Search code examples
c++debuggingvisual-studio-debuggingpdb-files

Why isn't pdb for ntdll.dll cached

I'm developing C++ under Visual Studio Community 2013. It is C++/Win32 project not UWP and it is run as Debug/x64 platform.

My config is:

Tools -> Options -> Debugging -> Symbols -> All module, unless excluded
Tools -> Options -> Debugging -> Symbols -> Cache symbol in this directory

Cache symbol directory contains bunch of *.pdb files and it was never touched.

Problem: When I run debugger occasionally I get message about contacting MS symbol server to download ntdll.dll and some other files which are I guess system related because I do not recognize them as a part of my project.

Why is ntdll.dll being downloaded? This article says:

Some common reasons symbols aren’t loaded include:

  1. Symbol paths don’t point to the correct location
  2. The symbol file is from a different version of the module than the one loaded in the process - Visual Studio requires that the symbol file come from the exact same build as the module. It cannot load symbols that come from a different build even if the source code was identical

I haven't rebuild ntdll.dll, how could I? It is not possible because it is part of Windows kernel, so why download debug symbols for ntdll.dll again and again instead of caching it?

Edit:

When I run debug (F5) then under Debug -> Windows -> Output I see following line:

'MyProject.exe' (Win32): Loaded 'C:\Windows\System32\ntdll.dll'. Loading disabled by Include/Exclude setting.

Output of Debug -> Windows -> Modules:

ntdll.dll   C:\Windows\System32\ntdll.dll   N/A No  Loading disabled by Include/Exclude setting.        2   10.0.14393.447 (rs1_release_inmarket.161102-0100)   11/2/2016 11:13 AM  00007FFFDF410000-00007FFFDF5E1000   [12772] MyProject.exe

As I said it happens occasionally so I do not know how exactly I can reproduce this. Seems that in the past time it is working and ntdll.dll is not downloaded from MS servers anymore. I cannot change x64 to x86 because our project does not run on x86.

My C:\Users\wakatana\AppData\Local\Temp\SymbolCache contains following folders/files (I guess one might be for x86 and another for x64 but I'm not sure):

ntdll.pdb\41C94DD545BD4FCBA2E8F404185B97DC1\ntdll.pdb
ntdll.pdb\77A5329C3B1E425FAA9519DA285D8DA71\ntdll.pdb

Is it possible to explicitly tell VS to use already cached version of ntdll.dll in C:\Users\wakatana\AppData\Local\Temp\SymbolCache for all new projects or what is the default VS behavior?

My OS is Windows10 Home with latest updates

Solution

  • It would be related to this specific assembly.

    If I use the X86 Target, I will get the wntdll.pdb file.

    enter image description here

    If I use the X64 target, I will get the ntdll.pdb file, but like yours, they are all in temp\SymbolCache folder. I also get the information "source information stripped messages" in X64 target. It really has no the pdb file in the default symbol folder under TOOLS->Options->Debugging->Symbols.

    enter image description here

    Since I got the same issue as yours, I submitted a connect report to the product team:

    https://connect.microsoft.com/VisualStudio/feedbackdetail/view/3113479/why-isnt-pdb-for-ntdll-dll-cached

    You could also add your comment and vote it.