Microsoft Symbol and Type Information

Microsoft Symbol and Type Information

ii

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

Table of Contents
1.
1.1.
1.2.
1.3.
1.4.
1.5.

Symbol and Type Information ............................................... 1

Logical Segments .......................................................................................1
Lexical Scope Linkage ...............................................................................1
Numeric Leaves .........................................................................................2
Types Indices .............................................................................................3
$$SYMBOLS and $$TYPES Definitions...................................................3
$$TYPES Definition .............................................................................................................3
$$SYMBOLS Definition ......................................................................................................4

2.

Symbols ................................................................................... 5

2.1. General.......................................................................................................5
Format of Symbol Records .................................................................................................5
Symbol Indices ......................................................................................................................6

2.2. Non-modal Symbols...................................................................................7

(0x0001) Compile Flag.........................................................................................................7
(0x0002) Register..................................................................................................................8
(0x0003) Constant.................................................................................................................9
(0x0004) User-defined Type................................................................................................9
(0x0005) Start Search ..........................................................................................................9
(0x0006) End of Block..........................................................................................................9
(0x0007) Skip Record.........................................................................................................10
(0x0008) Microsoft Debugger Internal ...........................................................................10
(0x0009) Object File Name................................................................................................10
(0x000a) End of Arguments ..............................................................................................10
(0x000b) COBOL User-defined Type..............................................................................11
(0x000c) Many Registers ...................................................................................................11
(0x000d) Function Return .................................................................................................11
(0x000e) this at Method Entry..........................................................................................12

2.3. Symbols for 16:16 Segmented Architectures ..........................................12

(0x0100) BP Relative 16:16...............................................................................................12
(0x0101) Local Data 16:16 ................................................................................................12
(0x0102) Global Data Symbol 16:16................................................................................13
(0x0103) Public Symbol 16:16 ..........................................................................................13
(0x0104) Local Start 16:16................................................................................................13
(0x0105) Global Procedure Start 16:16 ..........................................................................14
(0x0106) Thunk Start 16:16 ..............................................................................................14
(0x0107) Block Start 16:16................................................................................................15
(0x0108) With Start 16:16 .................................................................................................15
(0x0109) Code Label 16:16 ...............................................................................................15
(0x010a) Change Execution Model 16:16 .......................................................................16
(0x010b) Virtual Function Table Path 16:16..................................................................17
(0x010c) Register Relative 16:16......................................................................................17

2.4. Symbols for 16:32 Segmented Architectures ..........................................17

(0x0200) BP Relative 16:32...............................................................................................17
(0x0201) Local Data 16:32 ................................................................................................18
(0x0202) Global Data Symbol 16:32................................................................................18
(0x0203) Public 16:32.........................................................................................................18
(0x0204) Local Procedure Start 16:32 ............................................................................18
(0x0205) Global Procedure Start 16:32 ..........................................................................19
(0x0206) Thunk Start 16:32 ..............................................................................................19
(0x0207) Block Start 16:32................................................................................................20
(0x0208) With Start 16:32 .................................................................................................20
(0x0209) Code Label 16:32 ...............................................................................................20
(0x020a) Change Execution Model 16:32 .......................................................................20
(0x020b) Virtual Function Table Path 16:32..................................................................21
(0x020c) Register Relative 16:32......................................................................................22
(0x020d) Local Thread Storage 16:32.............................................................................22
(0x020e) Global Thread Storage 16:32 ...........................................................................22

2.5. Symbols for MIPS Architectures ............................................................23

(0x0300) Local Procedure Start MIPS............................................................................23
(0x0301) Global Procedure Start MIPS..........................................................................23

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

Microsoft Symbol and Type Information

2.6. Symbols for CVPACK Optimization ......................................................24

(0x0400) Procedure Reference .........................................................................................24
(0x0401) Data Reference ...................................................................................................24
(0x0402) Symbol Page Alignment ....................................................................................24

3.

Types Definition Segment ($$TYPES) ................................. 25

3.1. Type Record.............................................................................................25

3.2. Type String ..............................................................................................25
Member Attribute Field.....................................................................................................27

3.3. Leaf Indices Referenced from Symbols ..................................................28

(0x0001) Type Modifier .....................................................................................................28
(0x0002) Pointer..................................................................................................................28
(0x0003) Simple Array.......................................................................................................33
(0x0004) Classes..................................................................................................................33
(0x0005) Structures ............................................................................................................33
(0x0006) Unions ..................................................................................................................34
(0x0007) Enumeration .......................................................................................................34
(0x0008) Procedure ............................................................................................................34
(0x0009) Member Function...............................................................................................35
(0x000a) Virtual Function Table Shape ..........................................................................35
(0x000b) COBOL0 .............................................................................................................36
(0x000c) COBOL1..............................................................................................................36
(0x000d) Basic Array .........................................................................................................36
(0x000e) Label.....................................................................................................................36
(0x000f) Null........................................................................................................................37
(0x0010) Not Translated....................................................................................................37
(0x0011) Multiply Dimensioned Array............................................................................37
(0x0012) Path to Virtual Function Table ........................................................................37
(0x0013) Reference Precompiled Types ..........................................................................38
(0x0014) End of Precompiled Types ................................................................................38
(0x0015) OEM Generic Type............................................................................................38
(0x0016) Reserved ..............................................................................................................39

3.4. Type Records Referenced from Type Records.........................................40

(0x0200) Skip.......................................................................................................................40
(0x0201) Argument List.....................................................................................................40
(0x0202) Default Argument ..............................................................................................40
(0x0203) Arbitrary List .....................................................................................................40
(0x0204) Field List..............................................................................................................41
(0x0205) Derived Classes...................................................................................................41
(0x0206) Bit Fields..............................................................................................................41
(0x0207) Method List .........................................................................................................42
(0x0208) Dimensioned Array with Constant Upper Bound .........................................42
(0x0209) Dimensioned Array with Constant Lower and Upper Bounds ...................42
(0x020a) Dimensioned Array with Variable Upper Bound..........................................42
(0x020b) Dimensioned Array with Variable Lower and Upper Bounds....................43
(0x020c) Referenced Symbol.............................................................................................43

3.5. Subfields of Complex Lists........................................................................44

(0x0400) Real Base Class...................................................................................................44
(0x0401) Direct Virtual Base Class..................................................................................44
(0x0402) Indirect Virtual Base Class...............................................................................44
(0x0403) Enumeration Name and Value.........................................................................45
(0x0404) Friend Function ..................................................................................................45
(0x0405) Index To Another Type Record .......................................................................45
(0x0406) Data Member......................................................................................................46
(0x0407) Static Data Member...........................................................................................46
(0x0408) Method.................................................................................................................46
(0x0409) Nested Type Definition ......................................................................................46
(0x040a) Virtual Function Table Pointer........................................................................47
(0x040b) Friend Class ........................................................................................................47
(0x040c) One Method.........................................................................................................47
(0x040d) Virtual Function Offset .....................................................................................47

ii

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

4.

Numeric Leaves..................................................................... 48
(0x8000) Signed Char.........................................................................................................48
(0x8001) Signed Short........................................................................................................48
(0x8002) Unsigned Short ...................................................................................................48
(0x8003) Signed Long.........................................................................................................48
(0x8004) Unsigned Long....................................................................................................48
(0x8005) 32-bit Float ..........................................................................................................49
(0x8006) 64-bit Float ..........................................................................................................49
(0x8007) 80-bit Float ..........................................................................................................49
(0x8008) 128 Bit Float........................................................................................................49
(0x8009) Signed Quad Word.............................................................................................49
(0x800a) Unsigned Quad Word........................................................................................49
(0x800b) 48-bit Float..........................................................................................................50
(0x800c) 32-bit Complex....................................................................................................50
(0x800d) 64-bit Complex ...................................................................................................50
(0x800e) 80-bit Complex....................................................................................................50
(0x800f) 128-bit Complex ..................................................................................................50
(0x8010) Variable-length String.......................................................................................50

5.

Predefined Primitive Types .................................................. 51

5.1. Format of Reserved Types.......................................................................51

5.2. Primitive Type Listing.............................................................................53
Special Types.......................................................................................................................53
Character Types .................................................................................................................53
Real Character Types ........................................................................................................53
Wide Character Types.......................................................................................................54
Real 16-bit Integer Types ..................................................................................................54
16-bit Short Types ..............................................................................................................54
Real 32-bit Integer Types ..................................................................................................54
32-bit Long Types...............................................................................................................55
Real 64-bit int Types ..........................................................................................................55
64-bit Integral Types..........................................................................................................55
32-bit Real Types ................................................................................................................55
48-bit Real Types ................................................................................................................56
64-bit Real Types ................................................................................................................56
80-bit Real Types ................................................................................................................56
128-bit Real Types..............................................................................................................56
32-bit Complex Types ........................................................................................................56
64-bit Complex Types ........................................................................................................57
80-bit Complex Types ........................................................................................................57
128-bit Complex Types ......................................................................................................57
Boolean Types .....................................................................................................................57

6. Register Enumerations ............................................................ 58

6.1. Intel 80x86/80x87 Architectures..............................................................58
8-bit Registers .....................................................................................................................58
16-bit Registers ...................................................................................................................58
32-bit Registers ...................................................................................................................58
Segment Registers...............................................................................................................58
Special Cases .......................................................................................................................59
PCODE Registers ...............................................................................................................59
System Registers .................................................................................................................59
Register Extensions for 80x87 ..........................................................................................59

6.2. Motorola 68000 Architectures.................................................................60

6.3. MIPS Architectures ................................................................................61
Integer Register ..................................................................................................................61

7.
7.1.
7.2.
7.3.
7.4.

Symbol and Type Format for Microsoft Executables.......... 63

Introduction .............................................................................................63
Debug Information Format .....................................................................63
Subsection Directory................................................................................65
SubSection Types (sst...) ..........................................................................67
(0x0120) sstModule.............................................................................................................68
(0x0121) sstTypes ...............................................................................................................68
(0x0122) sstPublic...............................................................................................................68

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

iii

Microsoft Symbol and Type Information

(0x0123) sstPublicSym .......................................................................................................69

(0x0124) sstSymbols ...........................................................................................................69
(0x0125) sstAlignSym.........................................................................................................69
(0x0126) sstSrcLnSeg.........................................................................................................69
(0x0127) sstSrcModule.......................................................................................................70
(0x0128) sstLibraries .........................................................................................................71
(0x0129) sstGlobalSym ......................................................................................................72
(0x012a) sstGlobalPub .......................................................................................................72
(0x012b) sstGlobalTypes ...................................................................................................73
(0x012c) sstMPC.................................................................................................................74
(0x012d) sstSegMap ...........................................................................................................74
(0x012e) sstSegName..........................................................................................................75
(0x012f) sstPreComp..........................................................................................................75
(0x0131) Reserved ..............................................................................................................75
(0x0132) Reserved ..............................................................................................................76
(0x0133) sstFileIndex .........................................................................................................76
(0x0134) sstStaticSym ........................................................................................................76

7.5. Hash table and sort table descriptions .....................................................77

Name hash table (symhash == 10): ..................................................................................77
Address sort table (addrhash == 12): ..............................................................................78

iv

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

1.

Symbol and Type Information

This document describes the format and meaning of Microsoft symbol and type debugging
information. The information is contained within two tables emitted by the language processor
into the object file. Each table is treated as a stream of variable length records. The first table is
called $$SYMBOLS and describes the symbols in the object file. The record for each symbol
contains the symbol name, the symbol address and other information needed to describe the
symbol. The second table is called $$TYPES and contains information about symbol typing.
There are fields in the records contained in $$SYMBOLS that index into the records contained
in $$TYPES. Records in $$TYPES can also index into the records contained in the $$TYPES
table.
The records for $$SYMBOLS and $$TYPES are accumulated by the linker and are written into
the executable file. There is a third table of symbol information for each object file that is
generated by the linker and written into the executable file called the PUBLICS table. This table
contains symbol records for each public symbol definition encountered in the object file.
Field sizes and arrangement in $$SYMBOLS and $$TYPES are arranged to maintain "natural
alignment" to improve performance. Natural alignment indicates that a field begins on an
address that is divisible by the size of the field. For example, a four byte (long) value begins on
an address that is evenly divisible by four. Some architectures, such as the MIPS R4000, impose
a severe penalty for loading data that is not in natural alignment. Even for Intel386 and
Intel486 processors, there is a significant improvement when processing data that is in natural
alignment.
Compilers that emit Symbol and Type OMF (object module formats) according to this
specification indicate so by placing a signature of 0x00000001 at the beginning of the
$$SYMBOLS and $$TYPES tables.
In all structure descriptions and value enumerations, all values not specified in this document are
reserved for future use. All values should be referenced by the symbolic descriptions.
The CVPACK utility must be run on a linked executable file before the Microsoft debugger can
process the file. This utility removes duplicate symbol and type information and rewrites the
remaining information in a format optimized for processing by the debugger. CVPACK will
recognize old Symbol and Type OMF and rewrite it to this format during packing.

1.1. Logical Segments

When the linker emits address information about a symbol, it is done in segment:offset format.
The segment is a logical segment index assigned by the linker and the offset is the offset from
the beginning of the logical segment. The physical address is assigned by the operating system
when the program is loaded.
For PE-formatted executables, the segment field is interpreted as the PE section number.

1.2. Lexical Scope Linkage

The model of a program envisioned by this document is that programs have nested scopes. The
outermost scope is module scope which encompasses all of the symbols not defined within any
inner (lexical) scope. Symbols and types defined at one scoping level are visible to all scopes
nested within it. Symbols and types defined at module scope are visible to all inner scopes.

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

Microsoft Symbol and Type Information

The next level of scoping is "function" scope, which in turn contains lexical blocks (including
other functions scopes) that can be further nested. Nested lexical scopes are opened by a
procedure, method, thunk, with, or block start symbol. They are closed by the matching blockend symbol.
In general, symbol searching within a module's symbol table is performed in the following
manner. The lexical scope that contains the current program address is searched for the symbol.
If the symbol is not found within that scope, the enclosing lexical scope is searched. This search
is repeated outward until the symbol is found or the module scope is searched unsuccessfully.
Note that lexical scopes at the same depth level are not searched. As an optimization for the
debugger, symbols that open a lexical scope have fields that contain offsets from the beginning
of the symbols for the module, which point to the parent of the scope, the next lexical scope that
is at the same scoping level, and the S_END symbol that closes this lexical scope.
The pParent, pNext and pEnd fields described below are filled in by the CVPACK utility and
should be emitted as zeroes by the language processor.

Field

Linkage

pParent

Used in local procedures, global procedures, thunk start, with start, and
block start symbols. If the scope is not enclosed by another lexical scope,
then pParent is zero. Otherwise, the parent of this scope is the symbol
within this module that opens the outer scope that encloses this scope but
encloses no other scope that encloses this scope. The pParent field contains
the offset from the beginning of the module's symbol table of the symbol
that opens the enclosing lexical scope.
Used in start search local procedures, global procedures, and thunk start
symbols. The pNext field, along with the start search symbol, defines a
group of lexically scoped symbols within a symbol table that is contained
within a code segment or PE section. For each segment or section
represented in the symbol table, there is a start search symbol that contains
the offset from the start of the symbols for this module to the first procedure
or thunk contained in the segment. Each outermost lexical scope symbol
has a next field containing the next outermost scope symbol contained in the
segment. The last outermost scope in the symbol table for each segment has
a next field of zero.
This field is defined for local procedures, global procedures, thunk, block,
and with symbols. The end field contains the offset from the start of the
symbols for this module to the matching block end symbol that terminates
the lexical scope.

pNext

pEnd

1.3. Numeric Leaves

When the symbol or type processor knows that a numeric leaf is next in the symbol or type
record, the next two bytes of the symbol or type string are examined. If the value of these two
bytes is less than LF_NUMERIC (0x8000), then the two bytes contain the actual numeric value.
If the value is greater than or equal to LF_NUMERIC (0x8000), then the numeric data follows
the two-byte leaf index in the format specified by the numeric leaf index. It is the responsibility
of routines reading numeric fields to handle the potential non alignment of the data fields. See
Section 4 entitled Numeric Leaves for details.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

1.4. Types Indices

All Symbol and Type OMF records which reference records in the $$TYPES table must use
valid non-zero type indices. For public symbols a type index of 0x0000 (T_NOTYPE) is
permitted.
Since many types (relating to hardware and language primitives) are common, type index values
less than 0x1000 (CV_FIRST_NONPRIM) are reserved for a set of predefined primitive types.
A list of predefined types and their indices are defined in this document in Section 5. Type
indices of 0x1000 and higher are used to index into the set of non-primitive type definitions in
the module's $$TYPES segment. Thus 0x1000 is the first type, 0x1001 the second, and so on.
Non-primitive type indices must be sequential and cannot contain gaps in the numbering.

1.5. $$SYMBOLS and $$TYPES Definitions

$$TYPES Definition
OMF
Type information appears in OMF TYPDEF format as LEDATA records that contribute to the
special $$TYPES debug segment. A SEGDEF or SEGDEF32 record for this segment must be
produced in each module that contains Symbol and Type OMF type information and have the
attributes:
Name:
Combine type:
Class:

$$TYPES
private
DEBTYP

The first four bytes of the $$TYPES table is used as a signature to specify the version of the
Symbol and Type OMF contained in the $$TYPES segment. If the first two bytes of the
$$TYPES segment are not 0x0000, the signature is invalid and the version is assumed to be that
emitted for an earlier version of the Microsoft CodeView debugger (version 3.x and earlier). If
the signature is 0x00000001, the Symbol and Type OMF has been written to conform to the later
version of the Microsoft debugger (version 4.0) specification. All other values for the signature
are reserved. The CVPACK utility rewrites previous versions of the Symbol and Type OMF to
conform to this specification. The signatures of the $$TYPES and $$SYMBOLS tables must
agree.
COFF
Type information appears in a COFF (common object file format) as initialized data sections.
The attributes for the sections are:
NAME:
Attribute:

.debug$T
Read Only, Discardable, Initialized Data

As with OMF, the first four bytes in the types section must contain a valid signature and agree
with the signature in the symbol table.

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

Microsoft Symbol and Type Information

$$SYMBOLS Definition
OMF
Symbol information appears in OMF TYPDEF format as LEDATA records that contribute to the
special $$SYMBOLS debug segment. A SEGDEF or SEGDEF32 record for this segment must
be produced in each module that contains Symbol and Type OMF symbol information and have
these attributes:
Name:
Combine type:
Class:

$$SYMBOLS
private
DEBSYM

The first four bytes of the $$SYMBOLS segment is used as a signature to specify the version of
the Symbol and Type OMF contained in the $$SYMBOLS segment. If the first two bytes of the
$$SYMBOLS segment are not 0x0000, the signature is invalid and the version is assumed to be
that emitted for an earlier version of the Microsoft CodeView debugger, version 3.x and earlier.
If the signature is 0x00000001, the Symbol and Type OMF has been written to conform to the
version 4.0 specification of the Microsoft CodeView debugger. All other values for the
signature are reserved. The CVPACK utility rewrites previous versions of the Symbol and Type
OMF to conform to this specification. The signatures for the $$TYPES and $$SYMBOLS tables
must agree.
COFF
Symbol information appears in separate sections. The attributes of the section are:
Name:
Attributes:

.debug$S
Read Only, Discardable, Initialized Data

There may be multiple symbol sections in an object. The first symbol section to appear in the
object file must NOT be associated with a comdat section and must contain a valid signature. If
a comdat section is present in the object then the symbol information for that comdat should be
in a separate symbol section associated with the text comdat section. Symbol sections
associated with comdats must not contain a signature.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

2.

Symbols

2.1. General
Format of Symbol Records
Data in the $$SYMBOLS segment is a stream of variable length records with the general format:

2
length
length
index
data

2
index

*
data...

Length of record, excluding the length field.

Type of symbol.
Data specific to each symbol format.

The symbol records are described below. Numbers above the fields indicate the length in bytes,
and * means variable length for that field.
Symbol indices are broken into five ranges. The first range is for symbols whose format does
not change with the compilation model of the program or the target machine. These include
register symbols, user-defined type symbols, and so on. The second range of symbols are those
that contain 16:16 segmented addresses. The third symbol range is for symbols that contain
16:32 addresses. Note that for flat model programs, the segment is replaced with the section
number for PE format .exe files. The fourth symbol range is for symbols that are specific to the
MIPS architecture/compiler. The fifth range is for Microsoft CodeView optimization.
The symbol records are formatted such that most fields fall into natural alignment if the symbol
length field is placed on a long word boundary. For all symbols, the variable length data is at
the end of the symbol structure. Note specifically that fields that contain data in potentially
nonaligned numeric fields must either pay the load penalty or first do a byte wise copy of the
data to a memory that is in natural alignment. Refer to Section 4 for details about numeric
leaves.
16:16 compilers do not have to emit padding bytes between symbols to maintain natural
alignment. The CVPACK utility places the symbols into the executable files in natural
alignment and zero pads the symbol to force alignment. The length of each symbol is adjusted
to account for the pad bytes. 16:32 compilers must align symbols on a long word boundary.
Provisions for enabling future implementation of register tracking and a stack machine to
perform computation on symbol addresses are provided in the symbols. When the symbol
processor is examining a symbol, the length field of the symbol is compared with the offset of
the byte following the end of the symbol name field. If these are the same, there is no stack
machine code at the end of the symbol. If the length and offset are different, the byte following
the end of the symbol name is examined. If the byte is zero, there is no stack machine code
following the symbol. If the byte is not zero, then the byte indexes into the list of stack machine
implementations and styles of register tracking. If stack machine code is present, the address
field of the symbol becomes the initial value of the stack machine. Microsoft does not currently
emit or process stack machine code or register tracking information. The opcodes and operation
of the stack machine have not been defined.

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

Microsoft Symbol and Type Information

Symbol Indices
0x0001
0x0002
0x0003
0x0004
0x0005
0x0006
0x0007
0x0008

0x0009
0x000a
0x000b
0x000c
0x000d
0x000e

S_COMPILE
S_REGISTER
S_CONSTANT
S_UDT
S_SSEARCH
S_END
S_SKIP
S_CVRESERVE
debugger
S_OBJNAME
S_ENDARG
S_COBOLUDT
S_MANYREG
S_RETURN
S_ENTRYTHIS

Compile flags symbol

Register variable
Constant symbol
User-defined Type
Start search
End block, procedure, with, or thunk
Skip - Reserve symbol space
Reserved for internal use by the Microsoft
Specify name of object file
Specify end of arguments in function symbols
Microfocus COBOL user-defined type
Many register symbol
Function return description
Description of this pointer at entry

0x0100
0x0101
0x0102
0x0103
0x0104
0x0105
0x0106
0x0107
0x0108
0x0109
0x010a
0x010b
0x010c

S_BPREL16
S_LDATA16
S_GDATA16
S_PUB16
S_LPROC16
S_GPROC16
S_THUNK16
S_BLOCK16
S_WITH16
S_LABEL16
S_CEXMODEL16
S_VFTPATH16
S_REGREL16

BP relative 16:16
Local data 16:16
Global data 16:16
Public symbol 16:16
Local procedure start 16:16
Global procedure start 16:16
Thunk start 16:16
Block start 16:16
With start 16:16
Code label 16:16
Change execution model 16:16
Virtual function table path descriptor 16:16
Specify 16:16 offset relative to arbitrary register

0x0200
0x0201
0x0202
0x0203
0x0204
0x0205
0x0206
0x0207
0x020b
0x020c
0x020d
0x020e

S_BPREL32
S_LDATA32
S_GDATA32
S_PUB32
S_LPROC32
S_GPROC32
S_THUNK32
S_BLOCK32
S_VFTPATH32
S_REGREL32
S_LTHREAD32
S_GTHREAD32

BP relative 16:32
Local data 16:32
Global data 16:32
Public symbol 16:32
Local procedure start 16:32
Global procedure start 16:32
Thunk start 16:32
Block start 16:32
Virtual function table path descriptor 16:32
16:32 offset relative to arbitrary register
Local Thread Storage data
Global Thread Storage data

0x0300
0x0301

S_LPROCMIPS
S_GPROCMIPS

Local procedure start MIPS

Global procedure start MIPS

0x0400
0x0401
0x0402

S_PROCREF
S_DATAREF
S_ALIGN

Reference to a procedure
Reference to data
Page align symbols

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

2.2. Non-modal Symbols

(0x0001) Compile Flag
This symbol communicates with Microsoft debugger compile-time information, such as the
language and version number of the language processor, the ambient model for code and data,
and the target processor, on a per-module basis.

