Skip to content
This repository has been archived by the owner on Apr 27, 2023. It is now read-only.

What does the values in S_PUB32 mean? #34

Open
Kyomian opened this issue Jun 15, 2018 · 3 comments
Open

What does the values in S_PUB32 mean? #34

Kyomian opened this issue Jun 15, 2018 · 3 comments

Comments

@Kyomian
Copy link

Kyomian commented Jun 15, 2018

So, I used cvdump to dump my PDB file. I would like to understand what these values in S_PUB32 mean:

eg.
S_PUB32: [0001:00001B80], Flags: 00000002, ___security_init_cookie

I understand that 00001B80 means that __security_init_cookie is found at 00001B80 offset to the image base address, but I do not understand what the other values mean.

@zjturner
Copy link

zjturner commented Jun 16, 2018

0001:0001B80 means that it is found at offset 0001B80 from section 0001. If you want to know the file offset of section 0001, then use the -headers option to cvdump. or use dumpbin /headers on the exe.

Flags is a bitwise combination of the following values:

  None = 0,
  Code = 1 << 0,
  Function = 1 << 1,
  Managed = 1 << 2,
  MSIL = 1 << 3,

In this case, the value is 2 meaning it is a function. This corresponds to the CV_PUBSYMFLAGS_e enum which you can find in cvinfo.h

@Kyomian
Copy link
Author

Kyomian commented Jun 17, 2018

@zjturner Thank you for the reply. I did cvdump -headers and realised that there are 'SECTION HEADERS' and 'ORIGINAL SECTION HEADERS'. What's the difference between them?

@zjturner
Copy link

zjturner commented Jun 17, 2018 via email

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants