A forum for reverse engineering, OS internals and malware analysis 

Discussion on reverse-engineering and debugging.
 #17951  by myid
 Thu Jan 31, 2013 8:02 pm
Hello everyone, this is a strange problem.
WINDBG (and my program) cannot download ATAPORT.PDB of WIN8X64.
But WINDBG (and my program) can download ATAPORT.PDB of WIN7X64.
What is the reason? M$ do not want to publish the ATAPORT.PDB of WIN8X64?
Code: Select all
1: kd> !drvobj atapi 2
Driver object (fffffa8031efd3e0) is for:
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ataport.SYS - 
 \Driver\atapi
DriverEntry:   fffff8800150cca0	atapi
DriverStartIo: 00000000	
DriverUnload:  fffff880015337d0	ataport!DllUnload
AddDevice:     fffff88001536188	ataport!DllUnload

Dispatch routines:
[00] IRP_MJ_CREATE                      fffff8800153a508	ataport!DllUnload+0x6ef4
[01] IRP_MJ_CREATE_NAMED_PIPE           fffff801682bf370	nt!IopInvalidDeviceRequest
[02] IRP_MJ_CLOSE                       fffff8800153a508	ataport!DllUnload+0x6ef4
[03] IRP_MJ_READ                        fffff801682bf370	nt!IopInvalidDeviceRequest
[04] IRP_MJ_WRITE                       fffff801682bf370	nt!IopInvalidDeviceRequest
[05] IRP_MJ_QUERY_INFORMATION           fffff801682bf370	nt!IopInvalidDeviceRequest
[06] IRP_MJ_SET_INFORMATION             fffff801682bf370	nt!IopInvalidDeviceRequest
[07] IRP_MJ_QUERY_EA                    fffff801682bf370	nt!IopInvalidDeviceRequest
[08] IRP_MJ_SET_EA                      fffff801682bf370	nt!IopInvalidDeviceRequest
[09] IRP_MJ_FLUSH_BUFFERS               fffff801682bf370	nt!IopInvalidDeviceRequest
[0a] IRP_MJ_QUERY_VOLUME_INFORMATION    fffff801682bf370	nt!IopInvalidDeviceRequest
[0b] IRP_MJ_SET_VOLUME_INFORMATION      fffff801682bf370	nt!IopInvalidDeviceRequest
[0c] IRP_MJ_DIRECTORY_CONTROL           fffff801682bf370	nt!IopInvalidDeviceRequest
[0d] IRP_MJ_FILE_SYSTEM_CONTROL         fffff801682bf370	nt!IopInvalidDeviceRequest
[0e] IRP_MJ_DEVICE_CONTROL              fffff8800151b000	ataport!AtaPortInitialize+0x154
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL     fffff8800151afe0	ataport!AtaPortInitialize+0x134
[10] IRP_MJ_SHUTDOWN                    fffff801682bf370	nt!IopInvalidDeviceRequest
[11] IRP_MJ_LOCK_CONTROL                fffff801682bf370	nt!IopInvalidDeviceRequest
[12] IRP_MJ_CLEANUP                     fffff801682bf370	nt!IopInvalidDeviceRequest
[13] IRP_MJ_CREATE_MAILSLOT             fffff801682bf370	nt!IopInvalidDeviceRequest
[14] IRP_MJ_QUERY_SECURITY              fffff801682bf370	nt!IopInvalidDeviceRequest
[15] IRP_MJ_SET_SECURITY                fffff801682bf370	nt!IopInvalidDeviceRequest
[16] IRP_MJ_POWER                       fffff8800151b020	ataport!AtaPortInitialize+0x174
[17] IRP_MJ_SYSTEM_CONTROL              fffff880015337a4	ataport!DllUnload+0x190
[18] IRP_MJ_DEVICE_CHANGE               fffff801682bf370	nt!IopInvalidDeviceRequest
[19] IRP_MJ_QUERY_QUOTA                 fffff801682bf370	nt!IopInvalidDeviceRequest
[1a] IRP_MJ_SET_QUOTA                   fffff801682bf370	nt!IopInvalidDeviceRequest
[1b] IRP_MJ_PNP                         fffff8800153369c	ataport!DllUnload+0x88
I don't know why WINDBG only cannot download ATAPORT.PDB.