2
length

2
S_COMPILE

1
machine

3
flags

*
version

machine

Enumeration specifying target processor. Values not specified in the

following list are reserved:
0x00
Intel 8080
0x01
Intel 8086
0x02
Intel 80286
0x03
Intel 80386
0x04
Intel 80486
0x05
Intel Pentium
0x10
MIPS R4000
0x11
Reserved for future MIPS processor
0x12
Reserved for future MIPS processor
0x20
MC68000
0x21
MC68010
0x22
MC68020
0x23
MC68030
0x24
MC68040
0x30
DEC Alpha

flags

Flags showing compile-time options, as follows:

Language
:8
PCodePresent
:1
FloatPrecision
:2
FloatPackage
:2
AmbientData
:3
AmbientCode
:3
Mode32
:1 Compiled for 32-bit addresses
Reserved
:4
Language enumerations:
0
C
1
C++
2
Fortran
3
Masm
4
Pascal
5
Basic
6
COBOL
7 - 255
Reserved

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

Microsoft Symbol and Type Information

Ambient code and data memory model enumeration:

0
Near
1
Far
2
Huge
3-7
Reserved
Floating-package enumeration:
0
Hardware processor (80x87 for Intel 80x86 processors)
1
Emulator
2
Altmath
3
Reserved
The FloatPrecision flag is set to 1 if the compiler follows the ANSI C
floating-point precision rules. This is specified for Microsoft C
compilers by setting the -Op option.
version

Length-prefixed string specifying language processor version.

Language processors can place additional data in version string if
desired.

(0x0002) Register
This symbol record describes a symbol that has been placed in a register. Provisions for
enabling future implementation tracking of a symbol into and out of registers is provided in this
symbol. When the symbol processor is examining a register symbol, the length field of the
symbol is compared with the offset of the byte following the symbol name field. If these are the
same, there is no register tracking information. If the length and offset are different, the byte
following the end of the symbol name is examined. If the byte is zero, there is no register
tracking information following the symbol. If the byte is not zero, then the byte is the index into
the list of stack machine implementations and styles of register tracking. Microsoft does not
currently emit or process register-tracking information.

2
length

2
S_REGISTER

@type
register

name
tracking

2
@type

2
register

*
name

*
tracking

Type of symbol.
Enumeration of the registers in which the symbol value is stored.
This field is treated as two bytes. The high order byte specifies the
register in which the high order part of the value is stored. The low
byte specifies the register for the low order part of the value. If the
value is not stored in two registers then high order register field
contains the enumeration value for no register. For register
enumeration values, see Section 6. The register index enumeration is
specific to the processor model for the module.
Length-prefixed name of the symbol stored in the register.
Register-tracking information. Format unspecified.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x0003) Constant
This record is used to output constants and C enumerations. If used to output an enumeration,
then the type index refers to the containing enum.

2
length

2
S_CONSTANT
@type
value
name

2
@type

*
value

*
name

Type of symbol or containing enum.

Numeric leaf containing the value of symbol.
Length-prefixed name of symbol.

(0x0004) User-defined Type

This specifies a C typedef or user-defined type, such as classes, structures, unions, or enums.

2
length

2
S_UDT

@type
name

2
@type

*
name

Type of symbol.
Length-prefixed name of the user defined type.

(0x0005) Start Search

These records are always the first symbol records in a module's $$SYMBOL section. There is
one Start Search symbol for each segment (PE section) to which the module contributes code.
Each Start Search symbol contains the segment (PE section) number and $$SYMBOL offset of
the record of the outermost lexical scope in this module that physically appears first in the
specified segment of the load image. This referenced symbol is the symbol used to initiate
context searches within this module. The Start Search symbols are inserted into the
$$SYMBOLS table by the CVPACK utility and must not be emitted by the language processor.
2
length

2
S_SSEARCH
sym off

segment

4
sym off

2
segment

$$SYMBOL offset of the procedure or thunk record for this module

that has the lowest offset for the specified segment. See Section 1.2
on lexical scope linking.
Segment (PE section) to which this Start Search refers.

(0x0006) End of Block

Closes the scope of the nearest preceding Block Start, Global Procedure Start, Local Procedure
Start, With Start, or Thunk Start definition.

2
length

Tool Interface Standards (TIS)

2
S_END

Formats Specification for Windows

Version 1.0

Microsoft Symbol and Type Information

(0x0007) Skip Record

This record reserves symbol space for incremental compilers. The compiler can reserve a dead
space in the OMF for future expansions due to an incremental build. This symbol and the
associated reserved space is removed by the CVPACK utility.

2
length

2
S_SKIP

skip data

*
skip data

Unused data. Use the length field that precedes every symbol record
to skip this record.

(0x0008) Microsoft Debugger Internal

This symbol is used internally by the Microsoft debugger and never appears in the executable
file. Its format is unspecified.

(0x0009) Object File Name

This symbol specifies the name of the object file for this module.

2
length

2
S_OBJNAME

signature

name

4
signature

*
name

Signature for the Microsoft symbol and type information contained in

this module. If the object file contains precompiled types, then the
signature will be checked against the signature in the LF_PRECOMP
type record contained in the $$TYPES table for the user of the
precompiled types. The signature check is used to detect
recompilation of the supplier of the precompiled types without
recompilation of all of the users of the precompiled types. The
method for computing the signature is unspecified, but should be
sufficiently robust to detect failures to recompile.
Length-prefixed name of the object file without any path information
prepended to the name.

(0x000a) End of Arguments

This symbol specifies the end of symbol records used in formal arguments for a function. Use of
this symbol is optional for OMF and required for MIPS-compiled code. In OMF format, the end
of arguments can also be deduced from the fact that arguments for a function have a positive
offset from the frame pointer.

2
length

10

2
S_ENDARG

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x000b) COBOL User-defined Type

This record is used to define a user-defined type for the Microfocus COBOL compiler. This
record cannot be moved into the global symbol table by the CVPACK utility.

2
length
@type
name

2
S_COBOLUDT

2
@type

*
name

Type of symbol.
Length-prefixed name of the user-defined type.

(0x000c) Many Registers

This record is used to specify that a symbol is stored in a set of registers.

2
length
@type
count
reglist
name

2
S_MANYREG

2
@type

1
count

1 * count
reglist

*
name

Type index of the symbol.

Count of the register enumerations that follow.
List of registers in which the symbol is stored. The registers are listed
high order register first.
Name of the symbol.

(0x000d) Function Return

This symbol is used to describe how a function is called, how the return value, if any, is
returned, and how the stack is cleaned up.

2
length
flags

style

data

Tool Interface Standards (TIS)

2
S_RETURN

2
flags

1
style

*
data

Flags for function call:

cstyle
:1 push varargs right to left, if true
rsclean :1 returnee stack cleanup, if true
unused :14
Function return style:
0x00
void return
0x01
return value is in the registers specified in data
0x02
indirect caller-allocated near
0x03
indirect caller-allocated far
0x04
indirect returnee-allocated near
0x05
indirect returnee-allocated far
Data required by function return style.
If style is 0x01, then data is the following format.

Formats Specification for Windows

Version 1.0

11

Microsoft Symbol and Type Information

1
count

1 * count
reglist

count
reglist

Count of the number of registers.

Registers (high order first) containing the value.

(0x000e) this at Method Entry

This record is used to describe the this pointer at entry to a method. It is really a wrapper for
another symbol that describes the this pointer.

2
length

2
S_ENTRYTHIS

symbol

*
symbol

Full symbol, including length and symbol type fields, which describes
the this pointer.

2.3. Symbols for 16:16 Segmented Architectures

(0x0100) BP Relative 16:16
This symbol specifies symbols that are allocated on the stack for a procedure. For C and C++,
these include the actual function parameters and the local nonstatic variables of functions.

2
length

2
S_BPREL16

offset

@type
name

2
offset

2
@type

*
name

Signed offset relative to BP. If offset is 0, the symbol was assigned to

a register or never instantiated by the optimizer and cannot be
evaluated because its location is unknown.
Type of symbol.
Length-prefixed name of symbol.

(0x0101) Local Data 16:16

These symbols are used for data that is not exported from a module. In C and C++, symbols that
are declared static are emitted as Local Data symbols. Symbols that are emitted as Local Data
cannot be moved by the CVPACK utility into the global symbol table for the executable file.

2
length

2
S_LDATA16
offset
segment
@type
name

12

2
offset

2
segment

2
@type

*
name

Offset portion of symbol address.

Segment portion of symbol address.
Type index of symbol.
Length-prefixed name of symbol.
Formats Specification for Windows
Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x0102) Global Data Symbol 16:16

This symbol record has the same format as the Local Data 16:16 except that the record type is
S_GDATA16. For C and C++, symbols that are not specifically declared static are emitted as
Global Data Symbols and can be compacted by the CVPACK utility into the global symbol
table.

(0x0103) Public Symbol 16:16

This symbol has the same format as the Local Data 16:16 symbol. Its use is reserved for
symbols in the public table that is emitted by the linker into the Symbol and Type OMF portion
of the executable file. Current linkers (version 5.30 and later) emit the public symbols in the
S_PUB16 format. Previous linkers emitted the public symbols in the following obsolete format:

2
offset

2
segment
offset
segment
@type
name

2
@type

*
name

Offset portion of symbol address.

Segment portion of symbol address.
Type index of symbol (can be zero).
Length-prefixed name of symbol.

For public symbols emitted in the obsolete format, the CVPACK utility rewrites them to the
S_PUB16 format before compacting them into the global publics table. For more information
about the format of the Symbol and Type OMF as written by the linker and CVPACK utilities,
see Section 7 on executable file format.

(0x0104) Local Start 16:16

This symbol record defines local (file static) procedure definitions. For C and C++, functions
that are declared static to a module are emitted as Local Procedure symbols. Functions not
specifically declared static are emitted as Global Procedures (see below).

2
length

2
symbol

2
debug end

2
offset

symbol
pParent
pEnd
pNext
proc length
debug start

Tool Interface Standards (TIS)

4
pParent

4
pEnd

2
segment

4
pNext
2
@proctype

2
proc length
1
flags

2
debug start

->

*
name

S_LPROC16 or S_GPROC16.
See the section on lexical scope linking.
See the section on lexical scope linking.
See the section on lexical scope linking.
Length in bytes of this procedure.
Offset in bytes from the start of the procedure to the point where the
stack frame has been set up. Frame and register variables can be
viewed at this point.

Formats Specification for Windows

Version 1.0

13

Microsoft Symbol and Type Information

debug end

offset
segment
@proctype
flags

name

Offset in bytes from the start of the procedure to the point where the
procedure is ready to return and has calculated its return value, if any.
Frame and register variables can still be viewed.
Offset portion of the procedure address.
Segment portion of the procedure address.
Type index of the procedure type record.
Procedure flags:
fpo
:1 True if function has frame pointer omitted.
interrupt
:1 True if function is interrupt routine.
return
:1 True if function performs far return.
never
:1 True if function never returns.
unused
:4
Length-prefixed name of procedure.

(0x0105) Global Procedure Start 16:16

This symbol is used for procedures that are not specifically declared static to a module. The
format is the same as the Local Procedure Start 16:16 symbol (see above.)

(0x0106) Thunk Start 16:16

This symbol is used to specify any piece of code that exists outside of a procedure. The lexical
scope started by the Thunk Start symbol is closed by a matching End record.

2
length

2
S_THUNK16

2
length
pParent
pEnd
pNext
offset
segment
ordinal

length
name
variant

14

1
ordinal

4
pParent
*
name

4
pEnd

2
pNext

2
offset

2
segment

->

*
variant

See the section on lexical scope linking.

See the section on lexical scope linking.
See the section on lexical scope linking.
Offset portion of the thunk address.
Segment portion of the thunk address.
Ordinal specifying the type of thunk:
0 NOTYPE
1 ADJUSTOR
2 VCALL
3 PCODE
Length in bytes of this thunk.
Length-prefixed name of thunk.
Variant field, depending on the value of ordinal. If ordinal is
NOTYPE, there will be no variant field. If ordinal is ADJUSTOR, the
variant field will be a two-byte signed value specifying the delta to be
added to the this pointer, followed by the name of the target function.
If the ordinal is VCALL, then the variant field will be a 2-byte signed
displacement into the virtual table. Note that because of the variable
length name, the data in the variant field will not be in natural
alignment. If ordinal is PCODE, the variant is the segment:offset of the
pcode entry point.
Formats Specification for Windows
Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x0107) Block Start 16:16

This symbol specifies the start of an inner block of lexically scoped symbols. The lexical scope
is terminated by a matching S_END symbol.
2
length

2
S_BLOCK16
pParent
pEnd
length
offset
segment
name

4
pParent

4
pEnd

2
length

2
offset

2
segment

*
name

See the section on lexical scope linking.

