title: !process 0 0 - NT symbols are incorrect, please fix symbols
body: <p>I get the same error when using <code>!process 0 0</code> every time - being in kernel debug mode or not doesn't seem to change anything.</p>
  <p>Here's a command chain while opening <code>notepad.exe</code></p>
  <pre><code>Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
  Copyright (c) Microsoft Corporation. All rights reserved.
  
  CommandLine: C:\Windows\System32\notepad.exe
  
  ************* Path validation summary **************
  Response                         Time (ms)     Location
  Deferred                                       srv*
  DBGHELP: Symbol Search Path: cache*;SRV*https://msdl.microsoft.com/download/symbols
  Symbol search path is: srv*
  Executable search path is: 
  ModLoad: 00007ff6`27eb0000 00007ff6`27ee8000   notepad.exe
  ModLoad: 00007ffe`fb890000 00007ffe`fba86000   ntdll.dll
  ModLoad: 00007ffe`f9990000 00007ffe`f9a4d000   C:\WINDOWS\System32\KERNEL32.DLL
  ModLoad: 00007ffe`f90b0000 00007ffe`f9379000   C:\WINDOWS\System32\KERNELBASE.dll
  ModLoad: 00007ffe`fb820000 00007ffe`fb84a000   C:\WINDOWS\System32\GDI32.dll
  ModLoad: 00007ffe`f8fd0000 00007ffe`f8ff2000   C:\WINDOWS\System32\win32u.dll
  ModLoad: 00007ffe`f9580000 00007ffe`f968b000   C:\WINDOWS\System32\gdi32full.dll
  ModLoad: 00007ffe`f9380000 00007ffe`f941d000   C:\WINDOWS\System32\msvcp_win.dll
  ModLoad: 00007ffe`f9420000 00007ffe`f9520000   C:\WINDOWS\System32\ucrtbase.dll
  ModLoad: 00007ffe`faff0000 00007ffe`fb190000   C:\WINDOWS\System32\USER32.dll
  ModLoad: 00007ffe`fa110000 00007ffe`fa466000   C:\WINDOWS\System32\combase.dll
  ModLoad: 00007ffe`fb440000 00007ffe`fb56b000   C:\WINDOWS\System32\RPCRT4.dll
  ModLoad: 00007ffe`fadc0000 00007ffe`fae6e000   C:\WINDOWS\System32\shcore.dll
  ModLoad: 00007ffe`fa4d0000 00007ffe`fa56e000   C:\WINDOWS\System32\msvcrt.dll
  ModLoad: 00007ffe`e2d70000 00007ffe`e300b000   C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.746_none_ca02b4b61b8320a4\COMCTL32.dll
  (1208.ff0): Break instruction exception - code 80000003 (first chance)
  SYMSRV:  BYINDEX: 0x1
           C:\ProgramData\Dbg\sym
           ntdll.pdb
           432F2B8588C52E47219EE25E35F653491
  SYMSRV:  PATH: C:\ProgramData\Dbg\sym\ntdll.pdb\432F2B8588C52E47219EE25E35F653491\ntdll.pdb
  SYMSRV:  RESULT: 0x00000000
  DBGHELP: ntdll - public symbols  
          C:\ProgramData\Dbg\sym\ntdll.pdb\432F2B8588C52E47219EE25E35F653491\ntdll.pdb
  ntdll!LdrpDoDebuggerBreak+0x30:
  00007ffe`fb960670 cc              int     3
  </code></pre>
  <p>The <code>.sympath</code> command :</p>
  <pre><code>0:000&gt; .sympath 
  Symbol search path is: srv*
  Expanded Symbol search path is: cache*;SRV*https://msdl.microsoft.com/download/symbols
  
  ************* Path validation summary **************
  Response                         Time (ms)     Location
  Deferred  
  </code></pre>
  <p>The <code>.reload</code> command :</p>
  <pre><code>0:000&gt; .reload
  Reloading current modules
  ...............SYMSRV:  BYINDEX: 0x3
           C:\ProgramData\Dbg\sym
           ntdll.pdb
           432F2B8588C52E47219EE25E35F653491
  SYMSRV:  PATH: C:\ProgramData\Dbg\sym\ntdll.pdb\432F2B8588C52E47219EE25E35F653491\ntdll.pdb
  SYMSRV:  RESULT: 0x00000000
  DBGHELP: ntdll - public symbols  
          C:\ProgramData\Dbg\sym\ntdll.pdb\432F2B8588C52E47219EE25E35F653491\ntdll.pdb
  </code></pre>
  <p>Finally the <code>!process 0 0</code> command :</p>
  <pre><code>0:000&gt; !process 0 0
  **** NT ACTIVE PROCESS DUMP ****
  Could not get address of nt!KdVersionBlock.
  unable to get nt!MmUserProbeAddress
  NT symbols are incorrect, please fix symbols
  </code></pre>
  <p>I don't know what is going on. I tried deleting the <code>sym\ntdll.pdb</code> folder and re-downloading it but to no avail.</p>
  <hr />
  <p>Edit - more info on request :</p>
  <pre><code>0:000&gt; !lmi nt
  Loaded Module Info: [nt] 
  DBGHELP: SharedUserData - virtual symbol module
  nt not found
  0:000&gt; vertarget
  Windows 10 Version 19042 MP (16 procs) Free x64
  Product: WinNt, suite: SingleUserTS
  Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
  Build layer:            -&gt; 
  Build layer:            -&gt; 
  Build layer:            -&gt; 
  Machine Name:
  Debug session time: Wed Mar 10 18:26:22.757 2021 (UTC + 1:00)
  System Uptime: 0 days 14:38:24.474
  Process Uptime: 0 days 0:00:51.162
    Kernel time: 0 days 0:00:00.015
    User time: 0 days 0:00:00.000
  
