{"id":4412,"date":"2012-10-12T12:07:37","date_gmt":"2012-10-12T10:07:37","guid":{"rendered":"https:\/\/ingmarverheij.com\/?p=4412"},"modified":"2012-10-12T12:13:01","modified_gmt":"2012-10-12T10:13:01","slug":"windbg-couldnt-load-mismatched-pdb-for-ntkrpamp-exe","status":"publish","type":"post","link":"https:\/\/ingmarverheij.com\/en\/windbg-couldnt-load-mismatched-pdb-for-ntkrpamp-exe\/","title":{"rendered":"WinDbg: Couldn’t load mismatched pdb for ntkrpamp.exe"},"content":{"rendered":"<\/p>\n

\"\"<\/a>When using a  debugging tool (like WinDbg) the debugging tool needs symbol files to display and interpret data. The symbol files (.pdb – program database<\/a>) are provided by the software vendor, it is not part of the debugging software.<\/p>\n

If your system is connected to the internet providing the Microsoft symbol files is very easy, just provide the online symbol server of Microsoft (explained in KB311503<\/a>).  In my case <\/strong>the system had no direct internet connection so I had to download the symbol files manually.<\/p>\n

<\/p>\n

Mismatched PDB<\/h2>\n

In this case I was debugging the running <\/em>kernel of a Microsoft Windows server 2003R2 SP2. Therefore I downloaded the Windows Symbol Package from the Microsoft site (link<\/a>). Which file you need is pretty simple, choose the operating system and the processor architecture (like x86 or x64). You usually need the download that says \u201cMost customers want this package\u201d.<\/em><\/p>\n

\"ntkrpamp.pdb<\/a>Don\u2019t be surprised you\u2019ll get the following error:<\/p>\n

DBGHELP: (symbol search path)\\ntkrpamp.pdb - file not found\nDBGHELP: (symbol search path)\\exe\\ntkrpamp.pdb - mismatched pdb\nDBGHELP: (symbol search path)\\symbols\\exe\\ntkrpamp.pdb - file not found\nDBGHELP: ntkrpamp.pdb - file not found\nDBGHELP: Couldn't load mismatched pdb for ntkrpamp.exe\n*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe\nDBGHELP: nt - export symbols<\/pre>\n
\n  
The main reason for this is: you\u2019ve installed a post SP2 <\/strong>hotfix that updated ntkrpamp.exe (this applies to other files as well).  <\/p>\n
 <\/p>\n
Solution \/ work-around<\/h2>\n
You can solve this by downloading the correct symbol file from the online symbol server of Microsoft (explained in KB311503<\/a>). This of course requires the use of another machine that is connected to the internet and has the WinDbg installed (<\/em>Download and Install Debugging Tools for Windows<\/em><\/a>) .<\/em><\/p>\n
Steps<\/p>\n
    \n
  1. Copy the executable <\/strong>(of which you want to download the symbol file) to the machine<\/li>\n
  2. Open Windows GUI symbolic debugger <\/strong>(WinDbg)\n
        
    \"\"<\/a><\/li>\n
  3. Configure the Symbol Search Path <\/strong>(CTRL+S, see KB311503<\/a>). Make sure you specify both a local and a remote path\n
        
    \"\"<\/a><\/li>\n
  4. Open the executable (copied in step 1) via Open Crash Dump<\/strong> (CTRL+D)\n
        
         \"\"<\/a><\/li>\n
  5. If you get the question \u2018Save information to workspace\u2019 click No (but that\u2019s up to you)
    \n      
    \"\"<\/a><\/em><\/li>\n
  6. Open the local symbol path <\/strong>(specified in step 3)\n
        
    \"\"<\/a><\/li>\n
  7. Copy the <executablename><\/em>.pdb folder <\/strong>to symbol search path on the machine where you have no internet access<\/li>\n
  8. The error of \u2018mismatched pdb\u2019 should not be solved<\/li>\n<\/ol>\n
     <\/p>\n
    Cheers!<\/p>","protected":false},"excerpt":{"rendered":"
    When using a  debugging tool (like WinDbg) the debugging tool needs symbol files to display and interpret data. The symbol files (.pdb – program database) are provided by the software vendor, it is not part of the debugging software. If your system is connected to the internet providing the Microsoft symbol files is very easy, […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[288],"tags":[513,512,130],"class_list":["post-4412","post","type-post","status-publish","format-standard","hentry","category-other","tag-ntkrpamp","tag-symbols","tag-windbg"],"_links":{"self":[{"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/posts\/4412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/comments?post=4412"}],"version-history":[{"count":4,"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/posts\/4412\/revisions"}],"predecessor-version":[{"id":4423,"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/posts\/4412\/revisions\/4423"}],"wp:attachment":[{"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/media?parent=4412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/categories?post=4412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ingmarverheij.com\/en\/wp-json\/wp\/v2\/tags?post=4412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}