Skip to content

Image Debug Directory

AFP edited this page Apr 1, 2023 · 1 revision

How to Access Image Debug Directory

after initialize the PE class you can get access the Image Debug Directory structure by calling GetImageDebugDirectory() method. by calling this function, you get the object of ImageDebugDirectory class, so you can retrieve the fields, change or modify them.

#include <iostream>
#include <POEX.h> // include POEX header

int main()
{
    auto pe = POEX::PE(L"1.exe");

    // Access to Image Debug Directory
    auto debugDirectory = pe.GetImageDebugDirectory();

    // other stuff in here

    return 0;
}

With calling GetImageDebugDirectory method, you can access the structure and method in bellow:

        /// <summary>
	/// Characteristics of the debug information.
	/// </summary>
	/// <returns>Characteristics</returns>
	auto Characteristics() const->unsigned int;

	/// <summary>
	/// Characteristics of the debug information.
	/// </summary>
	/// <param name="characteristics">Characteristics</param>
	/// <returns></returns>
	auto Characteristics(const unsigned int& characteristics) -> void;

	/// <summary>
	/// Time and date stamp
	/// </summary>
	/// <returns>Time and date stamp</returns>
	auto TimeDateStamp() const->unsigned int;

	/// <summary>
	/// Time and date stamp
	/// </summary>
	/// <param name="time">Time and date stamp</param>
	/// <returns></returns>
	auto TimeDateStamp(const unsigned int& time) -> void;

	/// <summary>
	/// Major Version.
	/// </summary>
	/// <returns>Major Version.</returns>
	auto MajorVersion() const->unsigned short;

	/// <summary>
	/// Major Version.
	/// </summary>
	/// <param name="majorVersion"></param>
	/// <returns></returns>
	auto MajorVersion(const unsigned short& majorVersion) -> void;

	/// <summary>
	/// Minor Version.
	/// </summary>
	/// <returns></returns>
	auto MinorVersion() const->unsigned short;
    
	/// <summary>
	/// Minor Version.
	/// </summary>
	/// <param name="minorVersion">Minor Version.</param>
	/// <returns></returns>
	auto MinorVersion(const unsigned short& minorVersion) -> void;

	/// <summary>
        /// Type
        /// 1: Coff
        /// 2: CV-PDB
        /// 9: Borland
	/// </summary>
	/// <returns></returns>
	auto Type() const->unsigned int;

	/// <summary>
    /// Type
    /// 1: Coff
    /// 2: CV-PDB
    /// 9: Borland
	/// </summary>
	/// <param name="type">type</param>
	/// <returns></returns>
	auto Type(const unsigned int& type) -> void;

	/// <summary>
	/// Type of Entry
	/// </summary>
	/// <returns>Type</returns>
	auto DebugType() const->DebugDirectoryType;

	/// <summary>
	/// Type of Entry
	/// </summary>
	/// <param name="type">type</param>
	/// <returns></returns>
	auto DebugType(const DebugDirectoryType& type) -> void;

	/// <summary>
	/// Size of data.
	/// </summary>
	/// <returns>Size</returns>
	auto SizeOfData() const->unsigned int;

	/// <summary>
	/// Size of data.
	/// </summary>
	/// <param name="length">Size</param>
	/// <returns></returns>
	auto SizeOfData(const unsigned int& length) -> void;

	/// <summary>
	/// Address of raw data.
	/// </summary>
	/// <returns>offset</returns>
	auto AddressOfRawData() const->unsigned int;

	/// <summary>
	/// Address of raw data.
	/// </summary>
	/// <param name="offset">pffset</param>
	/// <returns></returns>
	auto AddressOfRawData(const unsigned int& offset) -> void;

	/// <summary>
	/// Pointer to raw data.
	/// </summary>
	/// <returns>Pointer</returns>
	auto PointerToRawData() const->unsigned int;

	/// <summary>
	/// Pointer to raw data.
	/// </summary>
	/// <param name="offset">Pointer</param>
	/// <returns></returns>
	auto PointerToRawData(const unsigned int& offset) -> void;

	/// <summary>
	/// PDB information if the "Type" is IMAGE_DEBUG_TYPE_CODEVIEW.
	/// </summary>
	/// <returns></returns>
	auto PdbInfo() const->std::unique_ptr<CvInfoPdb70>;

	/// <summary>
	/// Flags if the "Type" is IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS
	/// </summary>
	/// <returns>characteristics</returns>
	auto ExtendedDllCharacteristics() const->ExtendedDllCharacteristicsType;

And with Calling PdbInfo method you can access to CvInfoPdb70 structure:

    /// <summary>
    /// Codeview signature.
    /// Typically 0x53445352 = 'RSDS'
    /// </summary>
    /// <returns></returns>
    auto CvSignature() const -> unsigned int;

    /// <summary>
    /// Codeview signature.
    /// Typically 0x53445352 = 'RSDS'
    /// </summary>
    /// <param name="cvSignature">Codeview signature</param>
    /// <returns></returns>
    auto CvSignature(const unsigned int& cvSignature) -> void;

    /// <summary>
    /// The PDB signature is a GUID to identify the PDB file which belongs to the PE file.
    /// </summary>
    /// <returns>guid</returns>
    auto Signature() const->GUID;

    /// <summary>
    /// The PDB signature is a GUID to identify the PDB file which belongs to the PE file.
    /// </summary>
    /// <param name="signature">guid</param>
    /// <returns></returns>
    auto Signature(const GUID& signature) -> void;

    /// <summary>
    /// PDB Age is the iteration of the PDB. The first iteration is 1. 
    /// The iteration is incremented each time the PDB content is augmented.
    /// </summary>
    /// <returns>Iteration if PDB</returns>
    auto Age() const -> unsigned int;

    /// <summary>
    /// PDB Age is the iteration of the PDB. The first iteration is 1. 
    /// The iteration is incremented each time the PDB content is augmented.
    /// </summary>
    /// <param name="age">Iteration if PDB</param>
    /// <returns></returns>
    auto Age(const unsigned int& age) -> void;

    /// <summary>
    /// Original file name of the PDB that belongs to the PE file.
    /// </summary>
    /// <returns></returns>
    auto PdbFileName() const->std::string;