Application Security Testing: An Integral Part of DevOps
This article describes how to set up and use the Microsoft Symbol Server to help you debug applications under Windows. Microsoft provides access to an Internet symbol server that contains symbol files for the Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems, as well as other Microsoft products.
When debugging applications with various Microsoft Tools, you must have symbol information available (usually stored in a .pdb file). Debug symbols provide you with a footprint of the functions that are contained in executable files and dynamic-link libraries (DLLs). In addition, when debugging an application, symbol files can help point to the function calls that led to a failure by helping you view your application's full call stack.
To install a full set of symbols for your operating system and associated files, you will need to have at least 1 Gb of free space available. It should use less than this (around 550 Mb–750 Mb), but 1 Gb will allow the Symbol Server to automatically download new symbols as necessary.
To set up the Symbol Server, you will need to download it from Microsoft; it's part of the Debugging Tools for Windows kit. (Always download the latest version.) You can download the appropriate version from the following locations:
- Install Debugging Tools for Windows 32-bit Version
- Install Debugging Tools for Windows 64-bit Version
Configuring Symbol Server
Before you can use Symbol Server, you need to configure it. This is very easy and simply requires that you to set the _NT_SYMBOL_PATH environment variable. Once you have set this path, you will find that most of the common Microsoft debugging tools will use it automatically.
This variable can be a system OS user environment variable. To set it from the desktop, right-click My Computer, and then click Properties. Select the Advanced tab and click the Environment Variables button.
You need to set this variable to the following value:
In the example above, I have told the Symbol Server that I want my local cache to be in the e:\localsymbols folder. You will need to modify this to point to the location that you want to use.
You can see my symbol path in the following screenshot, in the list of System variables.
Using the SymChk.exe Utility to Download Symbols
The SymChk.exe utility can be used to build your local symbol cache quickly, rather than waiting for individual symbols to be downloaded while you are debugging an application. This utility is included with the Debugging Tools for Windows package.
SymChk.exe is a command-line tool. You could add the Debugging Tools for Windows folder to your PATH environment variable for convienience so that you can access it from any command prompt. Type the following at a command prompt, replacing the symbol path (e:\localsymbols) with the one you have chosen.
symchk /r c:\windows\system32 /s SRV*e:\localsymbols\ *http://msdl.microsoft.com/download/symbols
In the above example:
- /r c:\windows\system32: Finds all symbols for files in the System32 folder and any subfolders.
- /s SRV*e:\localsymbols\*http://msdl.microsoft.com/download/symbols: Specifies the symbol path to use for symbol resolution. In this case, e:\localsymbols is the local folder where the symbols will be copied from the symbol server.
Using the Symbol Server with the Visual Studio .NET or Visual Studio 2005 Debugger
This section describes how to use the Visual Studio .NET or Visual Studio 2005 debugger with a symbol server. This allows them to load symbols automatically from the Symbol Server, assuming they are not already in your local cache.
Before you begin, ensure that you have downloaded the latest Debugging Tools for Windows and set the _NT_SYMBOL_PATH environment variable.
- Find the Symsrv.dll file in the c:\Program Files\Debugging Tools for Windows folder.
- Close any copies of Visual Studio .NET or Visual Studio 2005 that are running.
- Copy the Symsrv.dll file to the C:\Program Files\Microsoft Visual Studio .NET\Common7\IDE or C:\Program Files\Microsoft Visual Studio 8\Common7\IDE folder.
The next time that you start Visual Studio .NET or Visual Studio 2005, you can use the Symsrv.dll file to find symbol servers that you specify.
Adding Your Own Symbols to the Symbol Server Cache
When developing and debugging your own applications, you can use the SymStore.exe utility to add your own symbols to your local symbol cache. This will allow a debugger to retrieve the symbols it requires automatically, giving you an almost complete call stack every time you debug.
SymStore comes with the Debugging Tools for Windows, and you should refer to its documentation for full information on using SymStore. The following sections show a simple method of adding your own symbols and then removing them from the symbol cache.
Typically, your application's symbols will be stored within the executable image itself (MyApp.exe) or within a separate program database file (MyApp.pdb).
Every call to SymStore is recorded as a transaction, of which there are two types: add and delete. You will need to understand how these transactions work before you can delete your symbols from the cache because you will need the transaction number that was assigned when you added the symbols in the first place. This is obviously cumbersome, but because you will be mainly adding symbols to your cache, it is not really a problem. You should only need to delete symbols occasionally.
When you create your symbol cache for the first time, a folder called 000admin will be created under the root folder of the cache. This folder contains one file per transaction, as well as two log files, server.txt and history.txt.
The server.txt file contains a list of all transactions that are currently on the server. The history.txt file contains a chronological history of all transactions.
Each time you add symbols, SymStore will generate a new transaction number and will create a file with this name in the 000admin folder. This file contains a list of all the files that were added to the symbol cache during this transaction. When you delete symbols, SymStore will use this file to determine which files it should delete from the cache. A new transaction number will be allocated for the delete operation, too.
To add your own application's symbols to the cache, you need to specify the location of the cache and the path of the folder containing the symbols. The following example shows how to add symbols for an application called SymbolTest to your cache that is stored in d:\Symbols. You tell SymStore to recursively search (/r) from the specified folder for the symbols.
symstore add /r /f d:\MyStuff\Code\SymbolTest\*.* /s d:\Symbols /v "Build 1"
In this example:
- /f d:\MyStuff\Code\SymbolTest\*.*—Finds all symbols for the SymbolTest application.
- /s d:\Symbols—Specifies the root folder of your local symbol cache.
- /v "Build 1"—Specifies the version of the product.
The Transaction: 0000000001
When I added the symbols for SymbolTest, SymStore created a transaction file (filename: 0000000001), containing the name of each of the symbol files that it added to the cache, the contents of which can be seen here:
"vc70.pdb\6BE4B8055F6846F5A2BB748B91DA5FD9", "D:\My Stuff\SymbolTest\release\vc70.pdb" "SymbolTest.pdb\96CE1B9F227349DD948B38831D9161A11", "D:\My Stuff\SymbolTest\release\SymbolTest.pdb"
Note: SymStore does not support simultaneous transactions from multiple users. Microsoft recommends that a single user is assigned to be the administrator of the symbol store and they will be responsible for all add/delete transactions.
To remove the symbols from the cache, you will need to know the ID of your initial Add transaction. See the previous section, Adding symbols, to determine the transaction ID. In this example, the value is 0000000001.
You need to specify the number of the transaction that you want to delete, and the path to your symbol cache on the command line to SymStore, as in the following example.
symstore del /i 0000000001 /s d:\Symbols
You now should have full symbolic information when debugging, including full symbols for whatever operating system you are working on. In an environment with multiple developers, they can all share the same symbol store by simply placing it on a network location accessible to all.
- 1.01 (May 24, 2006): Added a section on how to add your own symbols to the Symbol Server Cache.
- 1.00 (May 17, 2006): Initial Public Release.