Forcing WinDbg to load symbols of an unloaded module

windbg
Amir Gonnen picture Amir Gonnen · Jun 11, 2012 · Viewed 23.2k times · Source

I'm debugging a module for which I have only the .exe and a .pdb without private symbols.
During the debug session I need to inspect an internal struct. Obviously this struct does not appear in the PDB since it's private - but fortunately I have an .h file where this struct is defined. Therefore I can build some dummy module that uses this struct and obtain a PDB file that contains this struct.

Now I have an unloaded module with the struct symbols, and I would like to load its symbols in order to cast some memory to that struct. (without unloading the original .exe I'm debugging, of course)
The problem: it seems that WinDbg only allows loading symbols for loaded modules...

My question is: Is there a simple way I could load my symbols from the unloaded module?

I've tried .reload /i /f MyDll.dll but I always get ...MyDll.dll - unmatched.
Setting the sympath did not help.

Any ideas?

Answer

Codeguard picture Codeguard · Sep 9, 2013

A better way is .reload /unl MyDll.dll

Unloaded module list contains timestamp (for image/pdb matching) and image base address. Using /unl tells WinDBG to use that information.

Related questions

Getting windbg without the whole WDK?

Does anyone know how to get ahold of windbg without having to download the entire 620MB WDK ISO? All I can find on the net to download the debugger is this link, which says you have to get the whole …

Read More
How to set up symbols in WinDbg?

I am using Debugging Tools for Windows and I get the following error message when starting WinDbg / cdb or ntsd: Symbol search path is: *** Invalid *** **************************************************************************** * Symbol loading may be unreliable without a symbol search path. * * Use .symfix to have the …

Read More
ERROR: Symbol file could not be found. windbg.exe

I downloaded the symbols from http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx the package (Windows 7 RTM x86 retail symbols, all languages) but it still gives me the same error! Done .sympath but still not working .sympath C:\inetpub\…

Read More