See the section on lexical scope linking.
Length in bytes of the scope of this block.
Offset portion of the segmented procedure address.
Segment portion of the segmented procedure address.
Length-prefixed name of block.

(0x0108) With Start 16:16

This symbol describes the lexical scope of the Pascal with statement.

2
length

2
S_WITH16
pParent
pEnd
length
offset
segment
expr

4
pParent

4
pEnd

2
length

2
offset

2
segment

*
expr

See the section on lexical scope linking.

See the section on lexical scope linking.
Length in bytes of the scope of the with block.
Offset portion of the block start address.
Segment portion of the block start address.
Length-prefixed ASCII string of the expression used in the with
statement, which is evaluated at run time.

(0x0109) Code Label 16:16

2
length

2
S_LABEL16

offset
segment
flags

name

Tool Interface Standards (TIS)

2
offset

2
segment

1
flags

*
name

Offset portion of the code label address.

Segment portion of the code label address.
Label flags. This uses the same flag definition as in the S_LPROC16
symbol record, as follows:
fpo
:1 True if function has frame pointer omitted.
interrupt
:1 True if function is interrupt routine.
return
:1 True if function performs far return.
never
:1 True if function never returns.
unused
:4
Length-prefixed name of code label.

Formats Specification for Windows

Version 1.0

15

Microsoft Symbol and Type Information

(0x010a) Change Execution Model 16:16

This record is used to notify the debugger that, starting at the given code offset and until the
address specified by the next Change Execution Model record, the execution model is of the
specified type. The native execution model is assumed in the absence of Change Execution
Model records.

2
length

2
S_CEXMODEL16

offset
segment
model

variant

2
offset

2
segment

2
model

*
variant

Offset portion of start of the block.

Segment portion of the start of block.
The execution model.
0x00
Not executable code (e.g., a table)
0x01
Compiler generated jump table
0x02
Padding for data
0x03 - 0x1f Reserved for specific noncode types.
0x20
Native model (no processor specified)
0x21
Microfocus COBOL
0x22
Code padding for alignment
0x23
Code
0x24 - 0x3F Reserved
0x40
Pcode
Variable data dependent upon the execution model field. If the
variant record contains segment or offset information, then the
CVPACK utility and the Microsoft debugger must be modified to
process the segment information.

The variant field for 0x40 (C7 Pcode) data has the following format:
2
Fcn Header

2
SPI

Fcn Header
Offset of the Pcode procedure's Function Header.
SPI
Offset of the Pcode segment's Segment Pcode Information.
Both addresses are in the specified code segment.
The variant field for 0x21 (Microfocus COBOL) has the following format:
2
subtype
subtype

2
flag
COBOL execution model subtype.
0
Do not stop execution until next model record
1
pfm
2
False call - continue tracing
3
External call

The other models do not have variant fields.

16

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x010b) Virtual Function Table Path 16:16

This record is used to describe the base class path for the virtual function table descriptor.

2
length

2
S_VFTPATH16

offset
segment
@root
@path

2
offset

2
segment

2
@root

2
@path

Offset portion of start of the virtual function table.

Segment portion of the virtual function table.
The type index of the class at the root of the path.
Type index of the record describing the base class path from the root
to the leaf class for the virtual function table.

(0x010c) Register Relative 16:16

This symbol specifies symbols that are allocated relative to a register.

2
length

2
S_REGREL16
offset
register
@type
name

2
offset

2
register

2
@type

*
name

Signed offset relative to register.

Register enumeration for symbol base. Note that the register field can
specify a register pair, such as ES:BX.
Type of symbol.
Length-prefixed name of symbol.

2.4. Symbols for 16:32 Segmented Architectures

(0x0200) BP Relative 16:32
This symbol specifies symbols that are allocated on the stack for a procedure. For C and C++,
these include the actual function parameters and the local non-static variables of functions.

2
length
offset

@type
name

Tool Interface Standards (TIS)

2
S_BPREL32

4
offset

2
@type

*
name

Signed offset relative to BP. If offset is 0, then the symbol was

assigned to a register or never instantiated by the optimizer and
cannot be evaluated because its location is unknown.
Type of symbol.
Length-prefixed name of symbol.

Formats Specification for Windows

Version 1.0

17

Microsoft Symbol and Type Information

(0x0201) Local Data 16:32

These symbols are used for data that is not exported from a module. In C and C++, symbols that
are declared static are emitted as Local Data symbols. Symbols that are emitted as Local Data
cannot be moved by the CVPACK utility into the global symbol table for the executable file.

2
length

2
S_LDATA32
offset
segment
@type
name

4
offset

2
segment

2
@type

*
name

Offset portion of symbol address.

Segment portion of symbol address.
Type index of symbol.
Length-prefixed name of symbol.

(0x0202) Global Data Symbol 16:32

This symbol record has the same format as the Local Data 16:32 except that the record type is
S_GDATA32. For C and C++, symbols that are not specifically declared static are emitted as
Global Data Symbols and can be compacted by the CVPACK utility into the global symbol
table.

(0x0203) Public 16:32

This symbol has the same format as the Local Data 16:32 symbol. Its use is reserved to symbols
in the publics table emitted by the linker into the Symbol and Type OMF portion of the
executable file.

(0x0204) Local Procedure Start 16:32

This symbol record defines local (file static) procedure definition. For C and C++, functions
that are declared static to a module are emitted as Local Procedure symbols. Functions not
specifically declared static are emitted as Global Procedures (see below.)

2
length

2
symbol

4
debug end

4
offset

symbol
pParent
pEnd
pNext
proc length
debug start

18

4
pParent
2
segment

4
pEnd

4
pNext

4
proc length

2
@proctype

1
flags

4
debug start

->

*
name

S_LPROC32 or S_GPROC32.
See the section on lexical scope linking.
See the section on lexical scope linking.
See the section on lexical scope linking.
Length in bytes of this procedure.
Offset in bytes from the start of the procedure to the point where the
stack frame has been set up. Parameter and frame variables can be
viewed at this point.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

debug end

offset
segment
@proctype
flags

name

Offset in bytes from the start of the procedure to the point where the
procedure is ready to return and has calculated its return value, if any.
Frame and register variables can still be viewed.
Offset portion of the procedure address.
Segment portion of the procedure address.
Type of the procedure type record.
Procedure flags:
fpo
:1 True if function has frame pointer omitted.
interrupt
:1 True if function is interrupt routine.
return
:1 True if function performs far return.
never
:1 True if function never returns.
unused
:4
Length-prefixed name of procedure.

(0x0205) Global Procedure Start 16:32

This symbol is used for procedures that are not specifically declared static to a module. The
format is the same as the Local Procedure Start 16:32 symbol (see above.)

(0x0206) Thunk Start 16:32

This record is used to specify any piece of code that exists outside a procedure. It is followed by
an End record. The thunk record is intended for small code fragments and a two byte length
field is sufficient for its intended purpose.

2
length

2
S_THUNK32

2
thunk length

1
ordinal

pParent
pEnd
pNext
offset
segment
thunk length
ordinal

name
variant

Tool Interface Standards (TIS)

4
pParent

4
pEnd

*
name

4
pNext

4
offset

2
segment

->

*
variant

See the section on lexical scope linking.

See the section on lexical scope linking.
See the section on lexical scope linking.
Offset portion of the thunk address.
Segment portion of the thunk address.
Length in bytes of this thunk.
Ordinal specifying the type of thunk, as follows:
0 NOTYPE
1 ADJUSTOR
2 VCALL
3 PCODE
Length-prefixed name of thunk.
Variant field, depending on value of ordinal. If ordinal is NOTYPE,
there is no variant field. If ordinal is ADJUSTOR, the variant field is a
two-byte signed value specifying the delta to be added to the this
pointer, followed by the length-prefixed name of the target function.
If ordinal is VCALL, then the variant field is a two-byte signed
displacement into the virtual table. If ordinal is PCODE, the variant is
the segment:offset of the pcode entry point.

Formats Specification for Windows

Version 1.0

19

Microsoft Symbol and Type Information

(0x0207) Block Start 16:32

This symbol specifies the start of an inner block of lexically scoped symbols. The lexical scope
is terminated by a matching S_END symbol.
2
length

2
S_BLOCK32
pParent
pEnd
length
offset
segment
name

4
pParent

4
pEnd

4
length

4
offset

2
segment

*
name

See the section on lexical scope linking.

See the section on lexical scope linking.
Length in bytes of the scope of this block.
Offset portion of the segmented procedure address.
Segment portion of the segmented procedure address.
Length-prefixed name of the block.

(0x0208) With Start 16:32

2
length

2
S_WITH32
pParent
pEnd
length
offset
segment
expr

4
pParent

4
pEnd

4
length

4
offset

2
segment

*
expr

See the section on lexical scope linking.

See the section on lexical scope linking.
Length in bytes of the scope of the with block.
Offset portion of the segmented address of the start of the block.
Segment portion of the segmented address of the start of the block.
Length-prefixed ASCII string, evaluated at run time, of the expression
used in the with statement.

(0x0209) Code Label 16:32

2
length

2
S_LABEL32

offset
segment
flags

name

20

4
offset

2
segment

1
flags

*
name

Offset portion of the segmented address of the start of the block.

Segment portion of the segmented address of the start of the block.
Label flags. This uses the same flag definition as in the S_LPROC16
symbol record, as follows:
fpo
:1 True if function has frame pointer omitted.
interrupt
:1 True if function is interrupt routine.
return
:1 True if function performs far return.
never
:1 True if function never returns.
unused
:4
Length-prefixed name of label.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x020a) Change Execution Model 16:32

This record is used to notify the debugger that, starting at the given code offset and until the
address specified by the next Change Execution Model record, the execution model is of the
specified type. The native execution model is assumed in the absence of Change Execution
Model records.

2
length

2
S_CEXMODEL32

offset
segment
model

variant

4
offset

2
segment

2
model

*
variant

Offset portion of start of block.

Segment portion of the start of block.
Execution model, as follows:
0x00
Not executable code (e.g., a table)
0x01
Compiler generated jump table
0x02
Padding for data
0x03 - 0x1f Reserved for specific noncode types.
0x20
Native model (no processor specified)
0x21
Microfocus COBOL (unused in 16:32)
0x22
Code padding for alignment
0x23
Code
0x24 - 0x3f Reserved
0x40
Pcode (Reserved)
Variable data dependent upon the execution model field. If the
variant record contains segment or offset information, then the
CVPACK utility and the Microsoft debugger must be modified to
process the segment information.

The other models do not have variant fields.

(0x020b) Virtual Function Table Path 16:32

This record is used to describe the base class path for the virtual function table descriptor.

2
length

2
S_VFTPATH32
offset
segment
@root
@path

Tool Interface Standards (TIS)

4
offset

2
segment

2
@root

2
@path

Offset portion of start of the virtual function table.

Segment portion of the virtual function table.
The type index of the class at the root of the path.
Type index of the record describing the base class path from the root
to the leaf class for the virtual function table.

Formats Specification for Windows

Version 1.0

21

Microsoft Symbol and Type Information

(0x020c) Register Relative 16:32

This symbol specifies symbols that are allocated relative to a register.

2
length

2
S_REGREL32

offset
register
@type
name

4
offset

2
register

2
@type

*
name

Signed offset relative to register.

Register enumerations on which the symbol is based. Note that the
register field can specify a pair of registers, such as ES:EBX.
Type of symbol.
Length-prefixed name of symbol.

(0x020d) Local Thread Storage 16:32

These symbols are used for data declared with the thread storage attribute that is not exported
from a module. In C and C++, thread symbols that are declared static are emitted as Local
Thread Storage 16:32 symbols. Symbols that are emitted as Local Thread Storage 16:32 cannot
be moved by the CVPACK utility into the global symbol table for the executable file.

2
length

2
S_LTHREAD32

offset
segment
@type
name

4
offset

2
segment

2
@type

*
name

Offset into thread local storage.

Segment of thread local storage.
Type index.
Length-prefixed name.

(0x020e) Global Thread Storage 16:32

This symbol record has the same format as the Local Thread Storage 16:32 except that the
symbol type is S_GTHREAD32. For C and C++, thread symbols that are not specifically
declared static are emitted as Global Thread Storage 16:32 symbols and can be compacted by
the CVPACK utility into the global symbol table.

