Read symbols in WinDBG without exe

Question

I've been using WinDBG to view some structures for an attached C++ exe, e.g

dt blah::class::thingy
    +0x000 Flags: Uint4B
    +0x004 Whatever : Ptr64 something

But I've been given some older PDB files for an earlier version, and I'd like to view the same structures to compare changes, but I can't load the older PDBs as they don't match the current exe version.

So my question is there anyway to use the dt command in WinDBG without first loading/attaching to an exe? I've seen the DIA SDK, but it seems over my head in terms of complexity for what I need.

I'm not sure if there is anyway to even load a PDB without first loading an exe?

https://stackoverflow.com/questions/2040132/reading-a-pdb-file — Hans Passant, Oct 16 '20 at 16:35

blabb · Accepted Answer · 2020-10-16T19:16:25.627

use .symopt+ SYMOPT_LOAD_ANYTHING

to load an unmatched pdb to a current exe but be aware and use it with caution

Type information needed for structure recognition wont have much effect .

but source line numbers or Disassembly Address For a Function may not match and provide bogus information

you can check a module with a pdb using !chksym
if it is mismatched and you don't care about source lines and such stuff but only need typeinfo
you can load the mismatched pdb by using .symopt+ 0x40 and storing the mismatched pdb in pdbsearchpath (cache/curdir/sympath/etc)

0:000> !chksym loadany.exe loadany.pdb

loadany.exe
    Timestamp: 5F89E8D1
  SizeOfImage: 4E000
          pdb: C:\Users\XX\Desktop\loadany\loadany.pdb
      pdb sig: 2FDF9552-88E3-4452-9B5D-A03B24165869
          age: 1

loadany.pdb
      pdb sig: CB93F230-0E80-4485-AA6F-42202F1CF233
          age: 1

sig MISMATCH: loadany.pdb and loadany.exe

0:000> !sym noisy
noisy mode - symbol prompts off
0:000> .reload /f loadany.exe
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DBGHELP: C:\Users\XX\Desktop\loadany\loadany.pdb - mismatched pdb
DBGHELP: Couldn't load mismatched pdb C:\Users\XX\Desktop\loadany\loadany.exe
DBGHELP: loadany - no symbols loaded

0:000> .symopt +0x40
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Symbol options are 0x800B0367:
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
0:000> .reload /f loadany.exe
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DBGHELP: C:\Users\XX\Desktop\loadany\loadany.pdb - mismatched pdb
DBGHELP: Loaded mismatched pdb for C:\Users\XX\Desktop\loadany\loadany.exe
DBGHELP: loadany - private symbols & lines
        C:\Users\XX\Desktop\loadany\loadany.pdb - unmatched

Thanks. I'm not interested in functions at all, I just need to be able to view structs and classes. So can I just put the old pdb into the symcache and tell it to load it? — Tony, Oct 16 '20 at 16:19
yes you need to store the mismatched pdb in pdb search path and just do.reload /f to load a mismatched pdb i edited the answer with a demo — blabb, Oct 16 '20 at 19:16

Read symbols in WinDBG without exe

1 Answers1