Debug information

Hi,

I compiled a simple Hello World test using VC++ 6.0, with default
settings.  This generates a .PDB file, which is not read by the most
recent winedbg.  Perhaps this is due to an overly strict sanity check.

In debugger/msc.c I found the following check

if ( mpd_nth->Signature != IMAGE_NT_SIGNATURE || 
      mpd_nth->FileHeader.NumberOfSections != nth->FileHeader.NumberOfSections ||
      !(mpd_nth->FileHeader.Characteristics & IMAGE_FILE_DEBUG_STRIPPED ))
     goto leave;

Now unfortunately, the characteristics for my file are 0x10e, and
hence the IMAGE_FILE_DEBUG_STRIPPED flag is not set.  Disabling the
check solves this problem, but perhaps I should try to instruct VC++
to enable the bit?

Trying the same with Visual Studio .NET is somewhat more cumbersome.
I haven't been able to read in the debugging information generated by
C++ projects using winedbg.  Has anyone else tried this?

Greetings,

[Ulrich Weigand]

Tijs van Bakel wrote:
> In debugger/msc.c I found the following check
>
> if ( mpd_nth->Signature != IMAGE_NT_SIGNATURE || 
>       mpd_nth->FileHeader.NumberOfSections != nth->FileHeader.NumberOfSections ||
>       !(mpd_nth->FileHeader.Characteristics & IMAGE_FILE_DEBUG_STRIPPED ))
>      goto leave;

It would appear that this check is simply inverted, i.e. you should
remove the '!'.  At this point we require debug info *embedded*
in the PE module, i.e. *not* stripped ...
> Trying the same with Visual Studio .NET is somewhat more cumbersome.
> I haven't been able to read in the debugging information generated by
> C++ projects using winedbg.  Has anyone else tried this?

The format of the PDB files has changed; winedbg cannot read the
new format yet.

Bye,
Ulrich

Ulrich Weigand  writes:
> Tijs van Bakel wrote:
> > In debugger/msc.c I found the following check
> >
> > if ( mpd_nth->Signature != IMAGE_NT_SIGNATURE || 
> >       mpd_nth->FileHeader.NumberOfSections != nth->FileHeader.NumberOfSections ||
> >       !(mpd_nth->FileHeader.Characteristics & IMAGE_FILE_DEBUG_STRIPPED ))
> >      goto leave;
>
> It would appear that this check is simply inverted, i.e. you should
> remove the '!'.  At this point we require debug info *embedded*
> in the PE module, i.e. *not* stripped ...

Quoting an MSDN Library page on the topic of "Symbol Files" at
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/dbghe...

"Debuggers can determine whether an executable file or DLL contains
debugging information by searching for the IMAGE_FILE_DEBUG_STRIPPED
characteristic. If this characteristic is present, the debugging
information exists in a symbol file."

This remark is a bit ambiguous.  Does it say that if the
characteristic is _not_ present, then "the debugging information
exists, but not in a symbol file" ?
> > Trying the same with Visual Studio .NET is somewhat more cumbersome.
> > I haven't been able to read in the debugging information generated by
> > C++ projects using winedbg.  Has anyone else tried this?
>
> The format of the PDB files has changed; winedbg cannot read the
> new format yet.

Any ideas on where to find documentation?  Where does the knowledge
for the old PDB parser come from?

I could ask the above question for many more parts of Wine.  There is
a lot of code in Wine based on "undocumented" Windows features.  Is
there a list of sources for information on Windows internals (both
books and websites)?

Regards,

[Ulrich Weigand]

Tijs van Bakel wrote:
> "Debuggers can determine whether an executable file or DLL contains
> debugging information by searching for the IMAGE_FILE_DEBUG_STRIPPED
> characteristic. If this characteristic is present, the debugging
> information exists in a symbol file."
>
> This remark is a bit ambiguous.  Does it say that if the
> characteristic is _not_ present, then "the debugging information
> exists, but not in a symbol file" ?

Not quite; if the characteristic is not present, *either* the
debugging information exists embedded into the PE file itself,
*or* there is no debugging information at all.

However, note that 'symbol file' does not refer to PDB files, but
to DBG files containing stripped PE debug sections.

When PDB files are involved, the PE debug section contains only
a reference to the PDB, so it does not make much sense to strip
it to a separate DBG file (and it therefore usually isn't done).
> Any ideas on where to find documentation?

Microsoft does not document the PDB file format publicly as
far as I know.  I am not aware of any other publicly available
documentation that is more comprehensive than the winedbg sources.
(There is a short section in Sven Schreiber's "Undocumented
Windows 2000 Secrets", but this won't tell you anything that
wasn't already in winedbg since before that book came out.)

Of course, certain *parts* of the information inside the PDB
(like the actual symbol and type information records) do follow
the documented CodeView format.
> Where does the knowledge for the old PDB parser come from?
> From looking at various PDB files ...
> I could ask the above question for many more parts of Wine.  There is
> a lot of code in Wine based on "undocumented" Windows features.  Is
> there a list of sources for information on Windows internals (both
> books and websites)?

Not that I'm aware of; there of course the Pietrek books and others,
and there are various websites with bits and pieces of undocumented
Windows features.  I don't think there's a comprehensive list, though.

Bye,
Ulrich