Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here.
I learned here that for recent VisualStudio-compiled binaries, the type is
IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is
Now I have a vanilla VS-2015 compiled binary and I am using the Python module
pefile to iterate over the
for debug_data_object in pe.DIRECTORY_ENTRY_DEBUG: ...
The first entry is as expected:
0x6500 0x0 Characteristics: 0x0 0x6504 0x4 TimeDateStamp: 0x59088504 [Tue May 02 13:09:24 2017 UTC] 0x6508 0x8 MajorVersion: 0x0 0x650A 0xA MinorVersion: 0x0 0x650C 0xC Type: 0x2 0x6510 0x10 SizeOfData: 0x88 0x6514 0x14 AddressOfRawData: 0x176DC 0x6518 0x18 PointerToRawData: 0x66DC
But there is a second one. Its type is 0xC :
0x651C 0x0 Characteristics: 0x0 0x6520 0x4 TimeDateStamp: 0x59088504 [Tue May 02 13:09:24 2017 UTC] 0x6524 0x8 MajorVersion: 0x0 0x6526 0xA MinorVersion: 0x0 0x6528 0xC Type: 0xC 0x652C 0x10 SizeOfData: 0x14 0x6530 0x14 AddressOfRawData: 0x17764 0x6534 0x18 PointerToRawData: 0x6764
What is this second entry about? Why is it there? What does type
0xc correspond to?
In addition to the answer below, this SO post contains additional detailed info.