*** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys

A

alotta

Member
Joined
Sep 20, 2024
Posts
12
I am not having any BSOD issues, I am just trying to set up my debugger correctly, what should I do to resolve?

Perhaps it is just trying to load symbol from problem machine?

This may not even be an issue
 
When setting up the debugger for the first time, this may occur from time to time. I don't know if things have changed from the time I started, but many years ago when I had this issue (many times) I reopened the dump a couple of times and let the debugger automatically download the necessary symbols. If that's not working, double check you've set up the debugger correctly in which case, could you share how you've set up the debugger
 
axe0 said:
let the debugger automatically download the necessary symbols.
Click to expand...
Is there a certain command to start a download?


axe0 said:
could you share how you've set up the debugger
Click to expand...

Download the Windows Driver Kit (WDK) - Windows drivers Went thru this process.

But I am sure that there is something I missed. Perhaps you could explain setting up using...

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\windbg.exe



ubuysa said:
The Microsoft public symbol server is at Symbol information
Click to expand...

Yes machine is set to use symbol server.



Code: 
DBGHELP: Symbol Search Path: C:\WindowsSymbols;https://msdl.microsoft.com/download/symbols
DBGHELP: No header for C:\Windows\System32\win32k.sys.  Searching for image on disk
DBGHELP: C:\Windows\System32\win32k.sys - OK
DBGHELP: C:\WindowsSymbols\win32k.pdb - file not found
DBGHELP: C:\WindowsSymbols\sys\win32k.pdb - file not found
DBGHELP: C:\WindowsSymbols\symbols\sys\win32k.pdb - file not found
SYMSRV:  BYINDEX: 0x1
         https://msdl.microsoft.com/download/symbols
         win32k.pdb
         4861D9D8CC375CC7E28E23C9A6E302D71
SYMSRV:  UNC: C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\win32k.pdb - path not found
SYMSRV:  UNC: C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\win32k.pd_ - path not found
SYMSRV:  UNC: C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\file.ptr - path not found
SYMSRV:  HTTPGET: /download/symbols/index2.txt
SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/win32k.pdb/4861D9D8CC375CC7E28E23C9A6E302D71/win32k.pdb
SYMSRV:  HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV:  UNC: C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\win32k.pdb - path not found
SYMSRV:  UNC: C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\win32k.pd_ - path not found
SYMSRV:  UNC: C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\file.ptr - path not found
SYMSRV:  win32k.pdb from https://msdl.microsoft.com/download/symbols: 936960 bytes -                0 
percent   0 percent copied      
SYMSRV:  PATH: C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\win32k.pdb
SYMSRV:  RESULT: 0x00000000
DBGHELP: win32k - public symbols  
        C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\win32k.pdb
[SYMCHK] MODULE64 Info ----------------------
[SYMCHK] Struct size: 1680 bytes
[SYMCHK] Base: 0xFFFFF97FFF000000
[SYMCHK] Image size: 634880 bytes
[SYMCHK] Date: 0x62066f9f
[SYMCHK] Checksum: 0x000925a6
[SYMCHK] NumSyms: 0
[SYMCHK] SymType: SymPDB
[SYMCHK] ModName: win32k
[SYMCHK] ImageName: C:\Windows\System32\win32k.sys
[SYMCHK] LoadedImage: C:\Windows\System32\win32k.sys
[SYMCHK] PDB: "C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\win32k.pdb"
[SYMCHK] CV: RSDS
[SYMCHK] CV DWORD: 0x53445352
[SYMCHK] CV Data:  win32k.pdb
[SYMCHK] PDB Sig:  0
[SYMCHK] PDB7 Sig: {4861D9D8-CC37-5CC7-E28E-23C9A6E302D7}
[SYMCHK] Age: 1
[SYMCHK] PDB Matched:  TRUE
[SYMCHK] DBG Matched:  TRUE
[SYMCHK] Line numbers: FALSE
[SYMCHK] Global syms:  FALSE
[SYMCHK] Type Info:    TRUE
[SYMCHK] ------------------------------------
SymbolCheckVersion  0x00000002
Result              0x00130001
DbgFilename         
DbgTimeDateStamp    0x62066f9f
DbgSizeOfImage      0x0009b000
DbgChecksum         0x000925a6
PdbFilename         C:\Program Files (x86)\Windows 
Kits\10\Debuggers\x64\sym\win32k.pdb\4861D9D8CC375CC7E28E23C9A6E302D71\win32k.pdb
PdbSignature        {4861D9D8-CC37-5CC7-E28E-23C9A6E302D7}
PdbDbiAge           0x00000001
[SYMCHK] [ 0x00000000 - 0x00130001 ] Checked "C:\Windows\System32\win32k.sys"
[SYMCHK] Using search path "C:\WindowsSymbols;https://msdl.microsoft.com/download/symbols"

