none
Unable to load image ntoskrnl.exe, Win32 error 0n2

    Question

  • I get a minidump file, when I attempt to load symbol for system module. some error occur as follows:

    0: kd> .sympath
    Symbol search path is: srv*C:\symbolFilePath*http://msdl.microsoft.com/download/symbols;cache*C:\symbolFilePath
    Expanded Symbol search path is: srv*c:\symbolfilepath*http://msdl.microsoft.com/download/symbols;cache*c:\symbolfilepath

    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       srv*C:\symbolFilePath*http://msdl.microsoft.com/download/symbols
    Deferred                                       cache*C:\symbolFilePath

    0: kd> !sym noisy
    noisy mode - symbol prompts on
    0: kd> vertarget
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x64
    Product: Server, suite: Enterprise TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0xfffff800`01000000 PsLoadedModuleList = 0xfffff800`011d5100
    Debug session time: Fri Oct 17 19:59:53.663 2014 (UTC + 8:00)
    System Uptime: 0 days 0:04:33.279
    0: kd> .reload
    DBGENG:  c:\symbolfilepath\ntoskrnl.exe\45D69A89490000\ntoskrnl.exe image header does not match memory image header.
    DBGHELP: c:\symbolfilepath\ntoskrnl.exe\45D69A89490000\ntoskrnl.exe - mismatched
    DBGENG:  c:\symbolfilepath\ntoskrnl.exe\45D69A89490000\ntoskrnl.exe image header does not match memory image header.
    DBGHELP: c:\symbolfilepath\ntoskrnl.exe\45D69A89490000\ntoskrnl.exe - mismatched
    SYMSRV:  Unable to establish connection with server
    SYMSRV:  c:\symbolfilepath\ntkrnlup.exe\45D69A89490000\ntkrnlup.exe not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlup.exe/45D69A89490000/ntkrnlup.exe not found
    SYMSRV:  c:\symbolfilepath\ntkrnlup.exe\45D69A89490000\ntkrnlup.exe not found
    SYMSRV:  Unable to establish connection with server
    SYMSRV:  c:\symbolfilepath\ntkrnlpa.exe\45D69A89490000\ntkrnlpa.exe not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlpa.exe/45D69A89490000/ntkrnlpa.exe not found
    SYMSRV:  c:\symbolfilepath\ntkrnlpa.exe\45D69A89490000\ntkrnlpa.exe not found
    SYMSRV:  c:\symbolfilepath\ntkrnlmp.exe\45D69A89490000\ntkrnlmp.exe not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/45D69A89490000/ntkrnlmp.exe not found
    SYMSRV:  c:\symbolfilepath\ntkrnlmp.exe\45D69A89490000\ntkrnlmp.exe not found
    SYMSRV:  c:\symbolfilepath\ntkrpamp.exe\45D69A89490000\ntkrpamp.exe not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/ntkrpamp.exe/45D69A89490000/ntkrpamp.exe not found
    SYMSRV:  c:\symbolfilepath\ntkrpamp.exe\45D69A89490000\ntkrpamp.exe not found
    SYMSRV:  c:\symbolfilepath\xboxkrnlc.exe\45D69A89490000\xboxkrnlc.exe not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/xboxkrnlc.exe/45D69A89490000/xboxkrnlc.exe not found
    SYMSRV:  c:\symbolfilepath\xboxkrnlc.exe\45D69A89490000\xboxkrnlc.exe not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntoskrnl.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntoskrnl.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntkrnlup.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntkrnlup.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntkrnlpa.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntkrnlpa.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntkrnlmp.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntkrnlmp.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntkrpamp.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\ntkrpamp.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\xboxkrnlc.exe - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\xboxkrnlc.exe - file not found
    DBGENG:  ntoskrnl.exe - Image mapping disallowed by non-local path.
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    DBGENG:  ntoskrnl.exe - Partial symbol image load missing image info
    DBGHELP: No header for ntoskrnl.exe.  Searching for dbg file
    DBGHELP: .\ntoskrnl.dbg - file not found
    DBGHELP: .\exe\ntoskrnl.dbg - path not found
    DBGHELP: .\symbols\exe\ntoskrnl.dbg - path not found
    DBGHELP: ntoskrnl.exe missing debug info.  Searching for pdb anyway
    DBGHELP: Can't use symbol server for ntoskrnl.pdb - no header information available
    DBGHELP: ntoskrnl.pdb - file not found
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    DBGHELP: nt - no symbols loaded
    Loading Kernel Symbols
    .
    SYMSRV:  c:\symbolfilepath\halaacpi.dll\45D6936F5e000\halaacpi.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/halaacpi.dll/45D6936F5e000/halaacpi.dll not found
    SYMSRV:  c:\symbolfilepath\halaacpi.dll\45D6936F5e000\halaacpi.dll not found
    SYMSRV:  c:\symbolfilepath\halacpi.dll\45D6936F5e000\halacpi.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/halacpi.dll/45D6936F5e000/halacpi.dll not found
    SYMSRV:  c:\symbolfilepath\halacpi.dll\45D6936F5e000\halacpi.dll not found
    SYMSRV:  c:\symbolfilepath\halapic.dll\45D6936F5e000\halapic.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/halapic.dll/45D6936F5e000/halapic.dll not found
    SYMSRV:  c:\symbolfilepath\halapic.dll\45D6936F5e000\halapic.dll not found
    SYMSRV:  Unable to establish connection with server
    SYMSRV:  c:\symbolfilepath\halmacpi.dll\45D6936F5e000\halmacpi.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/halmacpi.dll/45D6936F5e000/halmacpi.dll not found
    SYMSRV:  c:\symbolfilepath\halmacpi.dll\45D6936F5e000\halmacpi.dll not found
    SYMSRV:  c:\symbolfilepath\halmps.dll\45D6936F5e000\halmps.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/halmps.dll/45D6936F5e000/halmps.dll not found
    SYMSRV:  c:\symbolfilepath\halmps.dll\45D6936F5e000\halmps.dll not found
    DBGHELP: c:\symbolfilepath\hal.dll\45D6936F5e000\hal.dll - OK
    DBGENG:  c:\symbolfilepath\hal.dll\45D6936F5e000\hal.dll - Mapped image memory


