CODEWITHSUNDEEP
debuggingwindbg
Ghita
Ghita

Reputation: 4505

Configure windbg not to show "wrong symbols" for modules that have no symbols

If I have a dump of a win app, how can I configure the windbg debugger to not "induce me in error" by showing me for modules I don't have any private symbols the nearest symbols it knows. I would want for functions that have unknown symbol to just print the address and not any symbols information + offset which has no relevance and might confuse. E.g.:

 Plg!CopyPropertyHolder+0x42fae
 Plg!CopyPropertyHolder+0x43151
 Plg!CopyPropertyHolder+0x431d5
 Plg!GetWPXFilterVersion+0xe8

Here you see CopyPropertyHolder, but in all cases the start symbol of the corresponding functions is not known and it doesn't help me the fact that the address is computed from something known.

Upvotes: 2

Views: 237

Answers (1)

Thomas Weller
Thomas Weller

Reputation: 59303

What you see are export symbols. Indeed, the function name does not match and may be misleading.

With .symopt+ 400 (SYMOPT_EXACT_SYMBOLS) you can turn export symbols off (or better, turn exact symbols on):

0:000> k L3
[...]
02 00000000`0012c390 000007fe`e29cef0f Qt5Core!QEventDispatcherWin32::processEvents+0x2ba

0:000> .symopt+ 400
Symbol options are 0x30737:
[...]

0:000> k L3
[...]
02 00000000`0012c390 000007fe`e29cef0f Qt5Core+0x222b1a

Upvotes: 3

Related Questions