Edit

Debugging User-Mode Processes Without Symbols

  • Article

It is important to have symbols on the faulting machine before starting the debugger for a user-mode failure. However, sometimes the debugger is started without symbols. If the problem is easily reproducible, you can just copy symbols and rerun. If, however, the problem may not occur again, some information can still be gleaned from the failure:

  1. To figure out what the addresses mean, you'll need a computer which matches the one with the error. It should have the same platform (x86 or x64) and be loaded with the same version of Windows.

  2. When you have the computer configured, copy the user-mode symbols and the binaries you want to debug onto the new machine.

  3. Start CDB or WinDbg on the symbol-less machine.

  4. If you don't know which application failed on the symbol-less machine, issue an | (Process Status) command. If that doesn't give you a name, break into KD on the symbol-less machine and do a !process 0 0, looking for the process ID given by the CDB command.

  5. When you have the two debuggers set up -- one with symbols which hasn't hit the error, and one which has hit the error but is without symbols -- issue a k (Display Stack Backtrace) command on the symbol-less machine.

  6. On the machine with symbols, issue a u (Unassemble) command for each address given on the symbol-less stack. This will give you the stack trace for the error on the symbol-less machine.

  7. By looking at a stack trace you can see the module and function names involved in the call.