Tech Support Forum banner
21 - 40 of 291 Posts

· Administrator, Manager, Microsoft Support, MVP
Joined
·
34,634 Posts
Discussion Starter · #25 ·
`

NT Kernel Symbol Errors

Some analysis on the SYM errors re: NT - ntoskrnl.exe/ ntkrpamp.exe --> http://www.techsupportforum.com/2667350-post15.html

Note the timestamp for NT - ntoskrnl - 8 December 2009

I'll have to check, but I believe it to be the same date that shows in Windows 7 systems w/ NT Kernel SYM errors

Note "tcpip.sys - note AVG..? in one of the code boxes at end of post

From the kd> command line in Windbg -
Code:
[font=lucida console]
[B]!sym noisy[/B] (shows which symbol files dbghelp is loading)

[B].reload[/B]

[B]lmvm tcpip[/B]
[/font]
Q. . . why does AVG show up under tcpip symbol file?

The OS = Windows XP Kernel Version 2600 SP3 - Bugcheck = 0xf4 (0x3,,,)

Comments appreciated.

John

.
 

· Administrator, Manager, Microsoft Support, MVP
Joined
·
34,634 Posts
Discussion Starter · #30 ·

· Administrator, Manager, Microsoft Support, MVP
Joined
·
34,634 Posts
Discussion Starter · #33 ·
Thanks, John.

It appears that the SYM error issues are over as the most recently processed Windows 7 x86 dumps in particular show no symbol errors. They have apparently been added to the MSDL site. I have not yet gone back to re-run prior dumps, though.

__________________________

A 0xd1 bugcheck mini kernel dump analysis in depth (actually 34 of them!) showing how the 4th parm (object referencing the memory address in parm #1) can be tied to a loaded driver. The 1st parm was not as easily ID'd to what I believe is the Realtek driver as it may be a physical memory address (v. virtual, or vice-versa) and a full kernel dump (w/ page file info) would be needed to do so. The page file contains the table for physical and virtual memory address conversions.

http://www.techsupportforum.com/f217/bsod-in-win7-and-realtek-ndis-474928.html#post2677840

jcgriff2

.
 

· Administrator, Manager, Microsoft Support, MVP
Joined
·
34,634 Posts
Discussion Starter · #37 · (Edited)
Information on commands and additional interesting and informative BSOD threads -

Windbg commands that I find most useful - http://www.sevenforums.com/671427-post3.html

Code:
[FONT=Lucida Console] !analyze -v; kv; k; r; lmnt; lmntsm
 
!for_each_module .echo @#ModuleIndex : @#Base @#End @#ModuleName @#ImageName @#LoadedImageName 
 
!for_each_module .echo @#ModuleName fver = @#FileVersion pver = @#ProductVersion[/FONT]

The first is the "usual" set of stringed commands that I use, including -

k = stack text of given thread
kv = " " + frame pointer omission (FPO) information
r = registers (I don't usually use much, if any info from this command

lmnt -
-- lm = loaded driver listing
-- n = displays image name
-- t = displays timestamp info
-- lmnt displays the loaded driver list in order of memory addresses

lmntsm -
- lmnt - see above
-- sm = Sorts the display by module name instead of by the start addresSorts the display by module name instead of by the start address

!for each module - displays various info for each module, including current and previous version numbers

Informative threads --> http://www.techsupportforum.com/f217/solved-symantec-endpoint-11-0x7e-vista-x64-bsod-370804.html

John

`
 

· Administrator, Manager, Microsoft Support, MVP
Joined
·
34,634 Posts
Discussion Starter · #39 ·
`

Windows Service Branch info - RTM, LDR, GDR + the infamous 8 December 2009 timestamp for ntoskrnl, ntkrnlmp, etc. . . causing all of the recent SYM errors (not found on MSDL SYM site) + tcpip, tcpipreg and others -

File info w/ timestamps & version numbers -

http://support.microsoft.com/default.aspx/kb/974145?p=1

http://support.microsoft.com/kb/977165

jcgriff2

.
It is now official... I went back and re-ran many old dumps that showed SYM errors - and they do not have symbol errors now.

Case in point - a post showing "before" (w/ SYM errors) and "after" - same dumps, but now no symbol errors.

http://www.techsupportforum.com/2680515-post8.html

jcgriff2

.
 
21 - 40 of 291 Posts
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top