When running Process Monitor (Procmon) version 4.01 on Windows 11 24H2 ARM, stack traces for events involving system DLL function calls (e.g., from ntdll.dll, kernelbase.dll, etc.) are not resolved correctly. Only stack frames from ntoskrnl.exe are properly symbolized.
Steps to Reproduce:
- Install Procmon 4.01 (ARM64 version).
- Run Procmon and capture events.
- Observe the stack trace - only ntoskrnl.exe frames seems to be resolved correctly; all user-mode system DLL frames miss function names.
- Try specifying different dbghelp.dll versions (both the one from System32 and the one shipped with WDK). The issue persists.
Here is an example of an improper symbolized stack trace, I was expecting to see the function symbols also for kernelbase and ntdll. The process that generates the event is ARM64:
