Skip to content

Improper symbolized stack traces for system DLL calls on ARM64 (Procmon 4.01) #895

@CaptWake

Description

@CaptWake

When running Process Monitor (Procmon) version 4.01 on Windows 11 24H2 ARM, stack traces for events involving system DLL function calls (e.g., from ntdll.dll, kernelbase.dll, etc.) are not resolved correctly. Only stack frames from ntoskrnl.exe are properly symbolized.

Steps to Reproduce:

  1. Install Procmon 4.01 (ARM64 version).
  2. Run Procmon and capture events.
  3. Observe the stack trace - only ntoskrnl.exe frames seems to be resolved correctly; all user-mode system DLL frames miss function names.
  4. Try specifying different dbghelp.dll versions (both the one from System32 and the one shipped with WDK). The issue persists.

Here is an example of an improper symbolized stack trace, I was expecting to see the function symbols also for kernelbase and ntdll. The process that generates the event is ARM64:

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions