Repository navigation
feat(symbols): fall back to a module's export table when no PDB is available - #36
Merged
Merged
Conversation
A module whose PDB no symbol source has — a vendor driver never published — indexed nothing, so k, ln and !analyze showed module+offset for its frames while the Windows debugger named functions from the image's export table in the same situation. Read the export directory of such a module's mapped image while guest memory is reachable from the loading thread, and index the named exports under the identity its CodeView record gives when the PDB cannot be acquired. A PDB indexed later under the same identity replaces the export symbols.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A module whose PDB no symbol source has — a vendor driver never published, a repro build that exists only on the crashed machine — indexed nothing:
k,lnand!analyzeshowedmodule+offsetfor its frames, while the Windows debugger names functions from the image's export table in the same situation (Symbol file: myfault.sys).The export directory of such a module's mapped image is read while guest memory is reachable from the loading thread, and the named exports are indexed under the identity the module's CodeView record gives whenever its PDB cannot be acquired — remembered unavailable, download failed, or indexing failed. Ordinal-only exports and forwarders are skipped. A PDB indexed later under the same identity replaces the export symbols, and the fallback never overwrites an indexed PDB.
Reading the exports at plan time (not at the failure) is what lets the background fetch thread publish them too: guest memory is only usable from the thread that owns a KD transport, so the exports are stashed on the load and the completion half stays files-and-network only.
Verified
A libvirt-written kernel dump of a NotMyFault 0xD1 crash (
myfault.sys, whose PDB is published nowhere):ln <faulting RIP>myfault+0x1e35myfault!nmf_fault_irql+0x35— the same symbol the Windows debugger reports for this dump!analyzefaultmyfault+0x1e35myfault!nmf_fault_irql+0x35bugcheck:000000d1|module:myfaultbugcheck:000000d1|symbol:myfault!nmf_fault_irqlmyfault+0x1530myfault!DriverEntry+0x530A driver with neither exports nor an obtainable PDB still shows
module+offset; that needs the PDB itself (--sympath-appendcovers a virtio-win ISO layout, for instance).cargo test(1241 tests, including a new unit test for the fallback and its yield-to-PDB rule),cargo clippy --all-targetsandcargo fmt --checkpass.