WinDbg, with minidump from native 32-bit app crashing on 64-bit Windows, won't load symbols for system DLLs

28,984

Are you debugging on a 32-bit or 64-bit system, and with the 32 or 64-bit version of WinDBG? You typically have to debug on the same architecture package you took the dump from:

http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

"The 32-bit version of Debugging Tools for Windows is the best choice, unless you are debugging an application on a 64-bit processor. In that case, you should use a 64-bit package."

Also, take a look at this article where he is debugging a 32-bit app running on a 64-bit platform:

http://blogs.msdn.com/alejacma/archive/2008/07/18/How-to-use-Windbg-to-debug-a-dump-of-a-32bit-.NET-app-running-on-a-x64-machine.aspx

Share:
28,984
Roger Lipscombe
Author by

Roger Lipscombe

I was a Windows programmer (15 years of C++, C#, SQL Server), but I took a leap of faith and now I'm a backend software developer, using Erlang and Elixir, at Twilio.

Updated on October 12, 2020

Comments

  • Roger Lipscombe
    Roger Lipscombe over 3 years

    I've got a minidump file from a crash in one of our apps. It's a 32-bit native app, and it was running on 64-bit Windows.

    If I load the minidump file into WinDbg, WinDbg won't load the symbols for the system DLLs. I've got my symbol paths configured correctly:

    _NT_SYMBOL_PATH=SRV*C:\WebSymbols*http://msdl.microsoft.com/download/symbols
    

    ...because WinDbg correctly loads symbols for minidumps created on 32-bit Windows. It just won't load symbols for DLLs in the SysWOW64 directory.

    I've tried 32-bit WinDbg (from Debugging Tools 6.9) on 32-bit Windows 2003, and 64-bit WinDbg (also from Debugging Tools 6.9) on 64-bit Windows 2008. Both fail to load the symbols. This is from the 32-bit WinDbg:

    0:014> !sym noisy
    noisy mode - symbol prompts on
    0:014> .reload
    ....................................................................................
    Loading unloaded module list
    ..
    SYMSRV:  C:\WebSymbols\ntdll.dll\48E714D0170000\ntdll.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/ntdll.dll/48E714D0170000/ntdll.dll not found
    DBGENG:  C:\Windows\SysWOW64\ntdll.dll - Couldn't map image from disk.
    Unable to load image C:\Windows\SysWOW64\ntdll.dll, Win32 error 0n2
    DBGENG:  ntdll.dll - Partial symbol image load missing image info
    DBGHELP: Module is not fully loaded into memory.
    DBGHELP: Searching for symbols using debugger-provided data.
    SYMSRV:  C:\WebSymbols\wntdll.pdb\6686D0C5D0554E14953396093DA218A92\wntdll.pdb not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/wntdll.pdb/6686D0C5D0554E14953396093DA218A92/wntdll.pdb not found
    DBGHELP: wntdll.pdb - file not found
    *** WARNING: Unable to verify timestamp for ntdll.dll
    *** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
    DBGHELP: ntdll - no symbols loaded
    SYMSRV:  C:\WebSymbols\kernel32.dll\48E7156Cf0000\kernel32.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/kernel32.dll/48E7156Cf0000/kernel32.dll not found
    DBGENG:  C:\Windows\SysWOW64\kernel32.dll - Couldn't map image from disk.
    Unable to load image C:\Windows\SysWOW64\kernel32.dll, Win32 error 0n2
    DBGENG:  kernel32.dll - Partial symbol image load missing image info
    DBGHELP: Module is not fully loaded into memory.
    DBGHELP: Searching for symbols using debugger-provided data.
    SYMSRV:  C:\WebSymbols\wkernel32.pdb\B0C3B36CC7EF4F3E9C168E186A5A6FEB2\wkernel32.pdb not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/wkernel32.pdb/B0C3B36CC7EF4F3E9C168E186A5A6FEB2/wkernel32.pdb not found
    DBGHELP: wkernel32.pdb - file not found
    *** WARNING: Unable to verify timestamp for kernel32.dll
    *** ERROR: Module load completed but symbols could not be loaded for kernel32.dll
    DBGHELP: kernel32 - no symbols loaded
    SYMSRV:  C:\WebSymbols\KERNELBASE.dll\48E7156D5a000\KERNELBASE.dll not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/KERNELBASE.dll/48E7156D5a000/KERNELBASE.dll not found
    DBGENG:  C:\Windows\SysWOW64\KERNELBASE.dll - Couldn't map image from disk.
    DBGENG:  KERNELBASE.dll - Partial symbol image load missing image info
    DBGHELP: Module is not fully loaded into memory.
    DBGHELP: Searching for symbols using debugger-provided data.
    SYMSRV:  C:\WebSymbols\wkernelbase.pdb\A8683F0C515F469B833E3FA562E0DB251\wkernelbase.pdb not found
    SYMSRV:  http://msdl.microsoft.com/download/symbols/wkernelbase.pdb/A8683F0C515F469B833E3FA562E0DB251/wkernelbase.pdb not found
    DBGHELP: wkernelbase.pdb - file not found
    *** WARNING: Unable to verify timestamp for KERNELBASE.dll
    *** ERROR: Module load completed but symbols could not be loaded for KERNELBASE.dll
    DBGHELP: KERNELBASE - no symbols loaded

    Any ideas? Are the symbols just not available on Microsoft's symbol server?

  • Roger Lipscombe
    Roger Lipscombe over 15 years
    It's a native app, so that last article's not a lot of use.