    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.

    .
    SYMSRV:  operation timed out
    SYMSRV:  c:\symbolfilepath\kdcom.dll\45D72A6Da000\kdcom.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/kdcom.dll/45D72A6Da000/kdcom.dll not found
    SYMSRV:  c:\symbolfilepath\kdcom.dll\45D72A6Da000\kdcom.dll not found
    SYMSRV:  c:\symbolfilepath\kdusb.dll\45D72A6Da000\kdusb.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/kdusb.dll/45D72A6Da000/kdusb.dll not found
    SYMSRV:  c:\symbolfilepath\kdusb.dll\45D72A6Da000\kdusb.dll not found
    SYMSRV:  c:\symbolfilepath\kd1394.dll\45D72A6Da000\kd1394.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/kd1394.dll/45D72A6Da000/kd1394.dll not found
    SYMSRV:  c:\symbolfilepath\kd1394.dll\45D72A6Da000\kd1394.dll not found
    SYMSRV:  Unable to establish connection with server
    SYMSRV:  c:\symbolfilepath\kdnet.dll\45D72A6Da000\kdnet.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/kdnet.dll/45D72A6Da000/kdnet.dll not found
    SYMSRV:  c:\symbolfilepath\kdnet.dll\45D72A6Da000\kdnet.dll not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kdcom.dll - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kdcom.dll - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kdusb.dll - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kdusb.dll - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kd1394.dll - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kd1394.dll - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kdnet.dll - file not found
    DBGHELP: C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kdnet.dll - file not found
    DBGENG:  kdcom.dll - Image mapping disallowed by non-local path.
    .............................................................
    ..............................................
    Loading User Symbols
    Loading unloaded module list
    ...