22

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

2.5. Symbols for MIPS Architectures

(0x0300) Local Procedure Start MIPS
The symbol records define local (file static) procedures. For C and C++, functions that are
declared static to a module are emitted as Local Procedure symbols.

2
length

2
symbol

4
debug
end
4
offset

4
pParent

4
int save
mask
2
seg

4
pEnd

4
fp save mask

2
@proctype

symbol
pParent
pEnd
pNext
length
debug start

debug end

int save mask

fp save mask
int save offset
fp save offset
offset
segment
@proctype
retreg

framepointer
name

4
pNext

1
retreg

4
length

4
int save offset

4
debug start

->

4
fp save offset

->

1
frame pointer reg

*
name

S_LPROCMIPS or S_GPROCMIPS.
See the section on lexical scope linking.
See the section on lexical scope linking.
See the section on lexical scope linking.
Length in bytes of this procedure.
Offset in bytes from the start of the procedure to the point where the
stack frame has been set up. Parameter and frame variables can be
viewed at this point.
Offset in bytes from the start of the procedure to the point where the
procedure is ready to return and has calculated its return value, if any.
Frame and register variables can still be viewed. If the procedure has
multiple exits, this field is zero.
Integer register save mask.
Floating-point register save mask.
Offset from sp to the integer register save area.
Offset from sp to the floating point register save area.
Offset portion of the address of the start of the procedure.
Segment portion of the address of the start of the procedure.
Type index of the procedure type record.
Index of the register that contains the return address. If this register is
31 and the integer register save mask indicates that the register has
been saved, then the return address is in the integer register save area.
Frame pointer register if not zero.
Length-prefixed name of procedure.

(0x0301) Global Procedure Start MIPS

This symbol is used for procedures that are not specifically declared static to a module. The
format is the same as the Local Procedure Start 16:32 symbol (see above.)

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

23

Microsoft Symbol and Type Information

2.6. Symbols for CVPACK Optimization

(0x0400) Procedure Reference
This symbol is inserted into the global and static symbol tables to reference a procedure. It is
used so that the symbol procedure can be found in the hashed search of the global or static
symbol table. Otherwise, procedures could be found only by searching the symbol table for
every module.

2
length

2
S_PROCREF
checksum

offset
module

4
checksum

4
offset

2
module

Checksum of the referenced symbol name. The checksum used is the

one specified in the header of the sstGlobalSym or sstStaticSym
subsections. See Section 7.4 for more details on the subsection
headers.
Offset of the procedure symbol record from the beginning of the
$$SYMBOL table for the module.
Index of the module that contains this procedure record.

(0x0401) Data Reference

This symbol is inserted into the global and static symbol tables to reference data. It is used so
that the symbol procedure can be found in the hashed search of the global or static symbol table.
Otherwise, data symbols could be found only by searching the symbol table for every module.

2
length

2
S_DATAREF
checksum
offset
module

4
checksum

4
offset

2
module

Checksum of the referenced symbol name.

Offset of the procedure symbol record from the beginning of the
$$SYMBOL table for the module.
Index of the module that contains this procedure record.

(0x0402) Symbol Page Alignment

This symbol is inserted by the CVPACK utility to pad symbol space so that the next symbol will
not cross a page boundary.

2
length

2
S_ALIGN
pad

24

*
pad
Unused data. Use the length field that precedes every symbol record
to skip this record. The pad bytes must be zero. For sstGlobalSym
and sstGlobalPub, the length of the pad field must be at least the
sizeof (long). There must be an S_Align symbol at the end of these
tables with a pad field containing 0xffffffff. The sstStaticSym table
does not have this requirement.
Formats Specification for Windows
Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

3.

Types Definition Segment ($$TYPES)

A $$TYPES segment may appear in linkable modules. It provides descriptions of the types of
symbols found in the $$PUBLICS and $$SYMBOLS debug section for the module.

3.1. Type Record

A type record has the following format:

2
length

*
type string

length

Length in bytes of the following type string. This count does not
include the length field.

3.2. Type String

A type string is a series of consecutive leaf structures and has the following format:

2
leaf

*
data
leaf
data

2
leaf

*
data

...

2
leaf

*
data

LF_... index, as described below.

Data specified to each leaf type.

No LF_... index can have a value of 0x0000. The leaf indices are separated into four ranges
according to the use of the type record. The first range is for the type records that are directly
referenced in symbols. The second range is for type records that are not referenced by symbols,
but instead are referenced by other type records. All type records must have a starting leaf index
in these first two ranges.
The third range of leaf indices is used to build complex lists, such as the field list of a class type
record. No type record can begin with one of the leaf indices in this range.
The fourth ranges of type indices are used to represent numeric data in a symbol or type records.
These leaf indices are greater than 0x8000. At the point that the type or symbol processor is
expecting a numeric field, the next two bytes in the type record are examined. If the value is
less than 0x8000, then the two bytes contain the numeric value. If the value is greater than
0x8000, then the data follows the leaf index in a format specified by the leaf index. See Section
4 for a detailed description of numeric leaf indices.
Because of the method used to maintain natural alignment in complex lists, no leaf index can
have a value greater than or equal to 0xf000. Also, no leaf index can have a value such that the
least significant 8 bits of the value is greater than or equal to 0xf0.

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

25

Microsoft Symbol and Type Information

Leaf indices for type records that can be referenced from symbols are the following:
0x0001
0x0002
0x0003
0x0004
0x0005
0x0006
0x0007
0x0008
0x0009
0x000a
0x000b
0x000c
0x000d
0x000e
0x000f
0x0010
0x0011
0x0012
0x0013
0x0014
0x0015
0x0016

LF_MODIFIER
LF_POINTER
LF_ARRAY
LF_CLASS
LF_STRUCTURE
LF_UNION
LF_ENUM
LF_PROCEDURE
LF_MFUNCTION
LF_VTSHAPE
LF_COBOL0
LF_COBOL1
LF_BARRAY
LF_LABEL
LF_NULL
LF_NOTTRAN
LF_DIMARRAY
LF_VFTPATH
LF_PRECOMP
LF_ENDPRECOMP
LF_OEM
Reserved

Leaf indices for type records that can be referenced from other type records are the following:
0x0200
0x0201
0x0202
0x0203
0x0204
0x0205
0x0206
0x0207
0x0208
0x0209
0x020a
0x020b
0x020c

LF_SKIP
LF_ARGLIST
LF_DEFARG
LF_LIST
LF_FIELDLIST
LF_DERIVED
LF_BITFIELD
LF_METHODLIST
LF_DIMCONU
LF_DIMCONLU
LF_DIMVARU
LF_DIMVARLU
LF_REFSYM

Leaf indices for fields of complex lists are the following:

0x0400
0x0401
0x0402
0x0403
0x0404
0x0405
0x0406
0x0407
0x0408
0x0409
0x040a
0x040b
0x040c
26

LF_BCLASS
LF_VBCLASS
LF_IVBCLASS
LF_ENUMERATE
LF_FRIENDFCN
LF_INDEX
LF_MEMBER
LF_STMEMBER
LF_METHOD
LF_NESTTYPE
LF_VFUNCTAB
LF_FRIENDCLS
LF_ONEMETHOD
Formats Specification for Windows
Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

0x040d

LF_VFUNCOFF

Leaf indices for numeric fields of symbols and type records are the following:
0x8000
0x8000
0x8001
0x8002
0x8003
0x8004
0x8005
0x8006
0x8007
0x8008
0x8009
0x800a
0x800b
0x800c
0x800d
0x800e
0x800f
0x8010

LF_NUMERIC
LF_CHAR
LF_SHORT
LF_USHORT
LF_LONG
LF_ULONG
LF_REAL32
LF_REAL64
LF_REAL80
LF_REAL128
LF_QUADWORD
LF_UQUADWORD
LF_REAL48
LF_COMPLEX32
LF_COMPLEX64
LF_COMPLEX80
LF_COMPLEX128
LF_VARSTRING

0xf0
0xf1
0xf2
0xf3
0xf4
0xf5
0xf6
0xf7
0xf8
0xf9
0xfa
0xfb
0xfc
0xfc
0xfe
0xff

LF_PAD0
LF_PAD1
LF_PAD2
LF_PAD3
LF_PAD4
LF_PAD5
LF_PAD6
LF_PAD7
LF_PAD8
LF_PAD9
LF_PAD10
LF_PAD11
LF_PAD12
LF_PAD13
LF_PAD14
LF_PAD15

Member Attribute Field

Several of the type records below reference a field attribute bit field. This bit field has the
following format:
access

:2
0
1
2
3

mprop

:3 Specifies the properties for methods

0 Vanilla method
1 Virtual method

Tool Interface Standards (TIS)

Specifies the access protection of the item

No access protection
Private
Protected
Public

Formats Specification for Windows

Version 1.0

27

Microsoft Symbol and Type Information

2
3
4
5
6
7
pseudo
noinherit
noconstruct
reserved

Static method
Friend method
Introducing virtual method
Pure virtual method
Pure introducing virtual method
Reserved

:1 True if the method is never instantiated by the compiler

:1 True if the class cannot be inherited
:1 True if the class cannot be constructed
:8

3.3. Leaf Indices Referenced from Symbols

(0x0001) Type Modifier
This record is used to indicate the const, volatile and unaligned properties for any particular
type.

2
LF_MODIFIER
attribute

@index

2
attribute

2
@index

const
:1 const attribute
volatile
:1 volatile attribute
unaligned
:1 unaligned attribute
reserved
:13
type index of the modified type.

(0x0002) Pointer
This record is the generic pointer type record. It supports the C++ reference type, pointer to data
member, and pointer to method. It also conveys const and volatile pointer information.

2
LF_POINTER

2
attribute

attribute
ptrtype

28

:5
0
1
2
3
4
5
6
7
8
9

2
@type

*
variant

Consists of five bit fields:

Ordinal specifying mode of pointer
Near
Far
Huge
Based on segment
Based on value
Based on segment of value
Based on address of symbol
Based on segment of symbol address
Based on type
Based on self

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

ptrmode

isflat32
volatile
const
unaligned
unused

10
11
12-31
:3
0
1
2
3
4-7
:1
:1
:1
:1
:4

@type
variant

Near 32-bit pointer

Far 32-bit pointer
Reserved
Ordinal specifying pointer mode
Pointer
Reference
Pointer to data member
Pointer to method
Reserved
True if 16:32 pointer
True if pointer is volatile
True if pointer is const
True if pointer is unaligned
Unused and reserved
Type index of object pointed to
variant portion of the record, depending
upon the pointer type
based on segment - Segment value
based on type- Index of type followed by
length-prefixed name
based on self - Nothing
based on symbol - Copy of symbol
record including length field
pointer to data member - Union
specifying pointer to data member
pointer to method - Union specifying
pointer to method

The union specifying the pointer to data member has the following format:

2
@class
class
format

Tool Interface Standards (TIS)

2
format
Type index of containing class.
0 16:16 data for class with no virtual functions or virtual bases
1 16:16 data for class with virtual functions
2 16:16 data for class with virtual bases
3 16:32 data for classes with or without virtual functions and no
virtual bases
4 16:32 data for class with virtual bases
5 16:16 near method non-virtual bases with single address point
6 16:16 near method non-virtual bases with multiple address points
7 16:16 near method with virtual bases
8 16:16 far method non-virtual bases with single address point
9 16:16 far method non-virtual bases with multiple address points
10 16:16 far method with virtual bases
11 16:32 method non-virtual bases with single address point
12 16:32 method non-virtual bases with multiple address points
13 16:32 method with virtual bases

Formats Specification for Windows

Version 1.0

29

Microsoft Symbol and Type Information

The pointer to data member and pointer to method have the following formats in memory. In
the following descriptions of the format and value of the NULL pointer, * means any value.

(00) 16:16 pointer to data member for a class with no virtual functions or bases.

2
mdisp
mdisp

Displacement to data. NULL is 0xffff.

(01) 16:16 pointer to data member for a class with virtual functions.

2
mdisp
mdisp

(02) 16:16 pointer to data member for a class with virtual bases.

2
mdisp
mdisp
pdisp
vdisp

Displacement to data. NULL is 0.

2
pdisp

2
vdisp

Displacement to data.
this pointer displacement to virtual base table pointer.
Displacement within virtual base table. NULL value is (,,0xffff).

(03) 16:32 near pointer to data member for a class with and without virtual functions and no
virtual bases.

4
mdisp
mdisp

(04) 16:32 near pointer to data member for a class with virtual bases.