Other PDB file is normal. Like this:
Code: Select all
0: kd> !drvobj disk 2
Driver object (fffffa8032507e30) is for:
 \Driver\disk
DriverEntry:   fffff8800160215c	disk!GsDriverEntry
DriverStartIo: 00000000	
DriverUnload:  fffff8800129bacc	CLASSPNP!ClassUnload
AddDevice:     fffff88001297440	CLASSPNP!ClassAddDevice

Dispatch routines:
[00] IRP_MJ_CREATE                      fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[01] IRP_MJ_CREATE_NAMED_PIPE           fffff801682bf370	nt!IopInvalidDeviceRequest
[02] IRP_MJ_CLOSE                       fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[03] IRP_MJ_READ                        fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[04] IRP_MJ_WRITE                       fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[05] IRP_MJ_QUERY_INFORMATION           fffff801682bf370	nt!IopInvalidDeviceRequest
[06] IRP_MJ_SET_INFORMATION             fffff801682bf370	nt!IopInvalidDeviceRequest
[07] IRP_MJ_QUERY_EA                    fffff801682bf370	nt!IopInvalidDeviceRequest
[08] IRP_MJ_SET_EA                      fffff801682bf370	nt!IopInvalidDeviceRequest
[09] IRP_MJ_FLUSH_BUFFERS               fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[0a] IRP_MJ_QUERY_VOLUME_INFORMATION    fffff801682bf370	nt!IopInvalidDeviceRequest
[0b] IRP_MJ_SET_VOLUME_INFORMATION      fffff801682bf370	nt!IopInvalidDeviceRequest
[0c] IRP_MJ_DIRECTORY_CONTROL           fffff801682bf370	nt!IopInvalidDeviceRequest
[0d] IRP_MJ_FILE_SYSTEM_CONTROL         fffff801682bf370	nt!IopInvalidDeviceRequest
[0e] IRP_MJ_DEVICE_CONTROL              fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL     fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[10] IRP_MJ_SHUTDOWN                    fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[11] IRP_MJ_LOCK_CONTROL                fffff801682bf370	nt!IopInvalidDeviceRequest
[12] IRP_MJ_CLEANUP                     fffff801682bf370	nt!IopInvalidDeviceRequest
[13] IRP_MJ_CREATE_MAILSLOT             fffff801682bf370	nt!IopInvalidDeviceRequest
[14] IRP_MJ_QUERY_SECURITY              fffff801682bf370	nt!IopInvalidDeviceRequest
[15] IRP_MJ_SET_SECURITY                fffff801682bf370	nt!IopInvalidDeviceRequest
[16] IRP_MJ_POWER                       fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[17] IRP_MJ_SYSTEM_CONTROL              fffff8800125b490	CLASSPNP!ClassGlobalDispatch
[18] IRP_MJ_DEVICE_CHANGE               fffff801682bf370	nt!IopInvalidDeviceRequest
[19] IRP_MJ_QUERY_QUOTA                 fffff801682bf370	nt!IopInvalidDeviceRequest
[1a] IRP_MJ_SET_QUOTA                   fffff801682bf370	nt!IopInvalidDeviceRequest
[1b] IRP_MJ_PNP                         fffff8800125b490	CLASSPNP!ClassGlobalDispatch
 #17953  by myid
 Fri Feb 01, 2013 12:53 am
r2nwcnydc wrote:Run:
Code: Select all
!sym noisy
.reload ataport.sys
What does the output say?
