mfc140.dll version 14.0.24212.0 not downloaded from microsoft symbols server

Question

I am using Windbg to debug a dump which has mfc140.dll version 14.0.24212.0 on the main thread callstack. It fails to download this version of mfc140 for some reason.

Here is the log with sym noisy on:

SYMSRV:  BYINDEX: 0xC
         c:\websymbols*http://msdl.microsoft.com/download/symbols
         mfc140.dll
         578697145cc000
SYMSRV:  c:\websymbols\mfc140.dll\578697145cc000\mfc140.dll - file not found
SYMSRV:  HTTPGET: /download/symbols/index2.txt
SYMSRV:  HttpQueryInfo: 400 - HTTP_STATUS_BAD_REQUEST
SYMSRV:  HTTPGET: /download/symbols/mfc140.dll/578697145cc000/mfc140.dll
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/mfc140.dll/578697145cc000/mfc140.dl_
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  HTTPGET: /download/symbols/mfc140.dll/578697145cc000/file.ptr
SYMSRV:  HttpQueryInfo: 404 - HTTP_STATUS_NOT_FOUND
SYMSRV:  c:\websymbols\mfc140.dll\578697145cc000\mfc140.dll not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/mfc140.dll/578697145cc000/mfc140.dll not found

DBGENG:  C:\Windows\System32\mfc140.dll image header does not match memory image header.
DBGENG:  C:\Windows\System32\mfc140.dll - Couldn't map image from disk.
DBGENG:  mfc140.dll - Partial symbol image load missing image info
DBGHELP: Module is not fully loaded into memory.
DBGHELP: Searching for symbols using debugger-provided data.
SYMSRV:  BYINDEX: 0x11
         c:\websymbols*http://msdl.microsoft.com/download/symbols
         mfc140.amd64.pdb
         A2209CF5D6D44F309A30F1D37A54A0F517
SYMSRV:  PATH: c:\websymbols\mfc140.amd64.pdb\A2209CF5D6D44F309A30F1D37A54A0F517\mfc140.amd64.pdb
*** WARNING: Unable to verify timestamp for mfc140.dll
DBGHELP: mfc140 - private symbols & lines 
        c:\websymbols\mfc140.amd64.pdb\A2209CF5D6D44F309A30F1D37A54A0F517\mfc140.amd64.pdb

Based on the error, it needs download mfc140.dll? Which is included the vc++ 2015 redistributable: https://www.microsoft.com/en-us/download/details.aspx?id=53840 you could try to install it if it's not in your machine. — Fletcher, Jan 25 '18 at 09:05
*"C:\Windows\System32\mfc140.dll image header does not match memory image header."* - Sounds like one of the images was tampered with, either on your machine or the machine you got the dump from. — IInspectable, Jan 25 '18 at 10:00
@IInspectable The version of mfc140.dll in system32 folder is 14.0.24215.0 and the dump requires 14.0.24212.0. — devstability, Jan 25 '18 at 11:18
@FletchZhou-MSFT why doesn't it download from the microsoft symbols server? — devstability, Jan 25 '18 at 11:19
The debugger *does* load the symbols from the symbol server. It fails to find a matching binary in your system, to reconstruct the memory of the dumped process. The symbol server does not serve binaries. You have to make them available yourself. — IInspectable, Jan 25 '18 at 13:20
@IInspectable If symbol server does not serve binaries, why does windbg look for it on the symbol server then --- "SYMSRV: http://msdl.microsoft.com/download/symbols/mfc140.dll/578697145cc000/mfc140.dll" — devstability, Jan 25 '18 at 16:31
I don't think it does. I believe that's just how the URL looks. — IInspectable, Jan 25 '18 at 16:47
14.0.24212.0 = Microsoft Visual C++ 2015 Redistributable Update 3: https://www.microsoft.com/en-us/download/details.aspx?id=53587: Source: https://blogs.technet.microsoft.com/jagbal/2017/09/04/where-can-i-download-the-old-visual-c-redistributables/ — magicandre1981, Jan 27 '18 at 07:21
Binaries should download along with .pdb files, debugger should not care about installed versions — Alex Guteniev, May 06 '19 at 10:02
It's seems like 32-64 bits the version mismatch problem. Does you application is compiled as 64 bit? **According to the log the Windbg is trying to load 32-bit version of the _mfc140.dll_ from _C:\Windows\System32\mfc140.dll_.** Perhaps you need redirect the Windbg to use correct 64 bit version of the _mfc140.dll_. — Jackdaw, May 11 '19 at 07:45
See the following post, this information can be useful: [WinDbg says “.dll” was not found in the image list](https://stackoverflow.com/questions/26100851/windbg-says-dll-was-not-found-in-the-image-list). — Jackdaw, May 11 '19 at 07:56
@AlexanderGutenev: what information would the binary (DLL) contain that is not in the PDB and not in the module that is loaded into memory? Put in another way: if it is possible to [save the DLL from the dump to disk](https://stackoverflow.com/questions/1643915/how-can-i-extract-dll-file-from-memory-dump), why would one download the same thing? — Thomas Weller, May 12 '19 at 19:46
@ThomasWeller, unfortunately I cannot save it, as I only have dump with stack, modules info, memory info, but no full memory. — Alex Guteniev, May 13 '19 at 05:01
After reading answer that mentions that "MFC140.dll has the same interface for VS2015, VS2017 and VS2019", I was able to install runtime referred by @magicandre1981 link above. Got DLL. And PDB for it was not missing, only DLL was missing, so the issue was solved. — Alex Guteniev, May 13 '19 at 05:56

Tania Chistyakova · Answer 1 · 2019-05-09T16:42:01.417

1

If an old file isn't in public pdb server, nobody could actually say what was happened. It might be a bug of build system configuration. Or a policy from these times. Or it's deleted already somehow.

For the case I just recommend updating redistributable to the latest version. MFC140.dll has the same interface for VS2015, VS2017 and VS2019.

edited May 09 '19 at 16:42

answered May 09 '19 at 16:35

Tania Chistyakova

3,928
6
13

Well, "it just gone" is an explanation. Not a solution, though. I need to analyze crash dump from the user. Sure if I could re-create the problem in my environment, I would not need specific version. – Alex Guteniev May 13 '19 at 04:54
Anyway, your answer helped me. Knowing now that "MFC140.dll has the same interface for VS2015, VS2017 and VS2019" I was able to figure out that I need to uninstall VS2017 runtime to be able to install vc_redist.x64.exe of version 14.0.24212.0. Installation of vc_redist.x64.exe was the easiest way to get proper MFC140.dll , and it turned out that only the DLL is missing from symbol server, not .pdb – Alex Guteniev May 13 '19 at 05:53
After I install runtime with version 14.0.24212.0, I was not able to process another crash dump with version 14.0.24215.1 . Looks like Microsoft symbol server is not able to provide *any* MFC DLL. Found the right one here, https://www.azdll.net/files/mfc140-dll.html and again , .pdb was avaiable – Alex Guteniev May 15 '19 at 05:50

score 0 · Answer 2 · answered May 15 '19 at 05:58

I'm summarizing comments, already given answer, and my observations.

Microsoft symbol server is not able to provide some DLLs of MFC/CRT.

Yet .pdb files are there.

Get DLLs by:

Installing proper C Runtime. Note that you'll may need to uninstall later version of C Runtime, also note that C Runtime for VS2015/VS2017/VS2019 is shared.
Download DLL from not official source

mfc140.dll version 14.0.24212.0 not downloaded from microsoft symbols server

2 Answers2