4
mdisp
mdisp
pdisp
vdisp

30

Displacement to data. NULL is 0x80000000.

4
pdisp

4
vdisp

Displacement to data.
this pointer displacement to virtual base table pointer.
Displacement within virtual base table. NULL value is (,,0xffffffff).

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(05) 16:16 pointer to near member function for a class with no virtual functions or bases and a
single address point.

2
off
off

Near address of method. NULL is 0.

(06) 16:32 pointer to near member function for a class with no virtual bases with multiple
address points.
2
off

2
disp
off
disp

Offset of function.
Displacement of address point. NULL is (0,*).

(07) 16:16 pointer to near member function for a class with virtual bases.

2
off

2
mdisp
off
mdisp
pdisp
vdisp

2
vdisp

Offset of function.
Displacement to data.
this pointer displacement to virtual base table pointer.
Displacement within virtual base table. NULL value is (0,*,*,*).

(08) 16:16 pointer to far member function for a class with no virtual bases and a single address
point.
2
off

2
seg
off
disp

2
pdisp

Offset of function.
Displacement of address point. NULL is (0:0).

(09) 16:16 pointer to far member function for a class with no virtual bases and multiple address
points.
2
off

2
seg
off
seg
disp

Tool Interface Standards (TIS)

2
disp
Offset of function.
Segment of function.
Displacement of address point. NULL is (0:0,*).

Formats Specification for Windows

Version 1.0

31

Microsoft Symbol and Type Information

(10) 16:16 pointer to far member function for a class with virtual bases.

2
off

2
seg
off
seg
mdisp
pdisp
vdisp

2
mdisp

2
pdisp

2
vdisp

Offset of function.
Segment of function.
Displacement to data.
this pointer displacement to virtual base table pointer.
Displacement within virtual base table. NULL value is (0,*,*,*).

(11) 16:32 pointer to member function for a class with no virtual bases and a single address
point.

4
off
off

(12) 16:32 pointer to member function for a class with no virtual bases and multiple address
points.

4
off

4
disp
off
disp

Offset of function.
Displacement of address point. NULL is (0L:0L).

(13) 16:32 pointer to member function for a class with virtual bases.

4
off

4
mdisp
off
mdisp
pdisp
vdisp

32

Offset of function. NULL is 0L.

4
pdisp

4
vdisp

Offset of function.
Displacement to data.
this pointer displacement to virtual base table pointer.
Displacement within virtual base table. NULL value is (0L,*,*,*).

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x0003) Simple Array

The format for a simple array is as follows:

2
LF_ARRAY

2
@elemtype

@elemtype
@idxtype
length
name

2
@idxtype

*
length

*
name

Type index of each array element.

Type index of indexing variable.
Length of array in bytes.
Length-prefixed name of array.

(0x0004) Classes
The format for classes is as follows:

2
leaf

2
count
leaf
count

@field
property

@dList

@vshape
length
name

2
@field

2
property

2
@dList

2
@vshape

*
length

*
name

LF_CLASS or LF_STRUCTURE.
Number of elements in the class or structure. This count includes
direct, virtual, and indirect virtual bases, and methods including
overloads, data members, static data members, friends, and so on.
Type index of the field list for this class.
Property bit field
packed
:1 Structure is packed
ctor
:1 Class has constructors and/or destructors
overops
:1 Class has overloaded operators
isnested
:1 Class is a nested class
cnested
:1 Class contains nested classes
opassign
:1 Class has overloaded assignment
opcast
:1 Class has casting methods
fwdref
:1 Class/structure is a forward (incomplete) reference
scoped
:1 This is a scoped definition
reserved
:8
Type index of the derivation list. This is output by the compiler as
0x0000 and is filled in by the CVPACK utility to a LF_DERIVED
record containing the type indices of those classes which immediately
inherit the current class. A zero index indicates that no derivation
information is available. An LF_NULL index indicates that the class
is not inherited by other classes.
Type index of the virtual function table shape descriptor.
Numeric leaf specifying size in bytes of the structure.
Length-prefixed name this type.

(0x0005) Structures
Structures have the same format as classes. Structure type records are used exclusively by the C
compiler. The C++ compiler emits both class and structure records depending upon the
declaration.
Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

33

Microsoft Symbol and Type Information

(0x0006) Unions
The format for unions is as follows:

2
LF_UNION

2
count

count
@field
property
length
name

2
@field

2
property

*
length

*
name

Number of fields in the union.

Type index of field list.
Property bit field.
Numeric leaf specifying size in bytes of the union.
Length-prefixed name of union.

(0x0007) Enumeration
The format for an enum is as follows:

2
LF_ENUM

2
count

count
@type
@field
property
name

2
@type

2
@fList

2
property

*
name

Number of enumerations.
Underlying type of enum.
Type index of field list.
Property bit field.
Length-prefixed name of enum.

(0x0008) Procedure
The format for a procedure is as follows:

2
LF_PROCEDURE
@rvtype
call

34

2
@rvtype

1
call

1
reserved

2
#parms

2
@arglist

Type index of the value returned by the procedure.

Calling convention of the procedure, as follows:
0
Near C (arguments pushed right to left, caller pops
arguments)
1
Far C.
2
Near Pascal (arguments pushed left to right, callee pops
arguments)
3
Far Pascal
4
Near fastcall
5
Far fastcall
6
Reserved
7
Near stdcall
8
Far stdcall
9
Near syscall
10
Far syscall
11
This call
Formats Specification for Windows
Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

#parms
@arglist

12
MIPS call
13
Generic
14-255 Reserved
Number of parameters.
Type index of argument list type record.

(0x0009) Member Function

The format for a member function is as follows:

2
LF_MFUNCTION
2
#parms

2
@arglist

@rvtype
@class
@this

call
res
#parms
arglist
thisadjust

2
@rvtype

2
@class

2
@this

1
call

1
res

->

4
thisadjust
Type index of the value returned by the procedure.
Type index of the containing class of the function.
Type index of the this parameter of the member function. A type of
void indicates that the member function is static and has no this
parameter.
Calling convention of the procedure. See Procedure description.
Reserved. Must be emitted as zero.
Number of parameters. This count does not include the this
parameter.
List of parameter specifiers. This list does not include the this
parameter.
Logical this adjuster for the method. Whenever a class element is
referenced via the this pointer, thisadjust will be added to the
resultant offset before referencing the element.

(0x000a) Virtual Function Table Shape

This record describes the format of a virtual function table. This record is accessed via the
vfunctabptr in the member list of the class which introduces the virtual function. The
vfunctabptr is defined either by the LF_VFUNCTAB or LF_VFUNCOFF member record. If
LF_VFUNCTAB record is used, then vfunctabptr is at the address point of the class. If
LF_VFUNCOFF record is used, then vfunctabptr is at the specified offset from the class address
point. The underlying type of the pointer is a VTShape type record. This record describes how
to interpret the memory at the location pointed to by the virtual function table pointer.

2
LF_VTSHAPE

2
count

4 bits
descriptor
repeated

count

Tool Interface Standards (TIS)

Number of descriptors.

Formats Specification for Windows

Version 1.0

35

Microsoft Symbol and Type Information

descriptor

A four-bit ordinal describing the entry in the virtual table

0
Near
1
Far
2
Thin
3
Address point displacement to outermost class. This is at
entry[-1] from table address
4
Far pointer to metaclass descriptor. This is at entry[-2] from
table address
5
Near32
6
Far32
7 - 15 Reserved

(0x000b) COBOL0
This record has been reserved for the Microfocus COBOL compiler.

2
LF_COBOL0

2
@parent

@parent
data

*
data

Type index of the parent type.

Data.

(0x000c) COBOL1
This record has been reserved for the Microfocus COBOL compiler.

2
LF_COBOL1
data

*
data
Data.

(0x000d) Basic Array

2
LF_BARRAY
type

2
@ type
Type of each element in the array.

(0x000e) Label
This is used for assembler labels where there is no typing information about the label.

2
LF_LABEL
mode

36

2
mode
Addressing mode of the label, as follows:
0 Near label
4 Far label
Formats Specification for Windows
Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x000f) Null
This is used when the symbol requires a type record but the data content is null.

2
LF_NULL

(0x0010) Not Translated

This is used when CVPACK encounters a type record that has no equivalent in the Microsoft
symbol information format.

2
LF_NOTTRANS

(0x0011) Multiply Dimensioned Array

This record is used to describe a multiply dimensioned array.
2
LF_DIMARRAY
@utype
@diminfo
name

2
@utype

2
@diminfo

*
name

Underlying type of the array.

Index of the type record containing the dimension information.
Length-prefixed name of the array.

(0x0012) Path to Virtual Function Table

This record is used to describe the path to the virtual function table.
2
LF_VFTPATH
count
bases

Tool Interface Standards (TIS)

2
count

2 * count
bases

Count or number of bases in the path to the virtual function table.

Type indices of the base classes in the path.

Formats Specification for Windows

Version 1.0

37

Microsoft Symbol and Type Information

(0x0013) Reference Precompiled Types

This record specifies that the type records are included from the precompiled types contained in
another module in the executable. A module that contains this type record is considered to be a
user of the precompiled types. When emitting to a COFF object, the section name should be
.debug$P rather than .debug$T. All other attributes should be the same.

2
LF_PRECOMP
start
count
signature

name

2
start

2
count

4
signature

*
name

Starting type index that is included. This number must correspond to

the current type index in the current module.
Count or number of type indices included. After including the
precompiled types, the type index must be start + count.
Signature for the precompiled types being referenced by this module.
The signature will be checked against the signature in the
S_OBJNAME symbol record and the LF_ENDPRECOMP type record
contained in the $$TYPES table of the creator of the precompiled
types. The signature check is used to detect recompilation of the
supplier of the precompiled types without recompilation of all of the
users of the precompiled types. The method for computing the
signature is unspecified. It should be sufficiently robust to detect
failures to recompile.
Name of the module containing the precompiled types. This name
must match the module name in the S_OBJNAME symbol emitted by
the compiler for the object file containing the precompiled types.

(0x0014) End of Precompiled Types

This record specifies that the preceding type records in this module can be referenced by another
module in the executable. A module that contains this type record is considered to be the creator
of the precompiled types. The subsection index for the $$TYPES segment for a precompiled
types creator is emitted as sstPreComp instead of sstTypes, so that the CVPACK utility can pack
the precompiled types creators before the users. Precompiled types must be emitted as the first
type records within the $$TYPES segment and must be self-contained. That is, they cannot
reference a type record with an index greater than or equal to the type index of the
LF_ENDPRECOMP type record.

2
LF_ENDPRECOMP
signature

38

4
signature
Signature of the precompiled types. The signatures in the
S_OBJNAME symbol record, the LF_PRECOMP type record and this
signature must match.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x0015) OEM Generic Type

This record is supplied to allow third party compiler vendors to emit debug OMF information in
an arbitrary format and still allow the CVPACK utility to process the record. CVPACK
processes this record by performing a left to right depth first recursive pack of the records
specified by indices below. The remainder of the data is copied without alteration.

2
LF_OEM

2
OEM

OEM
recOEM
count
indices
data

2
recOEM

2
count

2 * count
indices

*
data

Microsoft-assigned OEM identifier.

OEM-assigned record identifier. These record identifiers are unique
per assigned OEM.
Number of type indices that follow.
Type indices.
Remainder of type record.

(0x0016) Reserved

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

39

Microsoft Symbol and Type Information

3.4. Type Records Referenced from Type Records

(0x0200) Skip
This is used by incremental compilers to reserve space for future indexes.

2
LF_SKIP

2
index

index

*
pad

In processing $$TYPES, the index counter is advanced to index count,

skipping all intermediate indices. This is the next valid index.
Space reserved for incremental compilations. Note that this record is
removed by the link/pack utility, so there is no requirement for
maintaining natural alignment for this record.

pad

(0x0201) Argument List

2
LF_ARGLIST

2
argcount

argcount
indices

*
indices

Count or number of indices in list.

List of type indices for describing the formal parameters for a function
or method.

(0x0202) Default Argument

2
LF_DEFARG

2
@index

index
expression

*
expression

Type index of resulting expression.

Length-prefixed string of supplied default.

