
>  16. Creating a new segment  (000000014068F000-0000000140694000) ... ... OK
>  17. Creating a new segment  (00000001406A8000-00000001406B7000) ... ... OK
>  18. Creating a new segment  (00000001406B7000-00000001406C3000) ... ... OK
>  19. Creating a new segment  (00000001406C3000-00000001406CE000) ... ... OK
>  20. Creating a new segment  (00000001406CE000-0000000140747000) ... ... OK Reading exports directory... Reading imports directory...
> Applying fixups...
>  21. Creating a new segment  (0000000140343728-0000000140346000) ... ... OK PDB: using PDBIDA provider Could not find PDB file
> 'ntkrnlmp.pdb'. Please check _NT_SYMBOL_PATH PDB: loading
> C:\symbols\ntkrnlmp.pdb\0E352AF38FB64A36AA56E6CC5CAD6C1A1\ntkrnlmp.pdb
> Assuming __fastcall calling convention by default PDB: loaded 2129
> types 1400240EC: name has been deleted: NtCreateEnlistment 1400240F4:
> name has been deleted: NtCreateResourceManager PDB: total 21006
> symbols loaded for "C:\Users\AUSER\Documents\Visual Studio
> 2019\Reversing\ntoskrnl.exe" Plan  FLIRT signature: Windows Driver Kit
> 7/10 64bit Plugin "eh_parse" not found Marking typical code
> sequences... Flushing buffers, please wait...ok File
> 'C:\Users\AUSER\Documents\Visual Studio 2019\Reversing\ntoskrnl.exe'
> has been successfully loaded into the database. Hex-Rays Decompiler
> plugin has been loaded (v7.7.0.220118)   License: 00-0000-0000-00  (0
> user)   The decompilation hotkey is F5.   Please check the
> Edit/Plugins menu for more information. Using FLIRT signature: Windows
> Driver Kit 7/10 64bit Propagating type information... Function
> argument information has been propagated The initial autoanalysis has
> been finished.

[UPDATE] I did a clean install of Windows 8/8.1 on another computer installed IDA Free 7.7 and loaded ntoskrnl.exe into IDA. This time IDA was able to display both KiSwapContext and SwapContext functions very similar output as WinDbg. On the PC which is not displaying these two functions in IDA I tried uninstalling Norton Security but that didn't help. Doing a search for SwapContext in IDA displays the following two functions:

SwapContext_PatchStMxCsr and SwapContext_PatchLdt

Does anyone know why this is the case ? Could this be a windows update patch by Microsoft and the real SwapContext is hidden somewhere else ?

Answer 1

KiSwapContext is not an exported function, so the mapping between its address and its name is only available either through your own manual guesswork or the PDB (which contains debug symbols).

You may have had a transient issue loading the PDB file from Microsoft's Symbol Server (which provides symbols over the public Internet); without knowing exactly which mismatched PDB file you did have, and what choices you made on those dialog boxes, it's not 100% clear what went wrong.

Microsoft patching Windows does cause the symbol table and PDB to change as updates do change the layout of functions, exact addresses, etc., but the PDB's metadata (signature and age) should catch the issue of a PDB for a different version of the binary than the one you have (as they seem to have done here).