    ************* Symbol Loading Error Summary **************
    Module name            Error
    ntoskrnl               The system cannot find the file specified
    The SYMSRV client failed to find a file in the UNC store, or there
    is an invalid UNC store (an invalid path or the pingme.txt file is
    not present in the root directory), or the file is present in the
    symbol server exclusion list.

    Does Windows Symbols Host Unavailable Now?

    Could you help me? 

    Monday, October 20, 2014 2:32 PM

Answers

  • I have solve this problem as follows:

    1.Create a sub directory named “45D69A89490000” in C:\symbolFilePath\ntoskrnl.exe;

    2.Copy ntoskrnl.exe from dump machine (%windir%/system32) to C:\symbolFilePath\ntoskrnl.exe\45D69A89490000

    ntoskrnl.exe symbol can load accurately now.

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffadf52a90526, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffffadf2798f290, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS:  fffffadf52a90526 

    FAULTING_IP: 
    disk!memmove+60
    fffffadf`2798f290 488b040a        mov     rax,qword ptr [rdx+rcx]

    MM_INTERNAL_CODE:  0

    CUSTOMER_CRASH_COUNT:  7

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  clienteng.exe

    CURRENT_IRQL:  1

    TRAP_FRAME:  fffffadf257d2520 -- (.trap 0xfffffadf257d2520)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffadf3288b010 rbx=0000000000000000 rcx=fffffadf329e0e00
    rdx=00000000200af726 rsi=0000000000000000 rdi=0000000000000000
    rip=fffffadf2798f290 rsp=fffffadf257d26b8 rbp=fffffadf39a8e1b0
     r8=0000000000000018  r9=0000000000000003 r10=5be72d2eea34000b
    r11=fffffadf329e0e00 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    disk!memmove+0x60:
    fffffadf`2798f290 488b040a        mov     rax,qword ptr [rdx+rcx] ds:0004:fffffadf`52a90526=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff800010a58f2 to fffff8000102e950

    STACK_TEXT:  
    fffffadf`257d2448 fffff800`010a58f2 : 00000000`00000050 fffffadf`52a90526 00000000`00000000 fffffadf`257d2520 : nt!KeBugCheckEx
    fffffadf`257d2450 fffff800`0102d519 : fffffadf`39697750 00000000`00000000 fffffadf`00000000 fffffadf`32aaef40 : nt!MmAccessFault+0xa1f
    fffffadf`257d2520 fffffadf`2798f290 : fffffadf`2798c8dd 00000000`00000000 fffffadf`39697750 00000000`00000000 : nt!KiPageFault+0x119
    fffffadf`257d26b8 fffffadf`2798c8dd : 00000000`00000000 fffffadf`39697750 00000000`00000000 fffffadf`39a8e670 : disk!memmove+0x60
    fffffadf`257d26c0 fffffadf`29a5637a : fffff800`c0100080 fffffadf`257d2950 fffffadf`32aa8440 fffffadf`257d2cf0 : disk!DiskDeviceControl+0x7ed
    fffffadf`257d2930 fffff800`01379339 : fffffadf`32aa8440 fffffadf`257d2cf0 00000000`00000000 fffffadf`32aa8440 : PartMgr!PmDeviceControl+0x4aa
    fffffadf`257d29c0 fffffadf`27937922 : ffffffff`ffffffff 00000000`20206f49 fffffadf`32aa8440 fffffadf`38e6c620 : nt!RawDispatch+0x159
    fffffadf`257d2a10 fffff800`01280111 : 00000000`00000000 fffffadf`257d2cf0 00000000`00000001 fffffadf`32aaef40 : fltMgr!FltpDispatch+0x1c2
    fffffadf`257d2a70 fffff800`0127fc16 : 00000000`000003f8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa79
    fffffadf`257d2b90 fffff800`0102e3fd : fffffadf`32911c20 fffffadf`32acd840 fffffadf`32911f00 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
    fffffadf`257d2c00 00000000`78ee0a5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
    00000000`02aed1f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x78ee0a5a



    • Edited by bendsha Tuesday, October 21, 2014 9:27 AM
    • Marked as answer by bendsha Tuesday, October 21, 2014 10:45 AM
    Tuesday, October 21, 2014 9:26 AM

All replies

  • Try to upload your dump here and see if it helps.

