Using Process Explorer without an Internet Connection

Using Process Explorer without an Internet Connection

  • Comments 4
  • Likes

Last year when we wrote our post on Memory Management – Understanding Pool Resources we mentioned that it was possible to use Process Explorer to view the limit for both Paged and NonPaged Pool.  In that post  we mentioned that you would need to install the Microsoft Debugging Tools and configure the Symbol Path so that Process Explorer could pull the information for the Paged and NonPaged Pool limits.  That all seemed fairly straightforward, right?  Well, that doesn’t always work so well for every customer – we have many customers who have systems that have no Internet connectivity at all, and in some cases no connectivity to any systems outside of the subnet on which they sit.  So short of capturing a dump file (which is not always feasible) and using the !vm command to view the memory information, how can we get this information?

The answer lies in the Debugging Tools themselves.  Install the Debugging Tools and Process Explorer on the system with no Network access (which we will call ISLAND for the purposes of this post) for which you want to view the information.  You will also need to install the Debugging Tools on a system that has access to the Internet (we’ll call this system CLOUD).  Once everything is installed, we can use the SYMCHECK.EXE utility with a couple of switches and our second machine to get the symbols we need.

On ISLAND, run the following command from a command prompt.  You’ll need to change directories to the folder in which you installed the Debugging Tools:  symchk.exe /om c:\symlist /if c:\windows\system32\ntoskrnl.exe as shown below:

This will create a manifest file called SYMLIST in the C: drive that has what looks like gibberish in it if you open it up in Notepad.

The information after the file name is the checksum for the file.  This is important information because we need to make sure that we pull down the proper symbols.  Take the C:\SYMLIST file over to CLOUD and run the following command: symchk.exe /im c:\symlist /s SRV*c:\symbols*http://msdl.microsoft.com/download/symbols – what we are doing here is telling SYMCHK.EXE to read the manifest file (C:\Symlist) and then get the appropriate symbols from Microsoft’s public symbol server (http://msdl.microsoft.com/download/symbols) and create a local symbol store (C:\Symbols).  This local store will be populated with the symbols for NTOSKRNL.EXE.

Now, take the C:\Symbols folder from CLOUD and copy it over to ISLAND.  The rest of the process involves configuring Process Explorer in the same way we did earlier – point to the proper DBGHELP.DLL file and our new C:\Symbols folder and we’re ready to view our Pool limits.

You can use these same commands to generate symbols if you want to view the thread stack of a process inside Process Explorer or even if you want to debug an application on the server itself.  Below are some other useful switches for SYMCHK.EXE:

  • /if <Filename> - Input is a file name.  Wildcards can be used to specify the file name
  • /id <DumpFile> - Input is a dump file
  • /ih <HotFix> - Input is a self-extracting Hotfix cab
  • /ie <ExeName> - Input is an application name that is currently running.  If the provided ExeName is '*', all currently running processes will be checked
  • /im <ManifestList> - Input is a manifest previously created using the /om <file> option
  • /ip <ProcessId> - Input is a process id. If the provided ProcessID is '*', all currently running processes will be checked
  • /it <TextFileList>   Input is a list of files, one per line, inside of a text file

Hopefully this helps you out if you happen to be one of those customers with isolated networks!

- Sumesh P.

Share this post :
Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
  • <p>If you've got a machine that's connected to both networks (public and private), but you don't want to set up RRAS, ISA or simple routing, you can set up a proxy symbol server. See the files in C:\Program Files\Debugging Tools for Windows\symproxy for details.</p> <p>I had to do this recently -- my lab PCs are not connected to the Internet; my dev workstation is connected to my lab network and to the Internet.</p>

  • <p>Hello, I am wondering if there is a method to download symbols in advance from the Microsoft website (the hole Windows Symbol Package) and to use them for debugging (with a local upstream path, for example).</p> <p>Best Regards.</p>

  • <p>The -om/im option in symchk.exe does not work with dbg file that is used on win2k when an internet connection is not available.</p> <p>Use the symbol package download or symbol proxy instead.</p> <p><a rel="nofollow" target="_new" href="http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx">http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx</a></p>

  • <p>Everytime i try to download the symbols from the cloud i am getting the following errors.. Just wondering if somebody can help me out with this issue</p> <p>SYMSRV: &nbsp;<a rel="nofollow" target="_new" href="http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/49c22f7227e000/">http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/49c22f7227e000/</a></p> <p>ntoskrnl.exe not found</p> <p>SYMCHK: ntoskrnl.exe &nbsp; &nbsp; &nbsp; &nbsp; ERROR - Unable to download file. Error reported was</p> <p> 2</p> <p>The symbols that i download from the Microsoft <a rel="nofollow" target="_new" href="http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx#f">http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx#f</a> does not work for some reason my system i still keep seeing no symbols error message in process explorer</p> <p>Here is the output of symlist file </p> <p>ntkrnlmp.pdb,EE9924F93AA24F008A3D9032AC21DE5F2,1</p> <p>ntoskrnl.exe,49c22f7227e000,1</p> <p>Thanks for any help you can provide with this</p> <p>Raj</p>