.SYM

Introduction

A Breakpad symbol file is a plain-text summary of a program’s debug information, made for Breakpad, Google’s crash reporting system, and used by its successor Crashpad. When a program crashes, Breakpad saves a small minidump of its state; the minidump_stackwalk tool then reads the matching .sym files to turn the raw addresses into function names, source files and line numbers.

The dump_syms tool writes a .sym file from the native debug information: a PDB on Windows, DWARF in an ELF file on Linux, or a dSYM on macOS. One format for every system means a crash server needs only one kind of reader. Chrome, Firefox and many other programs use these files.

Structure

The file is text, one record per line, each starting with a keyword. The first line is the MODULE record: the operating system, the processor architecture, a debug identifier that matches the binary, and the module’s name. Then come:

• FILE records, numbering the source files;
• FUNC records, giving each function’s address, size, stack parameter size and name, each followed by line records of address, size, line number and file number;
• PUBLIC records for symbols with no line information;
• STACK WIN and STACK CFI records, which tell the stack walker how to find each caller’s frame.

Addresses are hexadecimal offsets from the module’s load address.

MODULE Linux x86_64 6EDC6ACDB282125843FD59DA9C81BD830 example
FILE 0 /src/example/main.c
FUNC 1130 2a 0 main
1130 4 3 0
1134 1d 4 0
1151 9 5 0
PUBLIC 1000 0 _init

Links