当dd user32!gSharedInfo时,是正常的,但是dt user32!tagSHAREDINFO <地址> 时就说“ Your debugger is not using the correct symbols ”,如下:
kd> dd user32!gSharedInfo
77d710a0 003a0650 002e0000 003a1588 bc230000
77d710b0 00000318 003a1758 00000000 00000000
77d710c0 00000318 003a17c8 00000014 003a1838
77d710d0 00000000 00000000 00000000 00000000
77d710e0 00000000 00000000 00000318 003a18b8
77d710f0 00000318 003a1998 00000318 003a1a08
77d71100 00000402 003a16c8 00000318 003a1a78
77d71110 00000318 003a1928 00000000 00000000
kd> dt user32!tagSHAREDINFO 77d710a0
*************************************************************************
***
***
*** Your debugger is not using the correct symbols
***
*** In order for this command to work properly, your symbol path
*** must point to .pdb files that have full type information.
***
*** Certain .pdb files (such as the public OS symbols) do not
*** contain the required information. Contact the group that
*** provided you with these symbols if you need this command to
*** work.
***
*** Type referenced: user32!tagSHAREDINFO
***
*************************************************************************
Symbol user32!tagSHAREDINFO not found.
其它的命令都是正常的,比如dt _TEB, dt _KUSER_SHARED_DATA。
刚开始,符号是调试器自动从网上下载。后来把调试器下载的符号全删了,去微软的网上下了XP SP3 x86 symbols 完整版的retail和checked版,但是分别手动安装这两个版本后还是没解决。