1

Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM:

enter image description here

Then loaded a test PE file and started debugging it (using Local Windows Debugger):

enter image description here

So now I want to load symbols from the Microsoft server, say for ntdll.dll (or any other Windows module for that matter):

enter image description here

This fails with the following message in the output window:

enter image description here

DWARF: Cannot determine location of DWARF info for "C:\Windows\System32\ntdll.dll".
Could not load debug info for module: "C:\Windows\System32\ntdll.dll"

Any idea what am I doing wrong?

Improve this question
2
  • 1
    IDA > File > Load file > PDB file...
    – Biswapriyo
    Commented Sep 24, 2019 at 20:00
  • @Biswapriyo oh, I see. Thank you. I also noticed that in the menu for that command, it says, "... you can specify .dll or .exe. In that case IDA will try to find and load PDB specified in its debug directory." How do I configure that debug directory? I know in WinDbg one needs to provide a URL to Microsoft public symbols. Do I need to do the same for IDA?
    – c00000fd
    Commented Sep 24, 2019 at 20:06

2 Answers 2

Reset to default
2

I fixed it by

  1. Setting the environment variable _NT_SYMBOL_PATH=srv*c:\pdb_cache*http://msdl.microsoft.com/download/symbols
  2. then tick the "auto load PDB files" in Debugger Options
Improve this answer
4
  • That is really cool. I need to try it. One clarification: by setting an environment variable, do you mean in Windows?
    – c00000fd
    Commented Apr 6, 2021 at 13:35
  • @c00000fd yes, this is a Windows environment variable. It also affects WinDbg, Visual Studio and other tools that make some use of the debug helper API to fetch symbols. You can fine-tune what location to use as cache and thereby keep your own local network share for your local symbols (e.g. of own products) but also consult the Microsoft servers and cache those symbols. If you have a VS subscription there's a chance you can also still access symbol packages for older Windows versions, if needed. But the symbol servers are reasonably fast, I find.
    – 0xC0000022L ♦
    Commented May 6, 2021 at 15:13
  • @0xC0000022L I still can't make it work. Is there https btw?
    – c00000fd
    Commented May 7, 2021 at 23:47
  • Don't think there are HTTPS URLs for the symbols, no. What exactly is it you can't make work?
    – 0xC0000022L ♦
    Commented May 8, 2021 at 21:18
1

you must load pdb file when you pause this application, it must be paused state.

Improve this answer
1
  • This looks like the start of a good answer but I feel it lacks some details and assumes a bit of knowledge that would better be explicit in the answer
    – NirIzr
    Commented Jul 7, 2022 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.