Windbg and Symbol Files

Question

I have a problem with symbol files. I experimented with the symbol file path and set the path as follows:

srv*c:\symbols*http://msdl.microsoft.com/download/symbols;C:\Users\myuser\Desktop\driver2\objchk_win7_x86\i386

But afterwards I changed it to the following:

srv*c:\symbols*http://msdl.microsoft.com/download/symbols;C:\Users\myuser\Desktop\mydriver\objchk_win7_x86\i386

I changed the driver2 with mydriver in the path: this is the path where the .pdb file for my driver is located. The problem is that .sympath prints the right path as shown below:

kd> .sympath
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols;C:\Users\myuser\Desktop\mydriver\objchk_win7_x86\i386
Expanded Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols;c:\users\myuser\desktop\mydriver\objchk_win7_x86\i386

But the symbols for the driver are still not found. If I run .reload command, we can see that WinDbg is looking for .pdb in driver2/ directory instead of mydriver/ directory.

kd> .reload /f mydriver.sys
SYMSRV:  c:\symbols\mydriver.pdb\3D655E533B0449A38D7AB0AF637CE9201\mydriver.pdb not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/mydriver.pdb/3D655E533B0449A38D7AB0AF637CE9201/mydriver.pdb not found
SYMSRV:  c:\users\myuser\desktop\mydriver\objchk_win7_x86\i386\mydriver.pdb\3D655E533B0449A38D7AB0AF637CE9201\mydriver.pdb not found
DBGHELP: c:\users\myuser\desktop\driver2\objchk_win7_x86\i386\mydriver.pdb - file not found
*** ERROR: Module load completed but symbols could not be loaded for mydriver.sys
DBGHELP: mydriver - no symbols loaded

I've deleted all the workspaces, closed WinDbg, restarted Windows, but the driver2/ entry is still there: it must be in the default workspace's cache or somewhere. How can I delete the whole personal settings of WinDbg including those caches, so I can restart WinDbg and be gone with the driver2/ path and make it use mydriver/.

I could also solve the problem with renaming the mydriver/ directory back into driver2/, but I don't want to solve the problem like that. I want to understand what's going on and solve it the best I can.

Solution

!sym noisy

will tell you why it did not want to load the pdb. Perhaps you did rebuild your driver and the pdb guid or pdb age does no longer match. If you are sure that you have built the same source files you can force loading of your pdb by

.reload /i /f yourdriver.sys

/i is the magic switch to load also mismatched pdbs. This switch will not load any driver from your symbol server but it will consider only local file paths to load your driver. Also symbol store directories (SRV*) are not considered since there would be many versions to choose from. But if your .sympath directly points to your pdb it will be loaded.

Comments

[eleanor]

Hi, yes I can solve the problem like that. I can also solve it by renaming the mydriver to driver2 directory. I first compiled the driver in driver2 directory, then renamed directory to mydriver, delete all files excpect mydriver.c and recompiled. I stopped the driver, deleted it and restart the debugged Windows system; I also restarted debugee system. I think, the problem is that WinDbg saved this path somewhere in cache and I'm interested where; the default workspace view is also changed once the debuggee connects to Windbg, so workspace must be saved somewhere, despite me deleting it.

[Rahul Sundar]

Seems like for the driver file the paths are being cumulated. Not sure if its a real bug in windbg or documentation bug. If you suspect it to be a bug in Windbg, you can try installing the latest version of windbg to see if it fixes the issue. As well you can try deleting the appropriate default workspaces(user\kernel\remote etc) and save the one you want as default by File->Save WS as->Default in the appropriate mode(user\kernel\remote)

[zinking]

this might be useful: msdn.microsoft.com/en-us/library/windows/hardware/…

[zhaorufei]

/i works for me, in my case, I use windbg 6.2.8299.0 AMD64 version on Windows 7 with SP1 to debug a full-dump file. I'm very sure the .sympath is correct, and I use symchk to verify the .dll and .pdb is matched perfectly. But windbg still refuse to load the pdb. BTW, from windbg help, /i also implies /f even if you have not specify /f flag.