  
  0:000&gt; lm
  start             end                 module name
  00007ff6`54910000 00007ff6`54948000   notepad    (deferred)             
  00007ffe`f9c40000 00007ffe`f9eda000   COMCTL32   (deferred)             
  00007fff`09350000 00007fff`09372000   win32u     (deferred)             
  00007fff`09540000 00007fff`095dd000   msvcp_win   (deferred)             
  00007fff`09690000 00007fff`09959000   KERNELBASE   (deferred)             
  00007fff`099e0000 00007fff`09ae0000   ucrtbase   (deferred)             
  00007fff`09b30000 00007fff`09c3b000   gdi32full   (deferred)             
  00007fff`09c70000 00007fff`09d0e000   msvcrt     (deferred)             
  00007fff`09e20000 00007fff`09ece000   shcore     (deferred)             
  00007fff`0a8d0000 00007fff`0a98d000   KERNEL32   (deferred)             
  00007fff`0aa60000 00007fff`0aa8a000   GDI32      (deferred)             
  00007fff`0aad0000 00007fff`0ac70000   USER32     (deferred)             
  00007fff`0ad00000 00007fff`0ae2b000   RPCRT4     (deferred)             
  00007fff`0b810000 00007fff`0bb65000   combase    (deferred)             
  00007fff`0bc10000 00007fff`0be05000   ntdll      (pdb symbols)          C:\ProgramData\Dbg\sym\ntdll.pdb\53F12BFE149A2F50205C8D5D66290B481\ntdll.pdb
  0:000&gt; .reload /f nt
  
  &quot;nt&quot; was not found in the image list.
  Debugger will attempt to load &quot;nt&quot; at given base 00000000`00000000.
  
  Please provide the full image name, including the extension (i.e. kernel32.dll)
  for more reliable results.Base address and size overrides can be given as
  .reload &lt;image.ext&gt;=&lt;base&gt;,&lt;size&gt;.
  SYMSRV:  BYINDEX: 0xD
           C:\ProgramData\Dbg\sym
           nt
           FFFFFFFE
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\nt - path not found
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\n_ - path not found
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\file.ptr - path not found
  SYMSRV:  RESULT: 0x80070003
  SYMSRV:  BYINDEX: 0xE
           C:\ProgramData\Dbg\sym*https://msdl.microsoft.com/download/symbols
           nt
           FFFFFFFE
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\nt - path not found
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\n_ - path not found
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\file.ptr - path not found
  SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/nt
  SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
  SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
  SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/n_
  SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
  SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
  SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/file.ptr
  SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
  SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
  SYMSRV:  RESULT: 0x80190194
  DBGHELP: C:\WINDOWS\system32\nt - file not found
  SYMSRV:  BYINDEX: 0xF
           https://msdl.microsoft.com/download/symbols
           nt
           FFFFFFFE
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\nt - path not found
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\n_ - path not found
  SYMSRV:  UNC: C:\ProgramData\Dbg\sym\nt\FFFFFFFE\file.ptr - path not found
  SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/nt
  SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
  SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
  SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/n_
  SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
  SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
  SYMSRV:  HTTPGET: /download/symbols/nt/FFFFFFFE/file.ptr
  SYMSRV:  HttpQueryInfo(HTTP_QUERY_CONTENT_LENGTH): 800C2F76 - ERROR_HTTP_HEADER_NOT_FOUND
  SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
  SYMSRV:  RESULT: 0x80190194
  DBGENG:  nt - Image mapping disallowed by non-local path.
  DBGHELP: No header for nt.  Searching for dbg file
  DBGHELP: .\nt.dbg - file not found
  DBGHELP: nt missing debug info.  Searching for pdb anyway
  DBGHELP: Can't use symbol server for nt.pdb - no header information available
  DBGHELP: nt.pdb - file not found
  *** WARNING: Unable to verify timestamp for nt
  *** ERROR: Module load completed but symbols could not be loaded for nt
  DBGHELP: nt_0 - no symbols loaded
  Unable to add module at 00000000`00000000
  </code></pre>