In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?

Question

Take for example, 'kernel32.dll', the export table already provides the list of exported functions, then in what use case, would I need to download the debugging symbols for it from the MS symbol server?

Answer 1

Most available public symbol files provide only global function and variable names (both exported and non-exported ones). A small minority (e.g. ntdll, kernel32, ntoskrnl) also include various system types (structures , enumerations) which is very useful for low level debugging. But even without types you can often guess a lot just from the function names.

Answer 2

without symbols most of the calls would be like call dword ptr ds :[12345678] or call 45678976 or jmp 86753535 etc

with symbols it would be like call dword ptr ds:[exitprocess]

call foo32!blah

jmp some-non-exported-address-that-was-named-by-symbol etc

apart from names symbols provide typeinfo

like push foo->blah

instead of push [eax+60]

also exported apis can be ordinal exports then all calls will look like call ord1 call ord2 call ordn
without a symbol file you will have a hard time renaming and analyzing them
take a look at mfcxx.dll