    -- pa

    Thanks for your suggest although it doesn't helpful.
    Tuesday, October 21, 2014 5:05 AM
  • I have solve this problem as follows:

    1.Create a sub directory named “45D69A89490000” in C:\symbolFilePath\ntoskrnl.exe;

    2.Copy ntoskrnl.exe from dump machine (%windir%/system32) to C:\symbolFilePath\ntoskrnl.exe\45D69A89490000

    ntoskrnl.exe symbol can load accurately now.

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffadf52a90526, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffffadf2798f290, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS:  fffffadf52a90526 

    FAULTING_IP: 
    disk!memmove+60
    fffffadf`2798f290 488b040a        mov     rax,qword ptr [rdx+rcx]

    MM_INTERNAL_CODE:  0

    CUSTOMER_CRASH_COUNT:  7

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  clienteng.exe

    CURRENT_IRQL:  1

    TRAP_FRAME:  fffffadf257d2520 -- (.trap 0xfffffadf257d2520)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffadf3288b010 rbx=0000000000000000 rcx=fffffadf329e0e00
    rdx=00000000200af726 rsi=0000000000000000 rdi=0000000000000000
    rip=fffffadf2798f290 rsp=fffffadf257d26b8 rbp=fffffadf39a8e1b0
     r8=0000000000000018  r9=0000000000000003 r10=5be72d2eea34000b
    r11=fffffadf329e0e00 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    disk!memmove+0x60:
    fffffadf`2798f290 488b040a        mov     rax,qword ptr [rdx+rcx] ds:0004:fffffadf`52a90526=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff800010a58f2 to fffff8000102e950

    STACK_TEXT:  
    fffffadf`257d2448 fffff800`010a58f2 : 00000000`00000050 fffffadf`52a90526 00000000`00000000 fffffadf`257d2520 : nt!KeBugCheckEx
    fffffadf`257d2450 fffff800`0102d519 : fffffadf`39697750 00000000`00000000 fffffadf`00000000 fffffadf`32aaef40 : nt!MmAccessFault+0xa1f
    fffffadf`257d2520 fffffadf`2798f290 : fffffadf`2798c8dd 00000000`00000000 fffffadf`39697750 00000000`00000000 : nt!KiPageFault+0x119
    fffffadf`257d26b8 fffffadf`2798c8dd : 00000000`00000000 fffffadf`39697750 00000000`00000000 fffffadf`39a8e670 : disk!memmove+0x60
    fffffadf`257d26c0 fffffadf`29a5637a : fffff800`c0100080 fffffadf`257d2950 fffffadf`32aa8440 fffffadf`257d2cf0 : disk!DiskDeviceControl+0x7ed
    fffffadf`257d2930 fffff800`01379339 : fffffadf`32aa8440 fffffadf`257d2cf0 00000000`00000000 fffffadf`32aa8440 : PartMgr!PmDeviceControl+0x4aa
    fffffadf`257d29c0 fffffadf`27937922 : ffffffff`ffffffff 00000000`20206f49 fffffadf`32aa8440 fffffadf`38e6c620 : nt!RawDispatch+0x159
    fffffadf`257d2a10 fffff800`01280111 : 00000000`00000000 fffffadf`257d2cf0 00000000`00000001 fffffadf`32aaef40 : fltMgr!FltpDispatch+0x1c2
    fffffadf`257d2a70 fffff800`0127fc16 : 00000000`000003f8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa79
    fffffadf`257d2b90 fffff800`0102e3fd : fffffadf`32911c20 fffffadf`32acd840 fffffadf`32911f00 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
    fffffadf`257d2c00 00000000`78ee0a5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
    00000000`02aed1f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x78ee0a5a



    • Edited by bendsha Tuesday, October 21, 2014 9:27 AM
    • Marked as answer by bendsha Tuesday, October 21, 2014 10:45 AM
    Tuesday, October 21, 2014 9:26 AM