Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-6101

qemu: elf2dmp utility cannot process ntkrnlmp.pdb for Windows 11

XMLWordPrintable

    • qemu-kvm-tools-8.2.0-2.el9.x86_64
    • None
    • rhel-sst-virtualization
    • ssg_virtualization
    • 23
    • 25
    • None
    • QE ack, Dev ack
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Red Hat Enterprise Linux
    • None
    • Unspecified Release Note Type - Unknown
    • None

      elf2dmp utility is used to convert QEMU memory dumps to Windows kernel dumps.
      eld2dmp fails to handle some of the Windows 11 memory dumps.

      Main reason:
      pdb.c has the following check:

      if (symbols->stream_index_size != sizeof(PDB_STREAM_INDEXES))

      { err = 1; goto out_symbols; }

      This Windows 11 kernel PDB fails the check: https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/ee6818ebc82f1f08ba8ebb2fd12196c01/ntkrnlmp.pdb

      The check code is taken from Wine: https://github.com/wine-mirror/wine/blob/master/tools/winedump/pdb.c

      Earlier, symbols->stream_index_size was 22, now it is 24.

              yvugenfi@redhat.com Yan Vugenfirer
              yvugenfi@redhat.com Yan Vugenfirer
              virt-maint virt-maint
              Wenkang Ji Wenkang Ji
              Votes:
              0 Vote for this issue
              Watchers:
              13 Start watching this issue

                Created:
                Updated:
                Resolved: