Windbg! GetContextState failed

NTFSD
1

Hello All,

Please don’t shoot me for posting this question here. Someone has
asked a similar question on the windbg mailing list but received no
responses.

I have a crash dump from a customer, who is running Winnt SP6 on a
dual processor SMP machine. For some strange reason the symbol server
at Microsoft does not have symbols for ntkrnlmp.exe (it does have it
for ntoskrnl.exe).

When I open the crash dump in Windbg, it is littered with errors saying:

Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147

I know the problem could be due to missing kernel symbols (it has
defaulted to the PE exports), but why do I see such weird error codes
i.e. STATUS_NO_PAGEFILE?

Is there any way to make any headway in debugging this crash? !analyze
and kb don’t report anything because there is no context.

Thanks

2

This is a standard set of errors when opening an NT 4.0 crash dump
without symbols. Set up to point to the symbol server, exit and SAVE
THE WORKSPACE. Then start the debugger again. These generally go away.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of faras namus
Sent: Friday, July 21, 2006 2:35 PM
To: ntfsd redirect
Subject: [ntfsd] Windbg! GetContextState failed

Hello All,

Please don’t shoot me for posting this question here. Someone has
asked a similar question on the windbg mailing list but received no
responses.

I have a crash dump from a customer, who is running Winnt SP6 on a
dual processor SMP machine. For some strange reason the symbol server
at Microsoft does not have symbols for ntkrnlmp.exe (it does have it
for ntoskrnl.exe).

When I open the crash dump in Windbg, it is littered with errors saying:

Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147

I know the problem could be due to missing kernel symbols (it has
defaulted to the PE exports), but why do I see such weird error codes
i.e. STATUS_NO_PAGEFILE?

Is there any way to make any headway in debugging this crash? !analyze
and kb don’t report anything because there is no context.

Thanks

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

With other crash dumps yes I have seen this problem go away. However,
I was wondering why this specific error code is returned.

In this case, since Microsoft has not put up those symbols on the
symbol server, it keeps cribbing.

Also the timestamp of nt (in lmv output) shows a 2005 date, so it
looks like this machine has a custom patch or kernel and they don’t
have symbols for it available.

On 7/21/06, Tony Mason wrote:
> This is a standard set of errors when opening an NT 4.0 crash dump
> without symbols. Set up to point to the symbol server, exit and SAVE
> THE WORKSPACE. Then start the debugger again. These generally go away.
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of faras namus
> Sent: Friday, July 21, 2006 2:35 PM
> To: ntfsd redirect
> Subject: [ntfsd] Windbg! GetContextState failed
>
> Hello All,
>
> Please don’t shoot me for posting this question here. Someone has
> asked a similar question on the windbg mailing list but received no
> responses.
>
>
> I have a crash dump from a customer, who is running Winnt SP6 on a
> dual processor SMP machine. For some strange reason the symbol server
> at Microsoft does not have symbols for ntkrnlmp.exe (it does have it
> for ntoskrnl.exe).
>
> When I open the crash dump in Windbg, it is littered with errors saying:
>
> Unable to get current machine context, NTSTATUS 0xC0000147
> GetContextState failed, 0xD0000147
> GetContextState failed, 0xD0000147
> GetContextState failed, 0xD0000147
>
>
> I know the problem could be due to missing kernel symbols (it has
> defaulted to the PE exports), but why do I see such weird error codes
> i.e. STATUS_NO_PAGEFILE?
>
> Is there any way to make any headway in debugging this crash? !analyze
> and kb don’t report anything because there is no context.
>
> Thanks
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@osr.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>