1

I am trying to generate a minimal Minidump using MiniDumpWriteDump where I can retroactively attach symbols with a pdb. Currently this works using MiniDumpWithFullMemory but produces a very large dump file.

Producing the dump with MiniDumpNormal produces a small file and gives a stack trace with offsets, but I cannot get Visual Studio or WinDbg to load the symbols. Visual studio just tells me that

Binary was not built with debug information

WinDbg tells me:

ERROR: Symbol file could not be found. Defaulted to export symbols for app.exe.

I have tried several combinations of flags but cannot load symbols without using MiniDumpWithFullMemory. What are the set of flags to generate the smallest possible dump which can resolve symbols for the stack trace?

The executable was built with debug information (/Zi /DEBUG), attaching a debugger to the running process loads the symbols, attaching a debugger to the crashed process (on WER triggering) loads the symbols, and generating the dump with MiniDumpWithFullMemory also loads the symbols, but other dump types do not load the symbols.

tx34
  • 124
  • 7
  • 2
    Possible duplicate of ["binary was not built with debug information " warning meaning in mfc application?](http://stackoverflow.com/questions/12721864/binary-was-not-built-with-debug-information-warning-meaning-in-mfc-applicatio) – Thomas Weller Apr 07 '17 at 23:44
  • 1
    This is not a duplicate of that question, it was built with debug information and will load symbols when dumped with MiniDumpWithFullMemory. – tx34 Apr 07 '17 at 23:54
  • Symbols are loaded lazily also called defferred loading it is in no way related full normal mini orr kernel the lloaded module list is stream so you have some other problem make sure you build both your debug version as well as release version with debug infirmation. Make sure you see /zi in the commandline of your priject make sure a pdb is generated if windbg says no symbols defaulted to export symbols it means your binary was built with no symbols. And minidump just dumped it as is – blabb Apr 08 '17 at 08:35
  • Did you also set your executable search path? Some minidump formats don't contain the executables and you need to supply them when analyzing the dump. – snoone Apr 08 '17 at 13:18
  • @snoone Setting the image file path in WinDbg gives me *** WARNING: Unable to verify timestamp for app.exe *** ERROR: Module load completed but symbols could not be loaded for app.exe – tx34 Apr 10 '17 at 17:27

1 Answers1

2

The most confusing part of this problem was how all debugging was working correctly except for reduced minidumps. Inspecting the executable revealed the issue:

symchk app.exe /v

dumpbin /headers app.exe | grep pdb

Showed that there was no pdb information in the exe. On inspection of my build system I discovered an extra build step that was embedding a manifest using:

MT.exe -manifest C:\app.exe.manifest -outputresource:C:\app.exe;1

Which was causing the pdb information to get stripped.

Removing this build step keeps the debug information and allows symbols to be loaded from a MiniDumpNormal dump.

Community
  • 1
  • 1
tx34
  • 124
  • 7
  • That's a surprising side effect of the manifest tool. Out of curiosity, did you try having the exe, the minidump, and the pdb all in the same directory when you tried to open the dump in the debugger? It might also be interesting to use chkmatch to see if it thinks the exe and pdb file actually match. – Adrian McCarthy Apr 11 '17 at 18:32
  • @AdrianMcCarthy when using the manifested exe putting the pdb/exe/dmp in the same directory does not load the symbols. Chkmatch gives: `Executable: TimeDateStamp: 58ed3297 Debug info: 2 ( CodeView ) TimeStamp: 58ed3297 Characteristics: 0 MajorVer: 0 MinorVer: 0 Size: 92 RVA: 01333e28 FileOffset: 01332a28 CodeView signature: 0\=A Debug info: 12 ( Unknown ) TimeStamp: 58ed3297 Characteristics: 0 MajorVer: 0 MinorVer: 0 Size: 20 RVA: 01333e84 FileOffset: 01332a84 Debug information file: Format: PDB 7.00 Result: unmatched (reason: incompatible debug information formats)` – tx34 Apr 11 '17 at 19:56