Question

As far as I have understood, COFF symbol table in the Microsoft's Portable Executable format is used to store the export, import and the debug symbols. But as we already have a .edata, .idata and .debug section for the purpose why do we need another such structure for it?

Était-ce utile?

La solution

See here: http://msdn.microsoft.com/en-us/library/ms809762.aspx

"[the COFF symbol table] is only used in OBJ files and PE files with COFF debug information."

"The .rdata section is used for at least two things. [...] (In TLINK32 EXEs, the debug directory is in a section named .debug.) [...] Three main types of debug information appear: CodeView®, COFF, and FPO."

"Why would anyone need COFF debug information when the much more complete CodeView information is available? If you intend to use the Windows NT system debugger (NTSD) or the Windows NT kernel debugger (KD), COFF is the only game in town."

In other words, the COFF symbol table is used only for debugging, only for the more primitive debuggers, and is typically placed inside the .debug (or .rdata) section.

Licencié sous: CC-BY-SA avec attribution
Non affilié à StackOverflow
scroll top