hi all

i am just learning to debug minidumps and just wanted to check that I am setting it up properly.

I'm using a Vista Business SP1 X86 machine and have downloaded and installed the debugging tools for Windows X86.

So far, so good

On opening my latest minidump file I get the following messages (as well as usual dump info):

ERROR: Module load completed but symbols could not be loaded for hal.dll
ERROR: FindPlugIns 80070015

and

Your debugger is not using the correct symbols

Does this mean that my symbols havent loaded correctly?

Info appreciated

No Windbg is not loading the symbols. Read this and for the symbols read this.

thanx buddy

hi all

which symbols package do you download? the version (service pack) that your machine is currently at or what it was to start with?

if my Vista Business x86 was without SP1 do i download the pre SP1 symbols pack?

info appreciated

Did you read the second link you were given by fastco?
On that page you will find ...
If this doesn't answer your question, then I apologize, for I must be misunderstanding you.

hi there

OK I am following everything to the letter and setting up my symbols path as: SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols

however I am still getting constant Your debugger is not using the correct symbols error message

here is some info from the output:

WARNING: Whitespace at end of path element
WARNING: Whitespace at end of path element

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini051709-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
WARNING: Whitespace at end of path element
Symbol search path is: Symbol search path is: SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols
;Symbol search path is: SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x81c4a000 PsLoadedModuleList = 0x81d61c70
Debug session time: Sun May 17 21:15:28.317 2009 (GMT+1)
System Uptime: 0 days 0:01:23.926
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.....
ERROR: FindPlugIns 80070015

I hope someone can shed some light on what I'm doing wrong

regards

1) Your symbol table should match your currently installed version of windows. (Symbol addresses and even names might be different when the installed Windows SP level changes. Important it should match the symbol table)

2. If you have the disk space (and assuming you're debugging your own dumps on your own PC each time) i'd suggest just download the symbol table you need and keep a copy local on your disk (i.e. instead of going to a server each time?)Look here for your download

3. Also, don't know if have you this Mar, 2009 link How to read the small memory dump files that Windows creates for debugging

hi there

i have done all that but still get the same errors as above. even if my symbols were missing or incorrect it should still download the required ones but it isnt.

totally stumped

might try it on another machine to see if the error reproduces itself.

thanx again

instead of downloading dynamically via the server have you first tried simply downloading the symbol table yourself to your hard disk? then just point your debugger to your hard drive?

/* EDIT */
Let's start by ruling out the server or your access to it as having any part of the problem and just know you can get the symbol table to work with your Windows installaation

hi there

i have installed the symbols for my OS into c:\windows\symbols and still the same

doesnt my post above give any clues?

regards

Pardon if any of these sound like dumb questions but let's make sure all the basics are covered
1) Are you certain you're running Vista SP1? Double check
2) Also double check 32 vs 64 bit windows Click for how to determine whether you are running 32 or 64 bit windows
3) Did you download symbol table from the link i provided? Double check and/or redownload your symbol table (and copy/paste the link here as well so i can see it pls)
4) Have you updated the Windows debugger to point to the local directory and not the server?

Hi there

yes to all questions

regards

Executable search path is:
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe


does this help any?

well, i just remote logged into a friend's computer (tho they run Vista Home Premium SP1 but in theory Home version shouldn't make the difference)

So if you're system is really what you say it is
=> The debugger version in your post is correct
=> I downloaded Windows Vista SP1 RTM and Windows Server 2008 RTM x86 retail symbols, all languages . I assume you did same?
=> I started Adobe reader, selected it in Task Manager, rt click Create Crash Dump, found it in the /user/your_username/appdata/local/temp/ directory
=> And all worked correctly

Why don't you
=> Set your System Advanced Options for Recovery/failure to create options to Create Complete Memory Dump and check so overwrites crash dumps
=> Reboot (for good measure)
=> Create a crash dump as i did above
=> If it doesn't work, please copy/paste the output into a text file and ATTACH it to your next post (use the paper clip icon)