Quick Tip: vfbasics!_AVRF_EXCEPTION_LOG_ENTRY symbol not resolved?


I was debugging some issues with the help of Application Verifier and WinDbg. Since I was onsite I did not have any access to Microsoft’s private symbol servers, so I was using the public symbol server (http://msdl.microsoft.com/download/symbols). On executing the !avrf extension command in WinDbg I was presented with the following error message in WinDbg:

***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: vfbasics!_AVRF_EXCEPTION_LOG_ENTRY                ***

It turns out that my WinDbg symbol path was as follows, and due to it pointing just to the public symbol server it was loading public symbols for vfbasics.dll:

0:001> .sympath
Symbol search path is: SRV*c:\localsymbols*
http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*c:\localsymbols*http://msdl.microsoft.com/download/symbols
0:001> lml
start             end                 module name
00000000`76dc0000 00000000`76f68000   ntdll      (pdb symbols)          c:\localsymbols\ntdll.pdb\FDAD9EE7D6E44F4F9672ECB401A802192\ntdll.pdb
000007fe`f0e50000 000007fe`f0ebe000   verifier   (pdb symbols)          c:\localsymbols\verifier.pdb\43FCE2D63C4544F9B1C67110EB3406951\verifier.pdb
000007fe`f1660000 000007fe`f1693000   vrfcore    (pdb symbols)          c:\localsymbols\vrfcore.pdb\751D23CCD6504794AF2F18C1E547FE371\vrfcore.pdb
000007fe`f28e0000 000007fe`f292a000   vfbasics   (pdb symbols)          c:\localsymbols\vfbasics.pdb\01ABCDFEFF9F4602A7F055801457A7D61\vfbasics.pdb

To resolve the issue, I explicitly pre-pended the path to private symbols for vfbasics (which is c:\windows\system32 or in general %WINDIR%\System32:

.sympath c:\windows\system32*SRV*c:\localsymbols*http://msdl.microsoft.com/download/symbols

.reload

ld vfbasics

0:001> lml
start             end                 module name
00000000`76dc0000 00000000`76f68000   ntdll      (export symbols)       C:\Windows\SYSTEM32\ntdll.dll
000007fe`f28e0000 000007fe`f292a000   vfbasics   (private pdb symbols)  C:\Windows\SYSTEM32\vfbasics.pdb

Then !avrf works just fine!

If you liked this post, please do rate it and try to leave some comments if you can!

Comments (4)

  1. philip.mcgraw@bentley.com says:

    Rather than always pre-pending you symbol path, you may want to just symstore the vfbasics.pdb file(s) from c:Windowssystem32 (and c:windowssyswow64) into your symbol cache.

  2. philip.mcgraw@bentley.com says:

    thanks VERY much for this hint, by the way!

  3. XICO2KX says:

    Nice tip!

    What about the error for "Type referenced: wow64!_TEB32"?

    Do you know how to fix this one?

    Here some of my info from the commands "!sympath", "!sym noisy",".reload -f" and "lml":

    Symbol search path is: C:Windows;C:WindowsSystem32;C:WindowsSysWOW64;C:Program Files (x86)Debugging Symbols (x64);srvc:symbolsmsdl.microsoft.com/…/symbols

    DBGHELP: c:program files (x86)debugging symbols (x64)wow64.pdb58C5DBBCB0374FC4B7065B1F69A030FD1wow64.pdb – mismatched pdb

    DBGHELP: wow64 – public symbols  

            c:symbolswow64.pdb612501691DDF4C66A9B98F6111F8B3EF1wow64.pdb

    DBGHELP: c:program files (x86)debugging symbols (x64)verifier.pdb34CED7359296439FAC854BBD0EADBBB41verifier.pdb – mismatched pdb

    DBGHELP: c:program files (x86)debugging symbols (x64)verifier.pdbAC9061CD05134254B5FAD7B5B990C3AD1verifier.pdb – mismatched pdb

    SYMSRV:  verifier.pdb from msdl.microsoft.com/…/symbols: 72267 bytes – copied        

    DBGHELP: verifier_74270000 – public symbols  

            c:symbolsverifier.pdb8878279C450C4F4DA6B252A4B824B4981verifier.pdb

    DBGHELP: c:windowssystem32vfbasics.pdb – mismatched pdb

    DBGHELP: vfbasics – private symbols & lines

            c:windowssyswow64vfbasics.pdb

    DBGHELP: c:windowssystem32vrfcore.pdb – mismatched pdb

    DBGHELP: vrfcore – private symbols & lines

            c:windowssyswow64vrfcore.pdb

    741b0000 741ef000   wow64      (pdb symbols)          c:symbolswow64.pdb612501691DDF4C66A9B98F6111F8B3EF1wow64.pdb

    74270000 742d0000   verifier_74270000   (pdb symbols)          c:symbolsverifier.pdb8878279C450C4F4DA6B252A4B824B4981verifier.pdb

    74680000 746bc000   vfbasics   (private pdb symbols)  c:windowssyswow64vfbasics.pdb

    74810000 74839000   vrfcore    (private pdb symbols)  c:windowssyswow64vrfcore.pdb

    Do you know what I am doing wrong?

    Thank you very much!

  4. arvindsh says:

    @XICO2KX: Try attaching a native x86 debugger and see what you get. In some cases, I have seen the WOW64 runtime can cause problems with symbol load.