SYMCHK: FAILED files = 0
SYMCHK: PASSED + IGNORED files = 1
Verifying symbols for C:\Windows\System32\ntoskrnl.exe
[SYMCHK] Using search path "C:\WindowsSymbols;https://msdl.microsoft.com/download/symbols"

SYMCHK: FAILED files = 0
SYMCHK: PASSED + IGNORED files = 1
symchk.exe : [SYMCHK] Searching for symbols to C:\Windows\System32\ntoskrnl.exe in path 
C:\WindowsSymbols;https://msdl.microsoft.com/download/symbols
At C:\Users\usernamehere\Desktop\2343.ps1:53 char:19
 
What's the input for the Symbol Search Path?
 
Mine looks like this
Code: 
SRV*E:\Symbols*https://msdl.microsoft.com/download/symbols
 
Delete your symbols and restart the debugger to download the correct symbols.
 
OK. I will get back to this in a few. Thanks for the help, I will let you know how it goes. I am pretty sure I have tried that, but I'll give it another shot.

Been thru the steps at this link as well.
 
We have our guide for Windbg Preview, but the symbol path is the relevant portion for it which is like what I have posted except the local path to which the symbols are stored is different.
Getting Started with WinDbg Preview
 
My symbol search path is the same as that which @axe0 posted. Mine is...
Code: 
srv*W:\SymCache*https://msdl.microsoft.com/download/symbols.

Are you using the SDK debugger or WinDng Preview? If you can't get the SDK version to work try using WinDbg Preview - get it from the Microsoft Store.
 
Can you detail the exact steps you took as if you set up the debugger for the first time? Here I really mean the steps you took, not what any guide or tutorial is describing.
 
I think it is best that I just try and setup everything on another computer. I was planning on doing a fresh install of windows 10 on a laptop I have. I will let you know when I have it going and perhaps we can trouble shoot this from the start, any suggestiions before I download anything on the machine, which debugger what to install first??
 
Personally I have migrated away from the SDK version of WinDbg and I now almost exclusively use WinDbg Preview.
 
alotta said:
Is there a certain command to start a download?
Click to expand...
You can use .reload /f win32k.sys to force a redownload of that particular symbol.

axe0 said:
What's the input for the Symbol Search Path?
Click to expand...
It's listed at the top of the log excerpt:

Code: 
DBGHELP: Symbol Search Path: C:\WindowsSymbols;https://msdl.microsoft.com/download/symbols

There are no issues with that symbol path, WinDbg will search for each location in order and then only fallback to the public symbol server if the symbol hasn't been cached locally.

It looks like the symbol did get downloaded correctly from the symbol server. I should imagine the issue is due to:

Code: 
DBGHELP: No header for C:\Windows\System32\win32k.sys.  Searching for image on disk

@alotta Have you tried the following from WinDbg?

Code: 
!sym noisy; .reload /f win32k.sys
 
Ok, clean install of windows 10 updated fully:

Programs installed:

Firefox:
UblockOrigin addon.
WinDbg Preview.

Clean slate, same issue:

What to do?

Direct me to a .DMP file. I'll run it post the result.
 
Back
Top