How to set up symbols in WinDbg?

Question

I am using Debugging Tools for Windows and I get the following error message when starting WinDbg / cdb or ntsd:

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************

When executing arbitrary commands, I also get the error message

*** ERROR: Module load completed but symbols could not be loaded for <module>.<ext>

And the following seems to be related:

*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
* using the _NT_SYMBOL_PATH environment variable.                   *
* using the -y <symbol_path> argument when starting the debugger.   *
* using .sympath and .sympath+                                      *
*********************************************************************

In a !analyze -v I have also seen

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

and

*************************************************************************
***                                                                   ***
*** Either you specified an unqualified symbol, or your debugger      ***
*** doesn't have full symbol information. Unqualified symbol          ***
*** resolution is turned off by default. Please either specify a      ***
*** fully qualified symbol module!symbolname, or enable resolution    ***
*** of unqualified symbols by typing ".symopt- 100". Note that        ***
*** enabling unqualified symbol resolution with network symbol        ***
*** server shares in the symbol path may cause the debugger to        ***
*** appear to hang for long periods of time when an incorrect         ***
*** symbol name is typed or the network symbol server is down.        ***
***                                                                   ***
*** For some commands to work properly, your symbol path              ***
*** must point to .pdb files that have full type information.         ***
***                                                                   ***
*** Certain .pdb files (such as the public OS symbols) do not         ***
*** contain the required information. Contact the group that          ***
*** provided you with these symbols if you need this command to       ***
*** work.                                                             ***
***                                                                   ***
*************************************************************************

How do I set up WinDbg to find the symbols?

_{Disclaimer: This is intended to be a canonical question to all the wrong symbols posts in windbg.}

Permission

Answer 1

Symbols can be set up correctly in various different ways.

WARNING: The examples here use \\server\symbols which is typically a network storage that is not available. Adapt it to your local server or leave that part out completely if you don't have one. A non-existent server may cause delays etc.

TLDR version for 80% of the cases

Create a new folder c:\symbols for symbols provided by Microsoft. Then type

.symfix+ c:\symbols
.reload

(or reload -f if necessary)

Make sure you have an Internet connection, since this will contact some Microsoft servers and download symbols from there.

In 80+% of the cases, this might already solve your symbols problem. If not, read on.

Fixing symbols by commands

WinDbg will look for symbols in the order they appear in the symbol path. Therefore it's a good idea to put your local symbols first, then some company local network share and then download symbols from the Internet and store a copy locally.

.sympath c:\mysymbols ; *** Symbols of your application, locally, flat list of PDB files
.sympath+ cache*c:\symbolcache ; *** (optional) Create a cache for everything
.sympath+ \\server\symbols ; *** Symbols provided from a network share
.symfix+ c:\symbols ; *** Microsoft symbols

Fixing symbols by menu

In WinDbg (but not the command line equivalents) you can set a symbol path by File/Symbol File Path... or pressing Ctrl+S. You enter it in the following format

c:\mysymbols;cache*c:\symbolcache;\\server\symbols;SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Fixing symbols by command line

WinDbg also takes the -y command line switch if you prefer having different desktop links with different symbol path setups.

WinDbg -y "<symbol path>"

Note that you need the complete path here, which is in a form like

c:\mysymbols;cache*c:\symbolcache;\\server\symbols;SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Fixing symbols by environment variable

There is a environment variable called _NT_SYMBOL_PATH which can be set to a symbol path as well. Use the following syntax:

c:\mysymbols;cache*c:\symbolcache;\\server\symbols;SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Note that not only WinDbg evaluates this variable, but also Visual Studio, Process Explorer, Process Monitor and potentially other software. You may experience performance impact setting this environment variable.

Saving the symbol path as part of a workspace

If you have a rather complex symbol setup which includes several paths, become familiar with the concept of WinDbg workspaces.

Workspaces allow you to save the symbol path so you don't have to re-type all the commands in every debugging session.

Once you're satisfied with the workspace, create a link for WinDbg to include -Q which means " Suppress the annoying "Save workspace?" question".

So far I'm very happy having save the symbols as part of the Base workspace.

Deferred symbols

Deferred symbols (indicated as such during a lm command) are not a problem. WinDbg will load them whenever needed. To force loading all of them, type

ld*

Debugging symbol issues

If the symbols (PDBs) do not work as expected, use the

!sym noisy

to get more information about what WinDbg is exactly doing when resolving symbols.

When you found the solution, turn it off with

!sym quiet

To check individual symbols for correctness, you can use the symchk tool which comes with WinDbg.

Symchk /if <exe> /s <symbol path> /av /od /pf
/if = input is a file
/s  = symbol file path
/od = all details
/av = verify
/pf = check if private symbols are available

or get ChkMatch which is a bit easier to use

ChkMatch -c <exe file> <pdb file>

If you have trouble accessing symbols from a network share, make sure you logged on to the network share before. AFAIR, WinDbg does not ask for credentials.

Official documentation

Use the Microsoft Symbol Server to obtain debug symbol files (should redirect here but redirection is currently broken)

Symbol path for Windows debuggers

Permission

@Techrocket9: ok, I added that information as a warning in the beginning of the post – Permission

The link to the Microsoft symbol Server no longer appears to work – Preeminent

@higginse: yes, that's a redirection issue on Microsoft side. Here's the destination: support.microsoft.com/en-us/help/311503/… – Permission

Can anyone expand on "You may experience performance impact setting [_NT_SYMBOL_PATH] environment variable." ? I can't find any information on what performance issues this would cause, and why. – Dictatorship

Answer 2

After opening the dump file, click File, select Symbol File Path or (Ctrl+S). This open box shows the default path set by environment the variable _NT_SYMBOL_PATH. In my case this shows:

SRV*C:\symcache*http://msdl.microsoft.com/download/symbols

1. Insert your local symbols path before and ";" after any entry.
2. Select Reload box.
3. Click OK.
4. In the Command prompt run: ld*
5. wait for symbols to load.

Mesdemoiselles

This answer is too simple to be complete. It e.g. ignores the concept of workspaces and assumes you have _NT_SYMBOL_PATH set. If you open a dump file, it's possible that a workspace gets loaded, which has a completely different symbol path already. – Permission

This is the sequence I have successfully used and it works very well for me. I don't usually use workspaces. – Mesdemoiselles