1

Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM:

enter image description here

Then loaded a test PE file and started debugging it (using Local Windows Debugger):

enter image description here

So now I want to load symbols from the Microsoft server, say for ntdll.dll (or any other Windows module for that matter):

enter image description here

This fails with the following message in the output window:

enter image description here

DWARF: Cannot determine location of DWARF info for "C:\Windows\System32\ntdll.dll".
Could not load debug info for module: "C:\Windows\System32\ntdll.dll"

Any idea what am I doing wrong?

2
  • 1
    IDA > File > Load file > PDB file...
    – Biswapriyo
    Sep 24 '19 at 20:00
  • @Biswapriyo oh, I see. Thank you. I also noticed that in the menu for that command, it says, "... you can specify .dll or .exe. In that case IDA will try to find and load PDB specified in its debug directory." How do I configure that debug directory? I know in WinDbg one needs to provide a URL to Microsoft public symbols. Do I need to do the same for IDA?
    – c00000fd
    Sep 24 '19 at 20:06
1

I fixed it by

  1. Setting the environment variable _NT_SYMBOL_PATH=srv*c:\pdb_cache*http://msdl.microsoft.com/download/symbols
  2. then tick the "auto load PDB files" in Debugger Options
4
  • That is really cool. I need to try it. One clarification: by setting an environment variable, do you mean in Windows?
    – c00000fd
    Apr 6 at 13:35
  • @c00000fd yes, this is a Windows environment variable. It also affects WinDbg, Visual Studio and other tools that make some use of the debug helper API to fetch symbols. You can fine-tune what location to use as cache and thereby keep your own local network share for your local symbols (e.g. of own products) but also consult the Microsoft servers and cache those symbols. If you have a VS subscription there's a chance you can also still access symbol packages for older Windows versions, if needed. But the symbol servers are reasonably fast, I find.
    – 0xC0000022L
    May 6 at 15:13
  • @0xC0000022L I still can't make it work. Is there https btw?
    – c00000fd
    May 7 at 23:47
  • Don't think there are HTTPS URLs for the symbols, no. What exactly is it you can't make work?
    – 0xC0000022L
    May 8 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.