windows3-7  Exercise 2: Which Files Have Public Symbols?
=================================================================

Verification: Level 1 (run on the author's machine, read-only, no administrator rights).

Prediction (work this out before running the script):

  Before running: predict which of these four have public symbols on Microsoft's server: ntoskrnl.exe,
  ntfs.sys, a networking driver from a hardware vendor (Killer), a VPN vendor's network driver (NDivert).

Commands (symbol_check.ps1 saved in the current folder):

  .\symbol_check.ps1
  .\symbol_check.ps1 -Path C:\Windows\System32\drivers\ntfs.sys
  .\symbol_check.ps1 -Path <path to a third-party driver .sys>

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  ntoskrnl.exe:
  File    : ntoskrnl.exe
  Symbols : ntkrnlmp.pdb   (key B661C6FE72991D160FE37C48B8BC54701)
  Server  : HTTP 302  (the symbol file exists on Microsoft's server)

  ntfs.sys:
  File    : ntfs.sys
  Symbols : ntfs.pdb   (key 433D847E833EE79E99B44E8EB90397BE1)
  Server  : HTTP 302  (the symbol file exists on Microsoft's server)

  KfeCo11X64.sys:
  File    : KfeCo11X64.sys
  Symbols : KfeCo11x64.pdb   (key B332E38520074DAFB2B68924724339331)
  Server  : HTTP 404  (not found: Microsoft does not publish these symbols)

  NDivert.sys:
  File    : NDivert.sys
  Symbols : NDivert.pdb   (key 41B64C5A98714B7E92D76DA9DEBEB0911)
  Server  : HTTP 404  (not found: Microsoft does not publish these symbols)

WHY THIS WORKS AS AN ANSWER
---------------------------
  The two Microsoft files return HTTP 302 (the symbol server redirects to the file, so it exists). The two
  third-party drivers return HTTP 404: Microsoft does not publish another company's symbols.
  What a stack through a driver without symbols looks like: the debugger can show the module name and, because of
  "export symbols", the names the driver exports, or an offset into the module; it cannot show the driver's internal
  function names. (I have not seen such a stack for these drivers: this is from Microsoft's symbol-path page and from the 404.)
  So the module list and the module name carry the information, not the function names; and a vendor, who has its own
  symbols, can read what you cannot.
  Common mistakes: reading a 404 as "your debugger is misconfigured"; assuming a Microsoft-signed driver always has
  public symbols (check; the server is the authority); and treating the key in the URL as something to type.