现象
3: kd> .reload nt
Map ntoskrnl.exe:
Image region 22e200:23a000 does not fit in mapping
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
用命令查看详细信息
!sym noisy
3: kd> .reload nt
DBGHELP: G:\pdb\ntoskrnl.exe\5C6E1CBD5dc000\ntoskrnl.exe - OK
Map ntoskrnl.exe:
Image region 22e200:23a000 does not fit in mapping
DBGENG: ntoskrnl.exe - Partial symbol image load missing image info
DBGHELP: No header for ntoskrnl.exe. Searching for dbg file
DBGHELP: .\ntoskrnl.dbg - file not found
DBGHELP: .\exe\ntoskrnl.dbg - path not found
DBGHELP: .\symbols\exe\ntoskrnl.dbg - path not found
DBGHELP: ntoskrnl.exe missing debug info. Searching for pdb anyway
DBGHELP: Can't use symbol server for ntoskrnl.pdb - no header information available
DBGHELP: ntoskrnl.pdb - file not found
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
DBGHELP: nt - no symbols loaded
检查文件 G:\pdb\ntoskrnl.exe\5C6E1CBD5dc000\ntoskrnl.exe
这个文件被破坏,导致无法加载, 也没有重新下载, windbg傻了
因为这个文件在上次加载时退出, 文件只下载了一部分, 所以文件损坏了
删掉这个文件, 重新加载正常