What does the values in S_PUB32 mean?

[Kyomian]

So, I used cvdump to dump my PDB file. I would like to understand what these values in S_PUB32 mean:

eg.
S_PUB32: [0001:00001B80], Flags: 00000002, ___security_init_cookie

I understand that 00001B80 means that __security_init_cookie is found at 00001B80 offset to the image base address, but I do not understand what the other values mean.

[zjturner]

0001:0001B80 means that it is found at offset 0001B80 from section 0001. If you want to know the file offset of section 0001, then use the -headers option to cvdump. or use dumpbin /headers on the exe.

Flags is a bitwise combination of the following values:

  None = 0,
  Code = 1 << 0,
  Function = 1 << 1,
  Managed = 1 << 2,
  MSIL = 1 << 3,

In this case, the value is 2 meaning it is a function. This corresponds to the CV_PUBSYMFLAGS_e enum which you can find in cvinfo.h

[Kyomian]

@zjturner Thank you for the reply. I did cvdump -headers and realised that there are 'SECTION HEADERS' and 'ORIGINAL SECTION HEADERS'. What's the difference between them?

[zjturner]

I actually don’t know, my guess is it has to do with incremental linking. Try doing doing a clean build, then add a function and do an incremental link. Probably section headers will change but original section headers won’t

…

On Sun, Jun 17, 2018 at 9:16 AM Jarrett ***@***.***> wrote: @zjturner <https://github.com/zjturner> Thank you for the reply. I did cvdump -headers and realised that there are 'SECTION HEADERS' and 'ORIGINAL SECTION HEADERS'. What's the difference between them? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#34 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ALRpSYVZ_3BOtqFi1pLdmNQJHxOmAYwgks5t9oDvgaJpZM4UpkL4> .