Hi, I compiled a simple Hello World test using VC++ 6.0, with default settings. This generates a .PDB file, which is not read by the most recent winedbg. Perhaps this is due to an overly strict sanity check. In debugger/msc.c I found the following check if ( mpd_nth->Signature != IMAGE_NT_SIGNATURE || mpd_nth->FileHeader.NumberOfSections != nth->FileHeader.NumberOfSections || !(mpd_nth->FileHeader.Characteristics & IMAGE_FILE_DEBUG_STRIPPED )) goto leave; Now unfortunately, the characteristics for my file are 0x10e, and hence the IMAGE_FILE_DEBUG_STRIPPED flag is not set. Disabling the check solves this problem, but perhaps I should try to instruct VC++ to enable the bit? Trying the same with Visual Studio .NET is somewhat more cumbersome. I haven't been able to read in the debugging information generated by C++ projects using winedbg. Has anyone else tried this? Greetings, -- Tijs van Bakel, ConnecTUX, <tijs(a)connectux.com>
Tijs van Bakel wrote:
In debugger/msc.c I found the following check
if ( mpd_nth->Signature != IMAGE_NT_SIGNATURE || mpd_nth->FileHeader.NumberOfSections != nth->FileHeader.NumberOfSections || !(mpd_nth->FileHeader.Characteristics & IMAGE_FILE_DEBUG_STRIPPED )) goto leave;
It would appear that this check is simply inverted, i.e. you should remove the '!'. At this point we require debug info *embedded* in the PE module, i.e. *not* stripped ...
Trying the same with Visual Studio .NET is somewhat more cumbersome. I haven't been able to read in the debugging information generated by C++ projects using winedbg. Has anyone else tried this?
The format of the PDB files has changed; winedbg cannot read the new format yet. Bye, Ulrich -- Dr. Ulrich Weigand weigand(a)informatik.uni-erlangen.de
Ulrich Weigand <weigand(a)immd1.informatik.uni-erlangen.de> writes:
Tijs van Bakel wrote:
In debugger/msc.c I found the following check
if ( mpd_nth->Signature != IMAGE_NT_SIGNATURE || mpd_nth->FileHeader.NumberOfSections != nth->FileHeader.NumberOfSections || !(mpd_nth->FileHeader.Characteristics & IMAGE_FILE_DEBUG_STRIPPED )) goto leave;
It would appear that this check is simply inverted, i.e. you should remove the '!'. At this point we require debug info *embedded* in the PE module, i.e. *not* stripped ...
Quoting an MSDN Library page on the topic of "Symbol Files" at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/dbghe... "Debuggers can determine whether an executable file or DLL contains debugging information by searching for the IMAGE_FILE_DEBUG_STRIPPED characteristic. If this characteristic is present, the debugging information exists in a symbol file." This remark is a bit ambiguous. Does it say that if the characteristic is _not_ present, then "the debugging information exists, but not in a symbol file" ?
Trying the same with Visual Studio .NET is somewhat more cumbersome. I haven't been able to read in the debugging information generated by C++ projects using winedbg. Has anyone else tried this?
The format of the PDB files has changed; winedbg cannot read the new format yet.
Any ideas on where to find documentation? Where does the knowledge for the old PDB parser come from? I could ask the above question for many more parts of Wine. There is a lot of code in Wine based on "undocumented" Windows features. Is there a list of sources for information on Windows internals (both books and websites)? Regards, -- Tijs van Bakel, ConnecTUX, <tijs(a)connectux.com>
Tijs van Bakel wrote:
"Debuggers can determine whether an executable file or DLL contains debugging information by searching for the IMAGE_FILE_DEBUG_STRIPPED characteristic. If this characteristic is present, the debugging information exists in a symbol file."
This remark is a bit ambiguous. Does it say that if the characteristic is _not_ present, then "the debugging information exists, but not in a symbol file" ?
Not quite; if the characteristic is not present, *either* the debugging information exists embedded into the PE file itself, *or* there is no debugging information at all. However, note that 'symbol file' does not refer to PDB files, but to DBG files containing stripped PE debug sections. When PDB files are involved, the PE debug section contains only a reference to the PDB, so it does not make much sense to strip it to a separate DBG file (and it therefore usually isn't done).
Any ideas on where to find documentation?
Microsoft does not document the PDB file format publicly as far as I know. I am not aware of any other publicly available documentation that is more comprehensive than the winedbg sources. (There is a short section in Sven Schreiber's "Undocumented Windows 2000 Secrets", but this won't tell you anything that wasn't already in winedbg since before that book came out.) Of course, certain *parts* of the information inside the PDB (like the actual symbol and type information records) do follow the documented CodeView format.
Where does the knowledge for the old PDB parser come from?
From looking at various PDB files ...
I could ask the above question for many more parts of Wine. There is a lot of code in Wine based on "undocumented" Windows features. Is there a list of sources for information on Windows internals (both books and websites)?
Not that I'm aware of; there of course the Pietrek books and others, and there are various websites with bits and pieces of undocumented Windows features. I don't think there's a comprehensive list, though. Bye, Ulrich -- Dr. Ulrich Weigand weigand(a)informatik.uni-erlangen.de
participants (2)
-
tijs＠connectux.com -
Ulrich Weigand