3

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.

So when I begin debugging it:

enter image description here

And break on a breakpoint, I want to load symbols, say for cmtcmt32.dll:

enter image description here

But instead of loading them it gives me this "Choose PDB file" window:

enter image description here

How do I set it up to load it from the Microsoft public symbol server?

PS. I tried running the following commands:

.sympath srv*c:symbols*https://msdl.microsoft.com/download/symbols
.reload /f

But it doesn't do anything. It just shows a bunch of errors:

enter image description here

enter image description here

Improve this question
5
  • Regarding the windbg sympath, you are supplying an invalid path (missing the backslash after c:), should be: .sympath srv*c:\symbols*https://msdl.microsoft.com/download/symbols
    – josh poley
    Commented Jun 10, 2019 at 21:22
  • @joshpoley: Hmm. I tried it with the slash like you showed, then did .reload /f comctl32.dll and still got *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.23403_none_2b180b30457f196c\COMCTL32.dll
    – c00000fd
    Commented Jun 10, 2019 at 21:39
  • At that point be sure to turn on !sym noisy and look for more detailed error information.
    – josh poley
    Commented Jun 10, 2019 at 23:13
  • @joshpoley Here's what I'm getting. I'm running it on Windows 7. I don't use WinDgb that much. What's going on there?
    – c00000fd
    Commented Jun 10, 2019 at 23:18
  • I agree theres not much useful in that output, though it looks like it isn't resolving https:// as a web request, you could try switching to http to see if that helps, or ensure you are running the latest build of windbg. It also looks like you are using the 64-bit version of windbg against a 32-bit dump or process, use the 32-bit version of windbg instead (though this is likely unrelated to symbol resolution issues).
    – josh poley
    Commented Jun 11, 2019 at 15:03

1 Answer 1

Reset to default
5

It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is:

  1. Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables
  2. Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set its value like SRV*\C:\Symbols*http://msdl.microsoft.com/download/symbols
  3. The next time you launch IDA, it should tell you when to load MS symbols from the symbols store.

PS: you may need to install VC Redistribute libraries if IDA prompts an error.

Improve this answer
2
  • SRV*http://msdl.microsoft.com/download/symbols worked for me
    – raspiduino
    Commented Apr 11, 2022 at 9:50
  • For Chromium, do SRV*https://chromium-browser-symsrv.commondatastorage.googleapis.com
    – raspiduino
    Commented Apr 11, 2022 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.