Home/ Questions/Q 6736667
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T11:09:26+00:00

When I do a dump file analysis, I setup symbol path to point to

  • 0

When I do a dump file analysis, I setup symbol path to point to Microsoft symbol server. How does windbg knows that the dump file was generated under what OS and how does it downloads correct symbols for that OS?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    To match symbols to binary, WinDbg looks at the thing called Debug Directories. Debug Directories are sections in PE modules (which is a file format used by Windows for all types of executables). Debug Directories simply contain links to types of debug information. If you type command in cmd window link /dump /headers <my_module_name>, it will print out something like this:

    ...
Debug Directories

    Time Type       Size      RVA  Pointer
-------- ------ -------- -------- --------
4CC78FB1 cv           22 00102588   101988    Format: RSDS, {30976E0B-FBF7-45EF-8608-99932F2B791F}, 2, ntdll.pdb
4CC78FB1 (   A)        4 00102584   101984    BB03197E

...

    This is output for ntdll.dll. You can see that CV (for CodeView) debug information is contained in ntdll.pdb, and GUID of that PDB has to match the one in the link. That GUID is generated randomly for each module at build time.

    Command !lmi in WinDbg will also dump this information, in different format.

    What WinDbg does when loading symbols from symbol server is it sends request to symbol server to get file named ‘ntdll.pdb’ with matching GUID.

    • 0