0

I'm using windbg version 6.12.0002.633 X86 on Windows XP SP3 in a VM. I've configured the environment variable, _NT_SYMBOL_PATH as shown below:

_NT_SYMBOL_PATH=symsrv*symsrv.dll*c:\symbols*http://msdl.microsoft.com/download/symbols

When I open a binary such as notepad.exe in windbg, the symbols are not loaded and I see a file called download.error in the path: C:\symbols\ntdll.pdb\1751003260CA42598C0FB326585000ED2

To debug this further, I enabled noisy mode for the symbols in windbg to find the root cause. When I reload the binary in windbg, I see the below messages in the logs:

!sym noisy

.reload

SYMSRV:  The connection with the server was reset
SYMSRV:  c:\symbols\ntdll.pdb\1751003260CA42598C0FB326585000ED2\ntdll.pdb not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/ntdll.pdb/1751003260CA42598C0FB326585000ED2/ntdll.pdb not found
DBGHELP: C:\WINDOWS\system32\ntdll.pdb - file not found
DBGHELP: ntdll.pdb - file not found
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
DBGHELP: ntdll - export symbols

It says, connection with the server was reset.

I checked with Wireshark as well and I can see a connection RST TCP flag sent by 104.214.40.16 which is the IP address corresponding to: vsblobprodscussu5shard90.blob.core.windows.net

The network connection sequence looks like this:

HTTP GET request to: http://msdl.microsoft.com/download/symbols/ntdll.pdb/1751003260CA42598C0FB326585000ED2/ntdll.pdb

A 302 found will redirect to the URL hosting the PDB file:

https://vsblobprodscussu5shard90.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/116562DEEFD5B373413753CB93AF387179BE36468A5F6E354E61565E5727A10D00.blob?sv=2019-02-02......<truncated>

This request for above URL receives a RST from the server. Interestingly, when I access the URL directly from a web browser, I can download the blob file successfully.

So, why is the symbol file not downloaded when accessed through windbg?

Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.