symbol加載失敗的case分析

最新一直在分析產品反饋回來的dump，分析過程中發現有一些dump的symbol無法加載。比例很小，1000個dump，只有7個沒法加載symbol。

即使使用.reload /i也無法加載：

 

0:000> .reload /i alibrowser.exe

Unable to load image C:\Program Files\AliBrowser\Alibrowser.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for Alibrowser.exe

*** ERROR: Module load completed but symbols could not be loaded for Alibrowser.exe

 

我們知道!sym noisy可以將整個加載symbol的過程打印出來。所以執行!sym noisy 之后再次執行.reload /i alibrowser.exe

0:000> !sym noisy

noisy mode - symbol prompts on

0:000> .reload /i alibrowser.exe

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://10.1.170.157/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://msdl.microsoft.com/download/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

DBGHELP: D:\Projects\aliyun\CrashTracker\CrashTracker\bin\Release\Alibrowser.exe - file not found

DBGHELP: Alibrowser.exe not found in e:\symbols

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://10.1.170.157/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://msdl.microsoft.com/download/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

DBGENG:  C:\Program Files\AliBrowser\Alibrowser.exe - Couldn't map image from disk.

Unable to load image C:\Program Files\AliBrowser\Alibrowser.exe, Win32 error 0n2

DBGHELP: No header for Alibrowser.exe.  Searching for dbg file

DBGHELP: .\Alibrowser.dbg - file not found

DBGHELP: .\exe\Alibrowser.dbg - path not found

DBGHELP: .\symbols\exe\Alibrowser.dbg - path not found

DBGHELP: Alibrowser.exe missing debug info.  Searching for pdb anyway

DBGHELP: Can't use symbol server for
Alibrowser.pdb - no header information available

DBGHELP: Alibrowser.pdb - file not found

*** WARNING: Unable to verify timestamp for Alibrowser.exe

*** ERROR: Module load completed but symbols could not be loaded for Alibrowser.exe

DBGHELP: Alibrowser - no symbols loaded

 

整個加載過程很長，直接一眼也看不出來哪里有問題。不過我們可以對比一下正常的加載過程。下面的代碼是在一個可以正常加載symbol的dump里面執行的：

 

0:024> !sym noisy

noisy mode - symbol prompts on

0:024> .reload /i alibrowser.exe

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://10.1.170.157/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://msdl.microsoft.com/download/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

DBGHELP: D:\Projects\aliyun\CrashTracker\CrashTracker\bin\Release\Alibrowser.exe - file not found

DBGHELP: Alibrowser.exe not found in e:\symbols

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://10.1.170.157/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://msdl.microsoft.com/download/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

DBGENG:  C:\Program Files\AliBrowser\Alibrowser.exe - Couldn't map image from disk.

Unable to load image C:\Program Files\AliBrowser\Alibrowser.exe, Win32 error 0n2

DBGENG:  Alibrowser.exe - Partial symbol image load missing image info

DBGHELP: Module is not fully loaded into memory.

DBGHELP: Searching for symbols using debugger-provided data.

*** WARNING: Unable to verify timestamp for Alibrowser.exe

DBGHELP: Alibrowser - private symbols & lines

         e:\symbols\Alibrowser.pdb\4A9A20AE996E4E5590C000C41FF40AB81\Alibrowser.pdb

 

 仔細對比兩者的加載過程，可以看到，前面大部分都完全一樣，從紅色部分開始，兩者不一樣。

從后者的這句話（DBGHELP: Searching for symbols using debugger-provided data）來看，加載symbol利用的是dump里面的symbol信息。

而前者里面的這塊信息可能丟失或者損壞，導致沒法正常加載symbol。

那么如何能夠使前者能夠加載symbol呢？我們可以看到前面一大段的日志都是在尋找alibrowser.exe，我猜想windbg一開始是想找到alibrowser.exe然后利用exe的信息來定位具體的symbol。

如果我們在他尋找的地方放一個exe，是不是就可以加載成功呢？

於是我在C:\Program Files\AliBrowser\下面放一個跟dump里面版本一樣的alibrowser.exe。果然就加載成功了：

0:000> .reload /i alibrowser.exe

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://10.1.170.157/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://msdl.microsoft.com/download/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

DBGHELP: D:\Projects\aliyun\CrashTracker\CrashTracker\bin\Release\Alibrowser.exe - file not found

DBGHELP: Alibrowser.exe not found in e:\symbols

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://10.1.170.157/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://msdl.microsoft.com/download/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

DBGENG:  C:\Program Files\AliBrowser\Alibrowser.exe - Mapped image memory

DBGHELP: Alibrowser - private symbols & lines

         e:\symbols\Alibrowser.pdb\4A9A20AE996E4E5590C000C41FF40AB81\Alibrowser.pdb

 

在C:\Program Files\AliBrowser放置了對應版本的alibrowser.exe之后，發現大部分（7個中的6個）都可以正常加載symbol了，但是還有一個沒法正常加載symbol。

我們看一下這個有問題的dump的加載過程：

0:004> !sym noisy

noisy mode - symbol prompts on

0:004> .reload /i alibrowser.exe

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://10.1.170.157/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

SYMSRV:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://msdl.microsoft.com/download/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

DBGHELP: D:\Projects\aliyun\CrashTracker\CrashTracker\bin\Release\Alibrowser.exe - file not found

DBGHELP: Alibrowser.exe not found in e:\symbols

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://10.1.170.157/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

SYMSRV:  E:\Symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe not found

SYMSRV:  http://msdl.microsoft.com/download/symbols/Alibrowser.exe/4F0C2D28e9e000/Alibrowser.exe not found

DBGENG:  D:\Program Files\瀏覽器\AliBrowser\Alibrowser.exe - Couldn't map image from disk.

Unable to load image D:\Program Files\瀏覽器\AliBrowser\Alibrowser.exe, Win32 error 0n2

DBGHELP: No header for Alibrowser.exe.  Searching for dbg file

DBGHELP: .\Alibrowser.dbg - file not found

DBGHELP: .\exe\Alibrowser.dbg - path not found

DBGHELP: .\symbols\exe\Alibrowser.dbg - path not found

DBGHELP: Alibrowser.exe missing debug info.  Searching for pdb anyway

DBGHELP: Can't use symbol server for Alibrowser.pdb - no header information available

DBGHELP: Alibrowser.pdb - file not found

*** WARNING: Unable to verify timestamp for Alibrowser.exe

*** ERROR: Module load completed but symbols could not be loaded for Alibrowser.exe

DBGHELP: Alibrowser - no symbols loaded

 

 

可以看到，加載symbol的時候是去D:\Program Files\瀏覽器\AliBrowser\，也就是產生dump時alibrowser.exe所在路徑去尋找的，而這個用戶沒有安裝在默認路徑，所以我們放在默認路徑的alibrowser.exe沒有作用。

另外，我們可以看到，windbg其實是首先到e:\symbols\Alibrowser.exe\4F0C2D28e9e000里面是尋找alibrowser.exe的，所以在里面放一個alibrowser.exe即可。

0:004> .reload /i alibrowser.exe

DBGHELP: e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe - OK

DBGENG:  e:\symbols\Alibrowser.exe\4F0C2D28e9e000\Alibrowser.exe - Mapped image memory

DBGHELP: Alibrowser - private symbols & lines

         e:\symbols\Alibrowser.pdb\4A9A20AE996E4E5590C000C41FF40AB81\Alibrowser.pdb