Windows 10을 위한 Symbol(PDB) 파일 내려받는 방법
환경 변수를 다음과 같이 설정하고,
이름: _NT_SYMBOL_PATH
값: SRV*e:\Symbols*https://msdl.microsoft.com/download/symbols
notepad.exe 실행 후 windbg로 연결해 다음의 명령을 내리면,
0:007> .reload /f
Reloading current modules
.*** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\system32\notepad.exe
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\FeClient.dll -
.*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\System32\efswrt.dll -
.*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\System32\IME\shared\imjkapi.dll -
.*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\System32\IME\IMEKR\imkrapi.dll -
.*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SYSTEM32\DUI70.dll -
.*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\System32\IME\shared\imetip.dll -
.*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\System32\IME\IMEKR\imkrtip.dll
...[생략]...
보는 바와 같이 현재 (2016-11-01) Windows 10 (x64)에서는 아무런 PDB 파일도 다운로드되지 않습니다. 이 때문에 windbg에서 콜 스택을 확인하려고 해도 정상적으로 나오지 않습니다.
0:007> kv
# Child-SP RetAddr : Args to Child : Call Site
00 00000029`f0e7fb68 00007ffb`c5cd0b5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!DbgBreakPoint
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\System32\KERNEL32.DLL -
01 00000029`f0e7fb70 00007ffb`c3e18364 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!DbgUiRemoteBreakin+0x4a
02 00000029`f0e7fba0 00007ffb`c5c65e91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
03 00000029`f0e7fbd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
게다가 기본적인 운영체제 내의 구조체조차도 검색이 안됩니다.
0:007> dt _HANDLE_TABLE
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: _HANDLE_TABLE ***
*** ***
*************************************************************************
Symbol _HANDLE_TABLE not found.
웬일인지, 마이크로소프트는 윈도우 10 관련 심벌 파일들을 PDB 서버에 올려놓고 있지 않은데요. 따라서, 다음의 경로에서 직접 다운로드해 설치해야 합니다.
Download Windows Symbol Packages
; https://developer.microsoft.com/en-us/windows/hardware/download-symbols
Windows?10, version 1607 and Windows Server 2016 Symbols
; https://download.microsoft.com/download/D/1/9/D196C4F3-FC5B-48D2-A5D9-D3D42CE5F4F0/Windows_Rs1.14393.0.160715-1616.x64FRE.Symbols.msi
하지만, 위의 심벌 파일도 처음 릴리스 된 정식 버전의 것만 포함하고 있기 때문에 이후 패치가 될 때마다 업데이트 된 DLL들에 대한 PDB는 여전히 구할 수 없습니다. 실제로 위의 심벌 파일을 설치 후 notepad.exe에 대해 ".reload" 명령을 내리면 다음과 같이 3개의 PDB 파일을 구할 수 없다고 나옵니다.
0:003> .reload /f
Reloading current modules
......
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\urlmon.dll -
..........*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SYSTEM32\wintypes.dll -
................................*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\System32\combase.dll -
...
************* Symbol Loading Error Summary **************
Module name Error
urlmon PDB not found : srv*e:\symbols*https://msdl.microsoft.com/download/symbols
wintypes PDB not found : srv*e:\symbols*https://msdl.microsoft.com/download/symbols
combase The operation timed out : srv*e:\symbols*https://msdl.microsoft.com/download/symbols
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
아래의 글을 보면,
Where can I find the debug symbols Windows 10?
; http://stackoverflow.com/questions/31480434/where-can-i-find-the-debug-symbols-windows-10
2015년부터 저랬다는 것인데... 흠... ^^; 희망이 안 보이는군요.
[이 글에 대해서 여러분들과 의견을 공유하고 싶습니다. 틀리거나 미흡한 부분 또는 의문 사항이 있으시면 언제든 댓글 남겨주십시오.]