Hi,
So I was trying to parse PE file using the documentation at
The documentation say about the location of the debug directory that: "The debug directory can be in a discardable .debug section (if one exists), or it can be included in any other section in the image file, or not be in a section at all."
I understand the first 2 points (it is either in the .debug section or any other section) and can find the debug directory fairly easily, however if the Debug Directory is not in any section at all how can I locate it then.
Note: I am trying to avoid loading the image, so the RVA provided in the debug data directory isn't useful to me without knowing which section it is a part of.
So I was trying to parse PE file using the documentation at
The documentation say about the location of the debug directory that: "The debug directory can be in a discardable .debug section (if one exists), or it can be included in any other section in the image file, or not be in a section at all."
I understand the first 2 points (it is either in the .debug section or any other section) and can find the debug directory fairly easily, however if the Debug Directory is not in any section at all how can I locate it then.
Note: I am trying to avoid loading the image, so the RVA provided in the debug data directory isn't useful to me without knowing which section it is a part of.
Edited by suhaib_khan
on
Reason: Initial post
You locate it by looking at data directory table: https://docs.microsoft.com/en-us/...eader-data-directories-image-only
This table contains address and size of various directories, including debug one.
Are you parsing .exe or .obj files. If I'm not mistaken then for 64-bit .exe files cl.exe/link.exe does not produce .debug section or debug directory. It puts all debug stuff into .pdb file.
This table contains address and size of various directories, including debug one.
Are you parsing .exe or .obj files. If I'm not mistaken then for 64-bit .exe files cl.exe/link.exe does not produce .debug section or debug directory. It puts all debug stuff into .pdb file.
Hi,
That table (data directory) only contains the RVA (the address after it has been loaded in memory) not the offset within the file (the thing I actually need).
I am parsing .exe files so I could find the pdb file associated with it. The information about the location of the PDB file can be gotten from the Debug Directory
From what I have seen through limited testing this information (debug directory) is usually within the .rdata section.
But I don't know how to handle cases where the debug directory is not within any section (although I haven't encountered such a case).
As for the .debug section I do believe it is not produces for 64-bit exe files at all, but the Debug Directory is definitely created (usually in .rdata as mentioned previously).
Note: I could load the image using a loader, then simply use the RVAs in the table, but I want to avoid that if at all possible.
That table (data directory) only contains the RVA (the address after it has been loaded in memory) not the offset within the file (the thing I actually need).
I am parsing .exe files so I could find the pdb file associated with it. The information about the location of the PDB file can be gotten from the Debug Directory
From what I have seen through limited testing this information (debug directory) is usually within the .rdata section.
But I don't know how to handle cases where the debug directory is not within any section (although I haven't encountered such a case).
As for the .debug section I do believe it is not produces for 64-bit exe files at all, but the Debug Directory is definitely created (usually in .rdata as mentioned previously).
Note: I could load the image using a loader, then simply use the RVAs in the table, but I want to avoid that if at all possible.
Edited by suhaib_khan
on
Reason: Added information
I am not sure what you want to parse or how far you want to go, but the physical offset can be calculated staticaly from the RVA, you do not need to actually load the file, you have all the information you need. This is sometimes a bit tricky though and there are some tricks you need to know if you want a really good parser, but for the majority of files it's kind of straightforward.