代码之家 › 专栏 › 技术社区 › Martin Ba

为什么WinDBG在转储中显示不匹配的FileVersion?

rsrc fileversioninfo memory-dump portable-executable windbg

1

Martin Ba · 技术社区 · 12 年前

TL;博士

为什么WinDBG lmv 显示两个版本信息字段(据我所知,没有其他工具这样做),在什么情况下这些字段会有所不同?

背景:我有一个应用程序的实时转储(来自死锁)。符号加载正确,我能够将死锁追溯到Microsoft的 pdm.dll (用于我们的vbscript引擎的“进程调试管理器”)。

然后我想检查这个DLL的哪个版本是在生产站点的会话中加载的:

0:000> lmv m pdm
start    end        module name
51860000 518b8000   pdm      # (pdb symbols)          d:\symcache\pdm.pdb\7BE601EDE9234816B72B49DA4A25DF042\pdm.pdb
    Loaded symbol image file: pdm.dll
    Image path: C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\pdm.dll
    Image name: pdm.dll
    Timestamp:        Tue Jul 29 16:46:11 2008 (488F2D33)
    CheckSum:         000663E0
    ImageSize:        00058000
??  File version:     9.0.30729.1
??  Product version:  9.0.30729.1
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      MicrosoftÂ® Visual Studio .NET
    InternalName:     pdm.dll
    OriginalFilename: pdm.dll
??  ProductVersion:   7.10.3077
??  FileVersion:      7.10.3077
    FileDescription:  Process Debug Manager
    LegalCopyright:   CopyrightÂ© Microsoft Corporation.  All rights reserved.

正如您所看到的,文件和产品版本显示了两次,但它们在转储中不匹配!

当我在机器上交叉检查(显然,请参阅时间戳和校验和!)运行的iexplore进程的相同文件时:

0:043> lmv m pdm
start    end        module name
3efa0000 3eff8000   pdm        (pdb symbols)          c:\windows\symbols\martin-cache\pdm.pdb\415D0A165EB24613BC01CE516512062C2\pdm.pdb
    Loaded symbol image file: C:\Program Files (x86)\Internet Explorer\pdm.dll
    Image path: C:\Program Files (x86)\Internet Explorer\pdm.dll
    Image name: pdm.dll
    Timestamp:        Tue Jul 29 16:46:11 2008 (488F2D33)
    CheckSum:         000663E0
    ImageSize:        00058000
    File version:     9.0.30729.1
    Product version:  9.0.30729.1
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      MicrosoftÂ® Visual StudioÂ® 2008
    InternalName:     pdm.dll
    OriginalFilename: pdm.dll
    ProductVersion:   9.0.30729.1
    FileVersion:      9.0.30729.1 built by: SP
    FileDescription:  Process Debug Manager
    LegalCopyright:   Â© Microsoft Corporation. All rights reserved.

版本信息匹配。

1 回复 | 直到 12 年前

1

2

Kjell Gunnar 12 年前

lmv显示在资源文件中定义的字符串,

enter image description here

我不知道为什么除了一些空格之外,两组文件/产品版本的名称是相同的。

0:041> lmv m kernel32
start    end        module name
753e0000 754f0000   kernel32   (deferred)             
    Image path: C:\Windows\SysWOW64\kernel32.dll
    Image name: kernel32.dll
    Timestamp:        Fri Aug 02 03:53:25 2013 (51FB1115)
    CheckSum:         00111A9F
    ImageSize:        00110000
    File version:     6.1.7601.18229
    Product version:  6.1.7601.18229
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      MicrosoftÂ® WindowsÂ® Operating System
    InternalName:     kernel32
    OriginalFilename: kernel32
    ProductVersion:   6.1.7601.18229
    FileVersion:      6.1.7601.18229 (win7sp1_gdr.130801-1533)

在您的情况下,您有两个不同的dll,请查看图像文件路径。

Image path: C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\

和

Image path: C:\Program Files (x86)\Internet Explorer

它们在资源部分必须有不同的字符串,winDbg除了显示它之外什么都不能做。由于时间戳是相同的,其中一个可能被篡改了。