Question

Trying to debug a dump file in Windbg. Its a managed that interops with some Microsoft native libraries. I have setup symbol path to .sympath SRV*c:\SymbolsCash*http://msdl.microsoft.com/download/symbols.

I loaded SOS without any problem. I can run sos commands without any error. I can also run most of the Windbg command fine (like ~, kb, .time etc), however for some command (e.g., !address -summary) I get following error.

Your debugger is not using the correct symbols
In order for this command to work properly, your symbol path
must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not
contain the required information. Contact the group that
provided you with these symbols if you need this command to
work.
Type referenced: ntdll!_NT_TIB

Any ideas what I am missing here?

Answer 1

From your output, we can see you don’t have symbols for ntdll. Note the line (3rd in the output above) that says you are using “export symbols”. This means that you don’t have the symbols for this module and the debugger is only using the entries from the module’s export table. The structure you need is not included in the limited info that is the export table.

Your symbol path should look like:

SRV*<local symbol cache directory>*http://msdl.microsoft.com/download/symbols

example:

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

If you have your symbol path setup correctly, you can turn on verbose symbol loading by running:

!sym noisy

Then force a reload for ntdll.dll:

.reload /f ntdll.dll

Use the output to determine why you are not getting the symbol. Then
turn off verbose symbol loading by running:

!sym quiet

Also, I prefer the !lmi <binary> (e.g. !lmi ntdll) over lmvm when troubleshoot symbol loading. The output is a little clearer about what you have. At the end of the !lmi output you will see the line “Load report”.