NT symbols are incorrect, please fix symbols

greyclear · Mar 19, 2018

I am trying to determine what is causing a bluescreen on my 2008 terminal servers. When I debug all I get is

Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffd5018). Type ".hh dbgerr001" for details

************* Symbol Loading Error Summary **************
Module name Error
ntkrnlmp The system cannot find the file specified

If I turn on !sym noisyto see what is going on I see this

Code:

DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: Symbol search path is: Symbol search path is: Symbol search path is: Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: srv*
Executable search path is: srv*
Executable search path is: srv*
Executable search path is: srv*
Executable search path is: srv*
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
SYMSRV:  BYINDEX: 0x12E
         c:\symbols*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EE505B3EDCD4479A55870B1997C82A61
SYMSRV:  BYINDEX: 0x12E
         c:\symbols*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EE505B3EDCD4479A55870B1997C82A61
SYMSRV:  BYINDEX: 0x12E
         c:\symbols*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EE505B3EDCD4479A55870B1997C82A61
SYMSRV:  BYINDEX: 0x12E
         c:\symbols*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EE505B3EDCD4479A55870B1997C82A61
SYMSRV:  BYINDEX: 0x12E
         c:\symbols*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EE505B3EDCD4479A55870B1997C82A61

Any further diagnoses gives me this

Unable to get nt!_EPROCESS.VadRoot at fffffa800abfdb00
0: kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
NT symbols are incorrect, please fix symbols
0: kd> !process -1 0
NT symbols are incorrect, please fix symbols
0: kd> !peb
PEB at 000007fffffd5000

How can I debug this?

greyclear · Mar 19, 2018

Wanted to add this I forgot

Code:

2: kd> .reload /f nt
SYMSRV:  BYINDEX: 0x11
         c:\symcache*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EE505B3EDCD4479A55870B1997C82A61
SYMSRV:  c:\symcache\ntkrnlmp.pdb\4EE505B3EDCD4479A55870B1997C82A61\ntkrnlmp.pdb - file not found
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pdb
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pd_
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/file.ptr
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  c:\symcache\ntkrnlmp.pdb\4EE505B3EDCD4479A55870B1997C82A61\ntkrnlmp.pdb not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pdb not found
DBGHELP: ntkrnlmp.pdb - file not found
SYMSRV:  BYINDEX: 0x11
         c:\symcache*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EE505B3EDCD4479A55870B1997C82A61
SYMSRV:  c:\symcache\ntkrnlmp.pdb\4EE505B3EDCD4479A55870B1997C82A61\ntkrnlmp.pdb - file not found
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pdb
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pd_
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/file.ptr
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  c:\symcache\ntkrnlmp.pdb\4EE505B3EDCD4479A55870B1997C82A61\ntkrnlmp.pdb not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pdb not found
DBGHELP: ntkrnlmp.pdb - file not found
SYMSRV:  BYINDEX: 0x11
         c:\symcache*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         4EE505B3EDCD4479A55870B1997C82A61
SYMSRV:  c:\symcache\ntkrnlmp.pdb\4EE505B3EDCD4479A55870B1997C82A61\ntkrnlmp.pdb - file not found
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pdb
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pd_
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/file.ptr
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  c:\symcache\ntkrnlmp.pdb\4EE505B3EDCD4479A55870B1997C82A61\ntkrnlmp.pdb not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/4EE505B3EDCD4479A55870B1997C82A61/ntkrnlmp.pdb not found
DBGHELP: ntkrnlmp.pdb - file not found

Wrench97 · Mar 19, 2018

Try using
The syntax for the _NT_SYMBOL_PATH variable is:

Code:

srv*[local cache]*[private symbol server]*https://msdl.microsoft.com/download/symbols

Note the change to https: from http:

Debugging with Symbols (Windows)

NT symbols are incorrect, please fix symbols

greyclear

New member

greyclear

New member

Wrench97

Administrator, Hardware Expert