Windows Symbols Debugging

Windows symbols and debugger ground truth

Resolve symbols before treating a function name, source line, type, or field offset as fact. This skill is for symbol/build correctness; load windows-internals, windows-driver-0day, or a binary-analysis skill after the target is identified.

1. Capture module identity

For every executable, DLL, driver, or dump module record:

• full path, SHA-256, file/product version, architecture, and PE timestamp;
• image base when loaded, RVA of the address under analysis, and file offset only when needed;
• PDB GUID plus age from the CodeView debug directory;
• loaded-module timestamp, checksum, and debugger-reported symbol status.

A filename and Windows version are insufficient: servicing can replace individual modules.

Completion: an evidence record can distinguish the exact module from a same-named binary on another build.

2. Configure a reproducible symbol path

Use a cache, then the Microsoft public symbol server. In WinDbg:

.symfix C:\Symbols
.sympath+ srv*C:\Symbols*https://msdl.microsoft.com/download/symbols
.reload /f <module-name>
!sym noisy
.reload /f <module-name>
!sym quiet
lmvm <module-name>

For offline or restricted analysis, retain the downloaded PDB and record its source. Do not point a debugger at an arbitrary PDB merely because its filename matches.

Completion: lmvm shows the expected image and the loaded PDB provenance is captured.

3. Validate the match

1. Compare the module's RSDS GUID/age with the candidate PDB.
2. Confirm the debugger's loaded image base and calculate RVA = VA - image base explicitly.
3. Resolve at least one known exported, public, or disassembly-verified address from symbol to instruction.
4. For private or reconstructed types, corroborate each field with code accesses, object dumps, or independent build-matched evidence.
5. Mark public symbols, inferred labels, and guessed names differently in notes and tooling.

Completion: each address/type assertion states module hash/build, PDB identity, RVA, and validation method.

4. Debugger evidence loop

Use the smallest observation that settles the question:

lm m <module>          ; module base/range
lmvm <module>          ; image and symbol details
x <module>!*pattern*   ; symbol lookup
ln <address>           ; nearest symbol/source line
u <address>            ; instruction validation
!lmi <module>          ; image metadata
.dt <type> <address>   ; typed object only after match validation

For a dump, first confirm its OS build, kernel image, processor architecture, and dump completeness. A missing page, optimized code, or incorrect context limits the conclusion; record that limit instead of inventing a field value.

Handoff record

| module | sha256 | image base | RVA | PDB GUID/age | symbol state | validation | confidence |

Final gate

• Module identity and loaded base recorded.
• PDB GUID/age match verified or mismatch documented.
• Addresses reported as module + RVA, not bare VAs.
• Reconstructed type fields have independent evidence.
• Debugger output and symbol path are preserved with the case.