Symbols and Symbol Trees

Usually, when code is compiled to create executable files, either of two different versions of the executables can be created: a debug (also known as checked) version or a non-debug (also known as free) version. The checked version contains extra code that enables a developer to debug problems, but this means a larger and possibly slower executable file. The free version of the executable is smaller and runs at a normal speed, but cannot be debugged.

In Windows NT, we combine the speed and smaller size of free versions with the debugging capabilities of the checked versions. The executable itself is in the free version. However, all executables, drivers, dynamic-link libraries, and other program files in Windows NT have a corresponding "symbol" file, which contains the debug code that is normally part of the checked file. These symbol files are stored on the Windows NT CD, in the \SUPPORT\DEBUG\platform\SYMBOLS directories, where platform is I386, ALPHA, MIPS, or PPC. Within each \SYMBOLS directory, there is one directory for each type of file (.EXE, .DLL, .SYS, etc.). This structure is referred to as a symbol tree. The following directories exist in a standard symbol tree:

All of the utilities used to debug Windows NT or interpret dump files require a symbol tree available containing the symbol files for the version of Windows NT you were running at the time of the crash. Some utilities (such as Dr. Watson) expect the \SYMBOLS directory to be on your hard drive, in the \systemroot directory. Other utilities allow you to specify the path to the \SYMBOLS directory as a command line option or in a dialog box. Some of the utilities described in this section allow you to specify multiple directories separated by semicolons (;) in a symbol path, much like the syntax for the PATH environment variable.