UEFI Debugging Troubleshooting

Could not locate debug symbols


ERROR: Could not locate debug symbols for file: MpCpu.efi


This indicates that a symbolic path was found within the module in target memory, but that the debugger was unable to locate the module file on the host machine. To solve this, refer to "Configuring UEFI Source Tree Path" in section UEFI Debug Mode Configuration.

No symbol path information


ERROR: A valid module was located in target memory at 0x784F3000 but it did not contain any symbol path information.


This error indicates that the module that was found on the target did not contain a path to source information. This usually means that the UEFI BIOS build that is running on the target machine was not built with the "Debug" flag enabled, and therefore did not emit debug information into the resulting binaries. To solve this, refer to "Configuring Build and Target" in section UEFI Debug Mode Configuration.

Execution Stopped by HLT Instruction


ERROR: Timeout while trying to search system table. Execution stopped by "HLT instruction"

One of the most common error cases is to invoke the UEFI commands while the target CPU is in the HALT state. Most commonly, this is the case when the target is executing the HLT opcode or any other similar instruction. The script will usually detect this case and will show a dialog box offering to attempt to work around it, but this might not work in all cases.


A manual workaround for this problem is to use the Assembler window to find an instruction (other than HLT) that will be executed in the future. Now, right-click the instruction and select Go Here. This will set a breakpoint and have the target run to it. At this point, the LoadDXEModules button can be used.

Target Crashes while using LoadDXEModules Button

The LoadDXEModules script inserts a short piece of assembly code into the target system, by default at address 0x100000. This code will search the target DRAM for the signature of the UEFI system table and restore the original memory contents afterwards. Depending on your target configuration, memory access to this address may crash your target.


Edit the file <install-dir>/<debugger-dir>/system_debug/scripts/constants.xdb and modify the variable TARGET_CODE_BASE to an address that the debugger can access.

Timeout while using LoadPEIMs Button

The LoadPEIMs script scans flash memory for the signature of the firmware volume, assuming a common address range of 0xFFC00000 to 0xFFFF8000 for flash memory, but can timeout if the range for flash memory is different on the target system.


If the range for flash memory is different on the target system, edit the file <install-dir>/<debugger-dir>/system_debug/scripts/constants.xdb and modify the variables FVBASE and FVLIMIT to reflect the correct values.

Enabling debug logging of the UEFI Plugin

In the startup script of the debugger <install_dir>/xdb.bat or <install_dir>/xdb.sh.

The debugger can log all transactions made to the target connection layer. Enable logging by setting the environment variable TCI_LOG=1 .

For example, edit the xdb.bat startup script to include the command set TCI_LOG=1 .

A log file will be created, for example, C:\Users\<username>\.sysdbg_<product_year> .

UEFI Buttons are missing in the GUI

The UEFI buttons are loaded automatically during start of the debugger from the script file scripts/startup.xdb. If the buttons are missing they can be added manually by using one of the following options:

Option 1: Using the GUI

  1. In the menu bar, select: File > Execute Command File ....

  2. Click the Browse… button.

  3. As Files, select


  4. Click OK.

Option 2: Using the Command Line

In the Console view, type:

BATCH "scripts/efi.xdb"

Both options will use the relative path to install directory <install-dir>/<debugger-dir>/system_debug .

See Also