The nt! ?? ::FNODOBFM::`string’+0x32c3b function name strings are a common problem when examining call stacks with WinDbg, and aren’t a result of any symbol misconfiguration which is deemed the common cause. The problem lies with optimisation strategies added by Microsoft. The common problem occurs because of the Basic Block Tools, which is used to produce greater working set management for Win32 applications. BBT will additionally edit the public symbol files (.PDB). This problem will not affect private symbols.
We can dump the call stack with the knL command, and then examine the return addresses of the said functions.
Now, we’ll apply the same method to the other function name which hasn’t been properly parsed by WinDbg.
However, there doesn’t seem to be an exact match to the appropriate function, and can therefore be rather ambiguous to which is the correct function. To resolve this problem, and verify which function is correct, then we can use the !stack -p extension which is part of the custom CMKD.dll:
The correct function is the nt!MiLocateWsle, which again fits with the context of our call stack. From this, I rather that the Memory Manager is searching through the Working Set List Entries which belong to that particular address space, and then removing the corresponding entries.
Understanding the .fnent Command:
This section is largely based upon some great information I read in a NT Debugging post (see end of this section), which goes beyond the scope of the context of my initial post, and thus is the reason why I wrote this section to begin with.
Since x64 stack conventions do not use a Stack Base Pointer (rbp/ebp), then the debugger will unwind the stack of the module using the metadata stored within the binary due to the linker. The .fnent command should also be able to see which functions are using FPO on x86 platforms.
The UnwindInfoAddress is combined with the base module address to produce the UnwindInfo at address, giving the following output:
The lmnm command will show the Begin address for the nt module:
For more information about the .fnent command, I suggest reading this post: x64 Manual Stack Reconstruction and Stack Walking