Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here.
I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW
, i.e. the value is 0x2
.
Now I have a vanilla VS-2015 compiled binary and I am using the Python module pefile
to iterate over the IMAGAE_DEBUG_DIRECTORY
objects:
for debug_data_object in pe.DIRECTORY_ENTRY_DEBUG:
...
The first entry is as expected:
0x6500 0x0 Characteristics: 0x0
0x6504 0x4 TimeDateStamp: 0x59088504 [Tue May 02 13:09:24 2017 UTC]
0x6508 0x8 MajorVersion: 0x0
0x650A 0xA MinorVersion: 0x0
0x650C 0xC Type: 0x2
0x6510 0x10 SizeOfData: 0x88
0x6514 0x14 AddressOfRawData: 0x176DC
0x6518 0x18 PointerToRawData: 0x66DC
But there is a second one. Its type is 0xC :
0x651C 0x0 Characteristics: 0x0
0x6520 0x4 TimeDateStamp: 0x59088504 [Tue May 02 13:09:24 2017 UTC]
0x6524 0x8 MajorVersion: 0x0
0x6526 0xA MinorVersion: 0x0
0x6528 0xC Type: 0xC
0x652C 0x10 SizeOfData: 0x14
0x6530 0x14 AddressOfRawData: 0x17764
0x6534 0x18 PointerToRawData: 0x6764
What is this second entry about? Why is it there? What does type 0xc
correspond to?
UPDATE
In addition to the answer below, this SO post contains additional detailed info.