I'm using windbg version 6.12.0002.633 X86 on Windows XP SP3 in a VM. I've configured the environment variable, _NT_SYMBOL_PATH as shown below:
When I open a binary such as notepad.exe in windbg, the symbols are not loaded and I see a file called download.error in the path: C:\symbols\ntdll.pdb\1751003260CA42598C0FB326585000ED2
To debug this further, I enabled noisy mode for the symbols in windbg to find the root cause. When I reload the binary in windbg, I see the below messages in the logs:
!sym noisy .reload SYMSRV: The connection with the server was reset SYMSRV: c:\symbols\ntdll.pdb\1751003260CA42598C0FB326585000ED2\ntdll.pdb not found SYMSRV: http://msdl.microsoft.com/download/symbols/ntdll.pdb/1751003260CA42598C0FB326585000ED2/ntdll.pdb not found DBGHELP: C:\WINDOWS\system32\ntdll.pdb - file not found DBGHELP: ntdll.pdb - file not found *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - DBGHELP: ntdll - export symbols
It says, connection with the server was reset.
I checked with Wireshark as well and I can see a connection RST TCP flag sent by 18.104.22.168 which is the IP address corresponding to: vsblobprodscussu5shard90.blob.core.windows.net
The network connection sequence looks like this:
HTTP GET request to: http://msdl.microsoft.com/download/symbols/ntdll.pdb/1751003260CA42598C0FB326585000ED2/ntdll.pdb
A 302 found will redirect to the URL hosting the PDB file:
This request for above URL receives a RST from the server. Interestingly, when I access the URL directly from a web browser, I can download the blob file successfully.
So, why is the symbol file not downloaded when accessed through windbg?