ufrisk / MemProcFS

MemProcFS
GNU Affero General Public License v3.0
2.96k stars 362 forks source link

Ubuntu 24.04 symbol problem #309

Closed tuttimann closed 2 weeks ago

tuttimann commented 1 month ago

I tried to use MemProcFS 5.11.3 on Ubuntu 24.04 with internet connection and got the following error message:

[SYMBOL]   Functionality may be limited. Extended debug information disabled.
[SYMBOL]   Partial offline fallback symbols in use.
[SYMBOL]   For additional information use startup option: -loglevel symbol:4
[SYMBOL]   Reason: Unable to download kernel symbols to cache from Symbol Server.

[SYMBOL]   Initialized symbol subsystem (Rust).

The same memory image produces no error messages while using MemProcFS on Windows.

ufrisk commented 4 weeks ago

I've tested this on Ubuntu 22.04 with the latest binary download from the releases section and it works just fine for me.

Do you have an Internet connection? Is the Symbols sub-folder (in MemProcFS folder) writable? Do you have openssl installed (a potential dependency of the symbol sub-system).

tuttimann commented 4 weeks ago

I am using Ubuntu 24.04 and not 22.04. Yes, I have an internet connection.

tuttimann commented 4 weeks ago

I tried the newest version 5.11.4 on Ubuntu 24.04 and now get a more detailed error message:

[SYMBOL]   Unable to download required debug symbols ntkrnlmp.pdb - manual download possible.
[SYMBOL]   Download from:
[SYMBOL]     https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb
[SYMBOL]   Download to:
[SYMBOL]     /home/fabian/Tools/MemProcFS/MemProcFS_files_and_binaries_v5.11.4-linux_x64-20240814/Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb
[SYMBOL]   Functionality may be limited. Extended debug information disabled.
[SYMBOL]   Partial offline fallback symbols in use.
[SYMBOL]   For additional information use startup option: -loglevel symbol:4
[SYMBOL]   Reason: Unable to download kernel symbols to cache from Symbol Server.

[SYMBOL]   Initialized symbol subsystem (Rust).
tuttimann commented 4 weeks ago

Yes, openssl is installed in following version: 3.0.13-0ubuntu3.2

ufrisk commented 3 weeks ago

Sorry about that, I meant Ubuntu 24.04. I tested this on my Ubuntu 24.04 system and it works fine.

Does your folder: /home/fabian/Tools/MemProcFS/MemProcFS_files_and_binaries_v5.11.4-linux_x64-20240814/Symbols/ exists? And is it writable by the current user?

Worst case the error message tells you that you may do this manually, i.e. download the file from the symbol server and rename it / place it where requested.

ufrisk commented 2 weeks ago

I'm closing the issue since I was unable to replicate the issue on Ubuntu 24.04. If the error persists let me know. But first make sure the symbol in question is downloadable from the system you use. Sometimes the symbol server may go offiline or symbols may be missing. Or there may be an issue with the internet connection temporarily.