Hi, it return these:
1: kd> !sym noisy
noisy mode - symbol prompts on
1: kd> .reload ataport.sys
1: kd> !drvobj atapi 2
Driver object (fffffa8031ac73e0) is for:
SYMSRV: c:\windows\pdb\ataport.pdb\F45F1568E4A7451DB7B48E56322B4EBD1\ataport.pdb not found
SYMSRV: http://msdl.microsoft.com/download/symb ... taport.pdb not found
SYMSRV: c:\windows\symbols\ataport.pdb\F45F1568E4A7451DB7B48E56322B4EBD1\ataport.pdb not found
SYMSRV: c:\windows\symbols\ataport.pdb\F45F1568E4A7451DB7B48E56322B4EBD1\ataport.pdb not found
SYMSRV: http://msdl.microsoft.com/download/symb ... taport.pdb not found
DBGHELP: ataport.pdb - file not found
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ataport.SYS -
DBGHELP: ataport - export symbols
\Driver\atapi
DriverEntry: fffff8800136cca0
DriverStartIo: 00000000
DriverUnload: fffff880013937d0 ataport!DllUnload
AddDevice: fffff88001396188 ataport!DllUnload

Dispatch routines:
[00] IRP_MJ_CREATE fffff8800139a508 ataport!DllUnload+0x6ef4
[01] IRP_MJ_CREATE_NAMED_PIPE fffff8007724a370 nt!IopInvalidDeviceRequest
[02] IRP_MJ_CLOSE fffff8800139a508 ataport!DllUnload+0x6ef4
[03] IRP_MJ_READ fffff8007724a370 nt!IopInvalidDeviceRequest
[04] IRP_MJ_WRITE fffff8007724a370 nt!IopInvalidDeviceRequest
[05] IRP_MJ_QUERY_INFORMATION fffff8007724a370 nt!IopInvalidDeviceRequest
[06] IRP_MJ_SET_INFORMATION fffff8007724a370 nt!IopInvalidDeviceRequest
[07] IRP_MJ_QUERY_EA fffff8007724a370 nt!IopInvalidDeviceRequest
[08] IRP_MJ_SET_EA fffff8007724a370 nt!IopInvalidDeviceRequest
[09] IRP_MJ_FLUSH_BUFFERS fffff8007724a370 nt!IopInvalidDeviceRequest
[0a] IRP_MJ_QUERY_VOLUME_INFORMATION fffff8007724a370 nt!IopInvalidDeviceRequest
[0b] IRP_MJ_SET_VOLUME_INFORMATION fffff8007724a370 nt!IopInvalidDeviceRequest
[0c] IRP_MJ_DIRECTORY_CONTROL fffff8007724a370 nt!IopInvalidDeviceRequest
[0d] IRP_MJ_FILE_SYSTEM_CONTROL fffff8007724a370 nt!IopInvalidDeviceRequest
[0e] IRP_MJ_DEVICE_CONTROL fffff8800137b000 ataport!AtaPortInitialize+0x154
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL fffff8800137afe0 ataport!AtaPortInitialize+0x134
[10] IRP_MJ_SHUTDOWN fffff8007724a370 nt!IopInvalidDeviceRequest
[11] IRP_MJ_LOCK_CONTROL fffff8007724a370 nt!IopInvalidDeviceRequest
[12] IRP_MJ_CLEANUP fffff8007724a370 nt!IopInvalidDeviceRequest
[13] IRP_MJ_CREATE_MAILSLOT fffff8007724a370 nt!IopInvalidDeviceRequest
[14] IRP_MJ_QUERY_SECURITY fffff8007724a370 nt!IopInvalidDeviceRequest
[15] IRP_MJ_SET_SECURITY fffff8007724a370 nt!IopInvalidDeviceRequest
[16] IRP_MJ_POWER fffff8800137b020 ataport!AtaPortInitialize+0x174
[17] IRP_MJ_SYSTEM_CONTROL fffff880013937a4 ataport!DllUnload+0x190
[18] IRP_MJ_DEVICE_CHANGE fffff8007724a370 nt!IopInvalidDeviceRequest
[19] IRP_MJ_QUERY_QUOTA fffff8007724a370 nt!IopInvalidDeviceRequest
[1a] IRP_MJ_SET_QUOTA fffff8007724a370 nt!IopInvalidDeviceRequest
[1b] IRP_MJ_PNP fffff8800139369c ataport!DllUnload+0x88