Why and how is the module name of ntoskrnl.exe displayed as "nt" rather than "ntoskrnl"?

Hi experts,

I find a weird problem with the WinDBG command 'lm n t':

kd> lm n t
start end module name
7c920000 7c9b4000 ntdll ntdll.dll Tue Aug 17 07:38:36 2004
(4121457C)
804d8000 806ec600 nt ntoskrnl.exe Wed Aug 04 14:19:48 2004
(41108004)
806ed000 80700d80 hal halacpi.dll Wed Aug 04 13:59:04 2004
(41107B28)
bf800000 bf9c0200 win32k win32k.sys Wed Aug 04 14:17:30 2004
(41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 14:00:51 2004
(41107B93)
.....

All of the module names except 'nt' are their image name without
extention. Why?

I also wonder how the debugger determines the module name of a given
kernel module?

Any help will be highly appreciated. Thanks in advance.

RossettoeCioccolato
Sun Aug 26 23:06:01 CDT 2007

xmllmx,

Perhaps you should ask this question over on the
microsoft.public.windbg newsgroup.

Regards,

Rossetoecioccolato.

"xmllmx" <xmllmx@gmail.com> wrote in message
news:1188177590.066629.6310@i38g2000prf.googlegroups.com...
> Hi experts,
>
> I find a weird problem with the WinDBG command 'lm n t':
>
> kd> lm n t
> start end module name
> 7c920000 7c9b4000 ntdll ntdll.dll Tue Aug 17 07:38:36 2004
> (4121457C)
> 804d8000 806ec600 nt ntoskrnl.exe Wed Aug 04 14:19:48 2004
> (41108004)
> 806ed000 80700d80 hal halacpi.dll Wed Aug 04 13:59:04 2004
> (41107B28)
> bf800000 bf9c0200 win32k win32k.sys Wed Aug 04 14:17:30 2004
> (41107F7A)
> bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 14:00:51 2004
> (41107B93)
> .....
>
> All of the module names except 'nt' are their image name without
> extention. Why?
>
> I also wonder how the debugger determines the module name of a given
> kernel module?
>
> Any help will be highly appreciated. Thanks in advance.
>

Doron
Mon Aug 27 13:16:39 CDT 2007

this is because there are many different kernels (and HALs). this alias
makes it very easty to refer to the kernel or hal generically, such as
nt!IoCreateDevice.

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"xmllmx" <xmllmx@gmail.com> wrote in message
news:1188177590.066629.6310@i38g2000prf.googlegroups.com...
> Hi experts,
>
> I find a weird problem with the WinDBG command 'lm n t':
>
> kd> lm n t
> start end module name
> 7c920000 7c9b4000 ntdll ntdll.dll Tue Aug 17 07:38:36 2004
> (4121457C)
> 804d8000 806ec600 nt ntoskrnl.exe Wed Aug 04 14:19:48 2004
> (41108004)
> 806ed000 80700d80 hal halacpi.dll Wed Aug 04 13:59:04 2004
> (41107B28)
> bf800000 bf9c0200 win32k win32k.sys Wed Aug 04 14:17:30 2004
> (41107F7A)
> bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 14:00:51 2004
> (41107B93)
> .....
>
> All of the module names except 'nt' are their image name without
> extention. Why?
>
> I also wonder how the debugger determines the module name of a given
> kernel module?
>
> Any help will be highly appreciated. Thanks in advance.
>

xmllmx
Mon Aug 27 17:01:20 CDT 2007

On Aug 28, 2:16 am, "Doron Holan [MSFT]" <dor...@online.microsoft.com>
wrote:
> this is because there are many different kernels (and HALs). this alias
> makes it very easty to refer to the kernel or hal generically, such as
> nt!IoCreateDevice.
>
> d
>
> --
> Please do not send e-mail directly to this alias. this alias is for
> newsgroup purposes only.
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "xmllmx" <xml...@gmail.com> wrote in message
>
> news:1188177590.066629.6310@i38g2000prf.googlegroups.com...
>
>
>
> > Hi experts,
>
> > I find a weird problem with the WinDBG command 'lm n t':
>
> > kd> lm n t
> > start end module name
> > 7c920000 7c9b4000 ntdll ntdll.dll Tue Aug 17 07:38:36 2004
> > (4121457C)
> > 804d8000 806ec600 nt ntoskrnl.exe Wed Aug 04 14:19:48 2004
> > (41108004)
> > 806ed000 80700d80 hal halacpi.dll Wed Aug 04 13:59:04 2004
> > (41107B28)
> > bf800000 bf9c0200 win32k win32k.sys Wed Aug 04 14:17:30 2004
> > (41107F7A)
> > bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 14:00:51 2004
> > (41107B93)
> > .....
>
> > All of the module names except 'nt' are their image name without
> > extention. Why?
>
> > I also wonder how the debugger determines the module name of a given
> > kernel module?
>
> > Any help will be highly appreciated. Thanks in advance.- Hide quoted text -
>
> - Show quoted text -

Thank you, Doron,
I just wonder how WinDBG does that. I still have two questions:

1, Does WinDBG internally maintain an alias list? or WinDBG does that
in
other way?

2, Only the modules from Microsoft can have alias, can't they?

Ivan
Mon Aug 27 17:12:08 CDT 2007

multipost.
follow-up on microsoft.public.windbg

--

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


"xmllmx" <xmllmx@gmail.com> wrote in message
news:1188252080.097501.128360@l22g2000prc.googlegroups.com...
> On Aug 28, 2:16 am, "Doron Holan [MSFT]" <dor...@online.microsoft.com>
> wrote:
>> this is because there are many different kernels (and HALs). this alias
>> makes it very easty to refer to the kernel or hal generically, such as
>> nt!IoCreateDevice.
>>
>> d
>>
>> --
>> Please do not send e-mail directly to this alias. this alias is for
>> newsgroup purposes only.
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>> "xmllmx" <xml...@gmail.com> wrote in message
>>
>> news:1188177590.066629.6310@i38g2000prf.googlegroups.com...
>>
>>
>>
>> > Hi experts,
>>
>> > I find a weird problem with the WinDBG command 'lm n t':
>>
>> > kd> lm n t
>> > start end module name
>> > 7c920000 7c9b4000 ntdll ntdll.dll Tue Aug 17 07:38:36 2004
>> > (4121457C)
>> > 804d8000 806ec600 nt ntoskrnl.exe Wed Aug 04 14:19:48 2004
>> > (41108004)
>> > 806ed000 80700d80 hal halacpi.dll Wed Aug 04 13:59:04 2004
>> > (41107B28)
>> > bf800000 bf9c0200 win32k win32k.sys Wed Aug 04 14:17:30 2004
>> > (41107F7A)
>> > bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 14:00:51 2004
>> > (41107B93)
>> > .....
>>
>> > All of the module names except 'nt' are their image name without
>> > extention. Why?
>>
>> > I also wonder how the debugger determines the module name of a given
>> > kernel module?
>>
>> > Any help will be highly appreciated. Thanks in advance.- Hide quoted
>> > text -
>>
>> - Show quoted text -
>
> Thank you, Doron,
> I just wonder how WinDBG does that. I still have two questions:
>
> 1, Does WinDBG internally maintain an alias list? or WinDBG does that
> in
> other way?
>
> 2, Only the modules from Microsoft can have alias, can't they?
>