(0x0203) Arbitrary List

2
LF_LIST
data

40

*
data
A list of leaves with a format defined by the leaf that indexes the list.
This leaf type has been superseded by more specific list types and its
use is not recommended.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x0204) Field List

A field list contains the descriptors of the fields of a structure, class, union, or enumeration. The
field list is composed of zero or more subfields. Because of the requirement for natural
alignment, there may be padding between elements of the field list. As a program walks down
the field list, the address of the next subfield is calculated by adding the length of the previous
field to the address of the previous field. The byte at the new address is examined and if it is
greater than 0xf0, the low four bits are extracted and added to the address to find the address of
the next subfield. These padding fields are not included in the count field of the class, structure,
union, or enumeration type records. If the field list is broken into two or more pieces by the
compiler, then the last field of each piece is an LF_INDEX with the type being the index of the
continuation record. The LF_INDEX and LF_PADx fields of the field list are not included in
field list count specified in the class, structure, union, or enumeration record. See Section 3.5
for field list elements.

2
leaf

*
data

*
pad

...
...

*
pad

2
leaf

*
data

(0x0205) Derived Classes

This type record specifies all of the classes that are directly derived from the class that
references this type record.

2
LF_DERIVED
count
@type

2
count

*
@type

Number of types in the list.

Type indices of the classes that directly inherit from the class that
references this type record.

(0x0206) Bit Fields

Bit fields are represented by an entry in the field list that indexes a bit field type definition.

2
LF_BITFIELD
length
position
@type

Tool Interface Standards (TIS)

1
length

1
position

2
@type

Length in bits of the object.

Starting position (from bit 0) of the object in the word.
Type index of the field.

Formats Specification for Windows

Version 1.0

41

Microsoft Symbol and Type Information

(0x0207) Method List

2
LF_MLIST

2
attribute

2
@type

4
vtab offset
optional

repeated
attribute
@type
vtab offset

Attribute of the member function.

Type index of the procedure record for this occurrence of the
function.
Present only when property attribute is introducing virtual (optional).
Offset in vtable of the class which contains the pointer to the function.

Once a method has been found in this list, its symbol is found by qualifying the method name
with its class (T::name) and then searching the symbol table for a symbol by that name with the
correct type index. Note that the number of repeats is determined by the subleaf of the field list
that references this LF_MLIST record.

(0x0208) Dimensioned Array with Constant Upper Bound

This record is used to describe a dimensioned array with default lower bound and constant upper
bound. The default lower bound is language specific.
2
LF_DIMCONU
rank
@index
bound

2
rank

2
@index

s*rank
bound

Number of dimensions.
Type of index.
Constants for the upper bound of each dimension of the array. Each
constant is of the size s specified by @index.

(0x0209) Dimensioned Array with Constant Lower and Upper Bounds

This record is used to describe a dimensioned array with constant lower and upper bound.
2
LF_DIMCONLU
rank
@index
bound

42

2
rank

2
@index

2*s*rank
bound

Number of dimensions.
Type of index.
Pairs of constants for the lower and upper bound of each dimension of
the array. Each constant is of the size s specified by @index. The
ordering is lower bound followed by upper bound for each dimension.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x020a) Dimensioned Array with Variable Upper Bound

This record is used to describe a dimensioned array with default lower bound and variable upper
bound. The default lower bound is language specific.
2
LF_DIMVARU
rank
@index
@var

2
rank

2
@index

2*rank
@var

Number of dimensions.
Type of index.
Array of type index of LF_REFSYM record describing the variable
upper bound. If one dimension of the array is variable, then all
dimensions must be described using LF_REFSYM records.

(0x020b) Dimensioned Array with Variable Lower and Upper Bounds

This record is used to describe a dimensioned array with variable lower and upper bound.
2
LF_DIMVARLU
rank
@index
@var

2
rank

2
@index

2*rank
var

Number of dimensions.
Type of index.
Array of type indices of LF_REFSYM records describing the variable
lower and upper bounds. If one dimension of the array is variable,
then all dimensions must be described using LF_REFSYM records.
The order is lower bound followed by upper bound for each
dimension.

(0x020c) Referenced Symbol

This record is used to describe a symbol that is referenced by a type record. The record is
defined because type records cannot reference symbols or locations in the $$SYMBOLS table
and because global symbol compaction will move symbols.
2
LF_REFSYM
sym

Tool Interface Standards (TIS)

*
sym
Copy of the referenced symbol including the length field.

Formats Specification for Windows

Version 1.0

43

Microsoft Symbol and Type Information

3.5. Subfields of Complex Lists

Currently, the only complex list that uses the following leaf indices is the field list of a structure,
class, union, or enumeration.

(0x0400) Real Base Class

This leaf specifies a real base class. If a class inherits real base classes, the corresponding Real
Base Class records will precede all other member records in the field list of that class. Base
class records are emitted in left-to-right declaration order for real bases.

LF_BCLASS
@type
attribute
offset

2
@type

2
attribute

*
offset

Index to type record of the class. The class name can be obtained
from this record.
Member attribute bit field.
Offset of subobject that represents the base class within the structure.

(0x0401) Direct Virtual Base Class

This leaf specifies directly inherited virtual base class. If a class directly inherits virtual base
classes, the corresponding Direct Virtual BaseClass records will follow all Real Base Class
member records and precede all other member records in the field list of that class. Direct
Virtual Base class records are emitted in bottommost left-to-right inheritance order for directly
inherited virtual bases.

2
type
type
@btype
@vbptype
attribute
vbpoff
vboff

2
@btype

2
@vbtype

2
attribute

*
vbpoff

*
vboff

LF_VBCLASS.
Index to type record of the direct or indirect virtual base class. The
class name can be obtained from this record.
Type index of the virtual base pointer for this base
Member attribute bit field.
Numeric leaf specifying the offset of the virtual base pointer from the
address point of the class for this virtual base.
Numeric leaf specifying the index into the virtual base displacement
table of the entry that contains the displacement of the virtual base.
The displacement is relative to the address point of the class plus
vbpoff.

(0x0402) Indirect Virtual Base Class

This leaf specifies indirectly inherited virtual base class. If a class indirectly inherits virtual base
classes, the corresponding Indirect Virtual Base Class records will follow all Real Base Class
and Direct Virtual Base Class member records and precede all other member records in the field
list of that class. Direct Virtual Base class records are emitted in bottommost left-to-right
inheritance order for virtual bases.
44

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

2
type
type
@btype
@vbptype
attribute
vbpoff
vboff

2
@btype

2
@vbtype

2
attribute

*
vbpoff

*
vboff

LF_VBCLASS or LF_IVBCLASS.
Index to type record of the direct or indirect virtual base class. The
class name can be obtained from this record.
Type index of the virtual base pointer for this base.
Member attribute bit field.
Numeric leaf specifying the offset of the virtual base pointer from the
address point of the class for this virtual base.
Numeric leaf specifying the index into the virtual base displacement
table of the entry that contains the displacement of the virtual base.
The displacement is relative to the address point of the class plus
vbpoff.

(0x0403) Enumeration Name and Value

This leaf specifies the name and value of an enumerate within an enumeration.

2
LF_ENUMERATE
attribute
value
name

2
attribute

*
value

*
name

Member attribute bit field.

Numeric leaf specifying the value of the enumeration.
Length-prefixed name of the member field.

(0x0404) Friend Function

This leaf specifies a friend function.

2
LF_FRIENDFCN
@type
name

2
@type

*
name

Index to type record of the friend function.

Length-prefixed name of friend function.

(0x0405) Index To Another Type Record

2
LF_INDEX
index

Tool Interface Standards (TIS)

2
@index
Type index. This field is emitted by the compiler when a complex list
needs to be split during writing.

Formats Specification for Windows

Version 1.0

45

Microsoft Symbol and Type Information

(0x0406) Data Member

This leaf specifies non-static data members of a class.

2
LF_MEMBER

2
@type

@type
attribute
offset
name

2
attribute

*
offset

*
name

Index to type record for field.

Member attribute bit field.
Numeric leaf specifying the offset of field in the structure.
Length-prefixed name of the member field.

(0x0407) Static Data Member

This leaf specifies the static data member of a class. Once a static data member has been found
in this list, its symbol is found by qualifying the name with its class (T::name) and then
searching the symbol table for a symbol by that name with the correct type index.

2
LF_STMEMBER

2
@type

@type
attribute
name

2
attribute

*
name

Index to type record for field.

Member attribute bit field.
Length-prefixed name of the member field.

(0x0408) Method
This leaf specifies the overloaded member functions of a class. This type record can also be
used to specify a non-overloaded method, but is inefficient. The LF_ONEMETHOD record
should be used for non-overloaded methods.

2
LF_METHOD
count
@mList
name

2
count

2
@mList

*
name

Number of occurrences of function within the class. If the function is

overloaded, there will be multiple entries in the method list.
Type index of method list.
Length-prefixed name of method.

(0x0409) Nested Type Definition

This leaf specifies nested type definition with classes, structures, unions, or enums.

2
LF_NESTEDTYPE
@index
46

2
@index

*
name

Type index of nested type.

Formats Specification for Windows
Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

name

Length-prefixed name of type.

(0x040a) Virtual Function Table Pointer

This leaf specifies virtual table pointers within the class. It is a requirement that this record be
emitted in the field list before any virtual functions are emitted to the field list.

2
LF_VFUNCTAB
@type

2
@type
Index to the pointer record describing the pointer. The pointer will in
turn have an LF_VTSHAPE type record as the underlying type. Note
that the offset of the virtual function table pointer from the address
point of the class is always zero.

(0x040b) Friend Class

This leaf specifies a friend class.

2
LF_FRIENDCLS
@type

2
@type
Index to type record of the friend class. The name of the class can be
obtained from the referenced record.

(0x040c) One Method

This record is used to specify a method of a class that is not overloaded.

2
LF_ONEMETHOD
attribute
@type
vbaseoff
name

2
attribute

2
@type

4
vbaseoff

*
name

Method attribute.
Type index of method.
Offset in virtual function table if virtual method. If the method is not
virtual, then this field is not present.
Length-prefixed name of method.

(0x040d) Virtual Function Offset

This record is used to specify a virtual function table pointer at a non-zero offset relative to the
address point of a class.

2
LF_VFUNCOFF
@type
Tool Interface Standards (TIS)

2
@type

4
offset

Type index of virtual function table pointer.

Formats Specification for Windows
Version 1.0

47

Microsoft Symbol and Type Information

offset

48

Offset of virtual function table pointer relative to address point of

class.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

4.

Numeric Leaves
The following leaves are used in symbols and types where actual numeric values need to be
specified. When the symbol or type processor knows that a numeric leaf is present, the next 2
bytes of the record are examined. If the value of these 2 bytes is less than LF_NUMERIC
(0x8000), then the 2 bytes contain the actual value. If the value is greater than or equal to
LF_NUMERIC (0x8000), then the numeric data follows the 2-byte leaf index and is contained in
the number of bytes specified by the leaf index. Note that the LF_UCHAR numeric field is not
necessary, because the value of the 8-bit unsigned character is less than 0x8000. Routines
reading numeric fields must handle the potential non alignment of the data fields.

(0x8000) Signed Char

2
LF_CHAR
char

1
char
8-bit value.

(0x8001) Signed Short

2
LF_SHORT
short

2
short
16-bit signed value.

(0x8002) Unsigned Short

2
LF_USHORT
ushort

2
ushort
16-bit unsigned value.

(0x8003) Signed Long

2
LF_LONG
long

4
long
32-bit signed value.

(0x8004) Unsigned Long

2
LF_ULONG
ulong

Tool Interface Standards (TIS)

4
ulong
32-bit unsigned value.

Formats Specification for Windows

Version 1.0

49

Microsoft Symbol and Type Information

(0x8005) 32-bit Float

2
LF_REAL32
real32

4
real32
32-bit floating-point value.

(0x8006) 64-bit Float

2
LF_REAL64
real64

8
real64
64-bit floating-point value.

(0x8007) 80-bit Float

2
LF_REAL80
real80

10
real80
80-bit floating-point value.

(0x8008) 128 Bit Float

2
LF_REAL128
real128

16
real128
128-bit floating-point value.

(0x8009) Signed Quad Word

2
LF_QUADWORD
quadword

8
quadword
64-bit signed value.

(0x800a) Unsigned Quad Word

2
LF_UQUADWORD
uquadword

50

8
uquadword
64-bit unsigned value.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

(0x800b) 48-bit Float

2
LF_REAL48
real48

6
real48
48-bit floating-point value.

(0x800c) 32-bit Complex

2
LF_COMPLEX32
real
imaginary

4
real

4
imaginary

Real part of complex number.

Imaginary part of complex number.

