0

Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here.

I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2.

Now I have a vanilla VS-2015 compiled binary and I am using the Python module pefile to iterate over the IMAGAE_DEBUG_DIRECTORY objects:

for debug_data_object in pe.DIRECTORY_ENTRY_DEBUG:
    ...

The first entry is as expected:

0x6500     0x0   Characteristics:               0x0       
0x6504     0x4   TimeDateStamp:                 0x59088504 [Tue May 02 13:09:24 2017 UTC]
0x6508     0x8   MajorVersion:                  0x0       
0x650A     0xA   MinorVersion:                  0x0       
0x650C     0xC   Type:                          0x2       
0x6510     0x10  SizeOfData:                    0x88      
0x6514     0x14  AddressOfRawData:              0x176DC   
0x6518     0x18  PointerToRawData:              0x66DC

But there is a second one. Its type is 0xC :

0x651C     0x0   Characteristics:               0x0       
0x6520     0x4   TimeDateStamp:                 0x59088504 [Tue May 02 13:09:24 2017 UTC]
0x6524     0x8   MajorVersion:                  0x0       
0x6526     0xA   MinorVersion:                  0x0       
0x6528     0xC   Type:                          0xC       
0x652C     0x10  SizeOfData:                    0x14      
0x6530     0x14  AddressOfRawData:              0x17764   
0x6534     0x18  PointerToRawData:              0x6764 

What is this second entry about? Why is it there? What does type 0xc correspond to?



UPDATE

In addition to the answer below, this SO post contains additional detailed info.

3

If you check winnt.h from the latest Windows 10 SDK you can find rest of the values there:

#define IMAGE_DEBUG_TYPE_UNKNOWN          0
#define IMAGE_DEBUG_TYPE_COFF             1
#define IMAGE_DEBUG_TYPE_CODEVIEW         2
#define IMAGE_DEBUG_TYPE_FPO              3
#define IMAGE_DEBUG_TYPE_MISC             4
#define IMAGE_DEBUG_TYPE_EXCEPTION        5
#define IMAGE_DEBUG_TYPE_FIXUP            6
#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC      7
#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC    8
#define IMAGE_DEBUG_TYPE_BORLAND          9
#define IMAGE_DEBUG_TYPE_RESERVED10       10
#define IMAGE_DEBUG_TYPE_CLSID            11
#define IMAGE_DEBUG_TYPE_VC_FEATURE       12
#define IMAGE_DEBUG_TYPE_POGO             13
#define IMAGE_DEBUG_TYPE_ILTCG            14
#define IMAGE_DEBUG_TYPE_MPX              15
#define IMAGE_DEBUG_TYPE_REPRO            16

So 0xC is IMAGE_DEBUG_TYPE_VC_FEATURE. It looks like there's not much info on what it is stored there but you can do some searches to get some idea.

1
  • Not much info about IMAGE_DEBUG_TYPE_VC_FEATURE, indeed. I will post a new question at stackoverflow, maybe somebody knows more about IMAGE_DEBUG_TYPE_VC_FEATURE. Feb 10 '18 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.