title: Trying to Analyze Dump File with WinDbg: PEB is Paged Out, Won't load symbols
body: <p>Hi I'm trying to use WinDbg to look at a memory.dmp kernel dump file with the aim of diagnosing a crash. When I open the crash file and get the symbols I get the message </p>
  
  <pre><code>BugCheck A, {2, ff, 4e, fffff801a42ebff2}
  
  CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
  CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
  Probably caused by : ntkrnlmp.exe ( nt!KxWaitForLockOwnerShipWithIrql+12 )
  
  Followup:     MachineOwner
  ---------
  
  0: kd&gt; .reload
  Loading Kernel Symbols
  ..................................CompressedPageDataReader warning: failed      to get _SM_PAGE_KEY symbol.
  
  Loading User Symbols
  PEB is paged out (Peb.Ldr = 000000e1`114f4018).  Type ".hh dbgerr001" for details
  </code></pre>
  
  <p>Which I assume means it can't load some of the symbols. When I try the !vad process to fix the PEB page error I get </p>
  
  <pre><code>0: kd&gt; !vad 000000e1114f4018 1
  
  VAD @ ffffca0f084164e0
  Start VPN              e111400  End VPN          e1115ff  Control Area  0000000000000000
  FirstProtoPte 0000000000000000  LastPte f943916c00000002  Commit Charge               21 (0n33)
  Secured.Flink                0  Blink                  0  Banked/Extend                0
  File Offset              50005  
    ViewUnmap NoChange PrivateMemory READWRITE  
  </code></pre>
  
  <p>which doesn't correspond to what the internet tells me the result should be. </p>
  
  <p>when I try the !process method I get </p>
  
  <pre><code>0: kd&gt; !process 000000e1114f4018 1
  Searching for Process with Cid == e1114f4018
  Invalid Handle: 0x114f4018
  ***Could not retrieve process handle from the Cid table.  Searching...
  </code></pre>
  
  <p>which also is an error which doesn't load the symbols either. What is wrong? In either the symbol loading or the crash itself if there is enough info. </p>
  
  <p>NOTE: I've tried the solutions from the MSDN page and they dont work as noted. Part of the problem is I don't know if I'm using the 000000e1`114f4018 address I'm given in the PEB paged out error message correctly in the command. </p>
  
  <p>NOTE 2: Here is a link to the crash report from WinDBG. If someone can figure out the cause and explain how they figured it out that would be dandy. </p>
  
  <p><a href="https://www.scribd.com/document/326672131/Crash-Archive" rel="nofollow">https://www.scribd.com/document/326672131/Crash-Archive</a></p>