ProcMon Enable debugger

1. Set _nt_symbol_path

If the correct? Symsrv syntax is provided in the _NT_SYMBOL_PATH environment variable, the common Mircoroft debugging tool will use SYMSRV technology. These tools automatically include any content that you provide as a symbol path in the variable.

You can set the variable to either a system variable or a user environment variable. To do this from the desktop, right-click My Computer, and then click Properties. On the Advanced tab, click Environment Variables.

You can also set the variable temporarily at the command prompt. If you use this method, all applications that are started from the command prompt inherit the setting. Example: Set _nt_symbol_path = Symsrv*symsrv.dll*c:\symbols*http://msdl.microsoft.com/download/symbols

Source Document

2. Download Debug Symbols

To use the SymChk.exe utility to download symbol files for all components in the Windows\System32 folder, use the following command-line command:

SYMCHK/R c:\windows\system32/s Srv*c:\symbols\*http://msdl.microsoft.com/download/symbols

3. Configure ProcMon Symbols

Copy the Dbghelp.dll and Symsrv.dll in the WinDbg into the system directory and set the debug symbol path to%_nt_symbol_path%

4. Start using ProcMon for monitoring

ProcMon Enable debugger