Search code examples
debuggingwindbgdebug-symbolscrash-dumps

How do I get the symbols for a single DLL without having a dump?

I have a single DLL or EXE file and I'd like to acquire the symbols (PDB file) for it, i.e. download from the symbol server.

Note: The DLL is not a module which is part of a crash dump, so opening the dump and doing .symfix and .reload is not possible.

I have tried

symchk /os /if "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll"
/su "SRV*e:\debug\symbols*http://msdl.microsoft.com/download/symbols"

but it just says

SYMCHK: FAILED files = 0
SYMCHK: PASSED + IGNORED files = 1

and there are no symbols in my symbol folder.

Solution

  • You have used /if which sounds plausible, but actually it needs to be /id for a dump file:

    symchk /os /id "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" 
/su "SRV*e:\debug\symbols*http://msdl.microsoft.com/download/symbols"

SYMCHK: FAILED files = 0
SYMCHK: PASSED + IGNORED files = 1

    The output is the same, but the symbol folder contains the PDBs now.

    It is similar in WinDbg:

    • choose File | Open Crash Dump ... or press Ctrl+D
    • for the file name filter, instead of Crash Dump Files select All files

    • choose the DLL or EXE of your interest. WinDbg will e.g. say

      Loading Dump File [C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll]

      although it is not really a dump file

    • issue the typical commands .symfix and .reload. If symbols are present on the symbol server, they will be downloaded.

    Looking at what you're "debugging", you'll see that it's the DLL:

    0:000> |
.  0    id: f0f0f0f0    examine name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll

0:000> ||
.  0 Image file: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll

0:000> lm
start             end                 module name
00000001`80000000 00000001`80988000   clr        (pdb symbols)          e:\debug\symbols\clr.pdb\5706A2AA257A45FDAC5776EDDC7BBA542\clr.pdb

    And also some other commands work:

    0:000>  x clr!*
00000001`80123e28 clr!SafeHandle::Init (<no parameter info>)
00000001`808f5e80 clr!HillClimbingLogSize = <no type information>
00000001`80064af0 clr!IsTimerSpecialThread (<no parameter info>)
...

0:000> u clr!SafeHandle::Init
clr!SafeHandle::Init:
00000001`80123e28 4883ec28        sub     rsp,28h
00000001`80123e2c 488b059d4b7c00  mov     rax,qword ptr [clr!g_Mscorlib+0x10 (00000001`808e89d0)]
00000001`80123e33 488b80e0070000  mov     rax,qword ptr [rax+7E0h]
00000001`80123e3a 4885c0          test    rax,rax
...