(0x800d) 64-bit Complex

2
LF_COMPLEX64
real
imaginary

8
real

8
imaginary

Real part of complex number.

Imaginary part of complex number.

(0x800e) 80-bit Complex

2
LF_COMPLEX80
real
imaginary

10
real

10
imaginary

Real part of complex number.

Imaginary part of complex number.

(0x800f) 128-bit Complex

2
LF_COMPLEX128
real
imaginary

16
real

16
imaginary

Real part of complex number.

Imaginary part of complex number.

(0x8010) Variable-length String

2
LF_VARSTRING
length
Tool Interface Standards (TIS)

2
length

*
string

Length of following string.

Formats Specification for Windows
Version 1.0

51

Microsoft Symbol and Type Information

string

52

Variable-length string.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

5.

Predefined Primitive Types

5.1. Format of Reserved Types

Types 0 - 4095 (0 - 0x0fff) are reserved.
following sizes and meanings.

11
reserved

10 - 8
mode

7-4
type

These values are interpreted as bit fields with the

3
reserved

2-0
size

type

One of the following types:

0x00
Special
0x01
Signed integral value
0x02
Unsigned integral value
0x03
Boolean
0x04
Real
0x05
Complex
0x06
Special2
0x07
Real int value
0x08
Reserved
0x09
Reserved
0x0a
Reserved
0x0b
Reserved
0x0c
Reserved
0x0d
Reserved
0x0e
Reserved
0x0f
Reserved for debugger expression evaluator

size

Enumerated value for each of the types.

Type = special
0x00
No type
0x01
Absolute symbol
0x02
Segment
0x03
Void
0x04
Basic 8-byte currency value
0x05
Near Basic string
0x06
Far Basic string
0x07
Untranslated type from previous Microsoft symbol formats
Type = signed/unsigned integral and Boolean values
0x00
1 byte
0x01
2 byte
0x02
4 byte
0x03
8 byte
0x04
Reserved
0x05
Reserved
0x06
Reserved
0x07
Reserved

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

53

Microsoft Symbol and Type Information

Type = real and complex

0x00
32 bit
0x01
64 bit
0x02
80 bit
0x03
128 bit
0x04
48 bit
0x05
Reserved
0x06
Reserved
0x07
Reserved
Type = special2
0x00
Bit
0x01
Pascal CHAR
Type = Real int
0x00
Char
0x01
Wide character
0x02
2-byte signed integer
0x03
2-byte unsigned integer
0x04
4-byte signed integer
0x05
4-byte unsigned integer
0x06
8-byte signed integer
0x07
8-byte unsigned integer
mode

54

Mode
0x00
0x01
0x02
0x03
0x04
0x05
0x06
0x07

Direct; not a pointer

Near pointer
Far pointer
Huge pointer
32-bit near pointer
32-bit far pointer
64-bit near pointer
Reserved

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

5.2. Primitive Type Listing

Special Types
T_NOTYPE
T_ABS
T_SEGMENT
T_VOID
T_PVOID
T_PFVOID
T_PHVOID
T_32PVOID
T_32PFVOID
T_CURRENCY
T_NBASICSTR
T_FBASICSTR
T_NOTTRANS
T_BIT
T_PASCHAR

0x0000
0x0001
0x0002
0x0003
0x0103
0x0203
0x0303
0x0403
0x0503
0x0004
0x0005
0x0006
0x0007
0x0060
0x0061

Uncharacterized type (no type)

Absolute symbol
Segment type
Void
Near pointer to void
Far pointer to void
Huge pointer to void
32-bit near pointer to void
32-bit far pointer to void
Basic 8-byte currency value
Near Basic string
Far Basic string
Untranslated type record from Microsoft symbol format
Bit
Pascal CHAR

0x0010
0x0020
0x0110
0x0120
0x0210
0x0220
0x0310
0x0320
0x0410
0x0420
0x0510
0x0520

8-bit signed
8-bit unsigned
Near pointer to 8-bit signed
Near pointer to 8-bit unsigned
Far pointer to 8-bit signed
Far pointer to 8-bit unsigned
Huge pointer to 8-bit signed
Huge pointer to 8-bit unsigned
16:32 near pointer to 8-bit signed
16:32 near pointer to 8-bit unsigned
16:32 far pointer to 8-bit signed
16:32 far pointer to 8-bit unsigned

0x0070
0x0170
0x0270
0x0370
0x0470
0x0570

Real char
Near pointer to a real char
Far pointer to a real char
Huge pointer to a real char
16:32 near pointer to a real char
16:32 far pointer to a real char

Character Types
T_CHAR
T_UCHAR
T_PCHAR
T_PUCHAR
T_PFCHAR
T_PFUCHAR
T_PHCHAR
T_PHUCHAR
T_32PCHAR
T_32PUCHAR
T_32PFCHAR
T_32PFUCHAR

Real Character Types

T_RCHAR
T_PRCHAR
T_PFRCHAR
T_PHRCHAR
T_32PRCHAR
T_32PFRCHAR

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

55

Microsoft Symbol and Type Information

Wide Character Types

T_WCHAR
T_PWCHAR
T_PFWCHAR
T_PHWCHAR
T_32PWCHAR
T_32PFWCHAR

0x0071
0x0171
0x0271
0x0371
0x0471
0x0571

Wide char
Near pointer to a wide char
Far pointer to a wide char
Huge pointer to a wide char
16:32 near pointer to a wide char
16:32 far pointer to a wide char

Real 16-bit Integer Types

T_INT2
T_UINT2
T_PINT2
T_PUINT2
T_PFINT2
T_PFUINT2
T_PHINT2
T_PHUINT2
T_32PINT2
T_32PUINT2
T_32PFINT2
T_32PFUINT2

0x0072
0x0073
0x0172
0x0173
0x0272
0x0273
0x0372
0x0373
0x0472
0x0473
0x0572
0x0573

Real 16-bit signed int

Real 16-bit unsigned int
Near pointer to 16-bit signed int
Near pointer to 16-bit unsigned int
Far pointer to 16-bit signed int
Far pointer to 16-bit unsigned int
Huge pointer to 16-bit signed int
Huge pointer to 16-bit unsigned int
16:32 near pointer to 16-bit signed int
16:32 near pointer to 16-bit unsigned int
16:32 far pointer to 16-bit signed int
16:32 far pointer to 16-bit unsigned int

0x0011
0x0021
0x0111
0x0121
0x0211
0x0221
0x0311
0x0321
0x0411
0x0421
0x0511
0x0521

16-bit signed
16-bit unsigned
Near pointer to 16-bit signed
Near pointer to 16-bit unsigned
Far pointer to 16-bit signed
Far pointer to 16-bit unsigned
Huge pointer to 16-bit signed
Huge pointer to 16-bit unsigned
16:32 near pointer to 16-bit signed
16:32 near pointer to 16-bit unsigned
16:32 far pointer to 16-bit signed
16:32 far pointer to 16-bit unsigned

16-bit Short Types

T_SHORT
T_USHORT
T_PSHORT
T_PUSHORT
T_PFSHORT
T_PFUSHORT
T_PHSHORT
T_PHUSHORT
T_32PSHORT
T_32PUSHORT
T_32PFSHORT
T_32PFUSHORT

Real 32-bit Integer Types

T_INT4
T_UINT4
T_PINT4
T_PUINT4
T_PFINT4
T_PFUINT4
T_PHINT4
T_PHUINT4
T_32PINT4
T_32PUINT4
T_32PFINT4
T_32PFUINT4
56

0x0074
0x0075
0x0174
0x0175
0x0274
0x0275
0x0374
0x0375
0x0474
0x0475
0x0574
0x0575

Real 32-bit signed int

Real 32-bit unsigned int
Near pointer to 32-bit signed int
Near pointer to 32-bit unsigned int
Far pointer to 32-bit signed int
Far pointer to 32-bit unsigned int
Huge pointer to 32-bit signed int
Huge pointer to 32-bit unsigned int
16:32 near pointer to 32-bit signed int
16:32 near pointer to 32-bit unsigned int
16:32 far pointer to 32-bit signed int
16:32 far pointer to 32-bit unsigned int

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

32-bit Long Types

T_LONG
T_ULONG
T_PLONG
T_PULONG
T_PFLONG
T_PFULONG
T_PHLONG
T_PHULONG
T_32PLONG
T_32PULONG
T_32PFLONG
T_32PFULONG

0x0012
0x0022
0x0112
0x0122
0x0212
0x0222
0x0312
0x0322
0x0412
0x0422
0x0512
0x0522

32-bit signed
32-bit unsigned
Near pointer to 32-bit signed
Near pointer to 32-bit unsigned
Far pointer to 32-bit signed
Far pointer to 32-bit unsigned
Huge pointer to 32-bit signed
Huge pointer to 32-bit unsigned
16:32 near pointer to 32-bit signed
16:32 near pointer to 32-bit unsigned
16:32 far pointer to 32-bit signed
16:32 far pointer to 32-bit unsigned

0x0076
0x0077
0x0176
0x0177
0x0276
0x0277
0x0376
0x0377
0x0476
0x0477
0x0576
0x0577

64-bit signed int

64-bit unsigned int
Near pointer to 64-bit signed int
Near pointer to 64-bit unsigned int
Far pointer to 64-bit signed int
Far pointer to 64-bit unsigned int
Huge pointer to 64-bit signed int
Huge pointer to 64-bit unsigned int
16:32 near pointer to 64-bit signed int
16:32 near pointer to 64-bit unsigned int
16:32 far pointer to 64-bit signed int
16:32 far pointer to 64-bit unsigned int

0x0013
0x0023
0x0113
0x0123
0x0213
0x0223
0x0313
0x0323
0x0413
0x0423
0x0513
0x0523

64-bit signed
64-bit unsigned
Near pointer to 64-bit signed
Near pointer to 64-bit unsigned
Far pointer to 64-bit signed
Far pointer to 64-bit unsigned
Huge pointer to 64-bit signed
Huge pointer to 64-bit unsigned
16:32 near pointer to 64-bit signed
16:32 near pointer to 64-bit unsigned
16:32 far pointer to 64-bit signed
16:32 far pointer to 64-bit unsigned

0x0040
0x0140
0x0240
0x0340
0x0440
0x0540

32-bit real
Near pointer to 32-bit real
Far pointer to 32-bit real
Huge pointer to 32-bit real
16:32 near pointer to 32-bit real
16:32 far pointer to 32-bit real

Real 64-bit int Types

T_INT8
T_UINT8
T_PINT8
T_PUINT8
T_PFINT8
T_PFUINT8
T_PHINT8
T_PHUINT8
T_32PINT8
T_32PUINT8
T_32PFINT8
T_32PFUINT8

64-bit Integral Types

T_QUAD
T_UQUAD
T_PQUAD
T_PUQUAD
T_PFQUAD
T_PFUQUAD
T_PHQUAD
T_PHUQUAD
T_32PQUAD
T_32PUQUAD
T_32PFQUAD
T_32PFUQUAD

32-bit Real Types

T_REAL32
T_PREAL32
T_PFREAL32
T_PHREAL32
T_32PREAL32
T_32PFREAL32
Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

57

Microsoft Symbol and Type Information

48-bit Real Types

T_REAL48
T_PREAL48
T_PFREAL48
T_PHREAL48
T_32PREAL48
T_32PFREAL48

0x0044
0x0144
0x0244
0x0344
0x0444
0x0544

48-bit real
Near pointer to 48-bit real
Far pointer to 48-bit real
Huge pointer to 48-bit real
16:32 near pointer to 48-bit real
16:32 far pointer to 48-bit real

0x0041
0x0141
0x0241
0x0341
0x0441
0x0541

64-bit real
Near pointer to 64-bit real
Far pointer to 64-bit real
Huge pointer to 64-bit real
16:32 near pointer to 64-bit real
16:32 far pointer to 64-bit real

0x0042
0x0142
0x0242
0x0342
0x0442
0x0542

80-bit real
Near pointer to 80-bit real
Far pointer to 80-bit real
Huge pointer to 80-bit real
16:32 near pointer to 80-bit real
16:32 far pointer to 80-bit real

0x0043
0x0143
0x0243
0x0343
0x0443
0x0543

128-bit real
Near pointer to 128-bit real
Far pointer to 128-bit real
Huge pointer to 128-bit real
16:32 near pointer to 128-bit real
16:32 far pointer to 128-bit real

0x0050
0x0150
0x0250
0x0350
0x0450
0x0550

32-bit complex
Near pointer to 32-bit complex
Far pointer to 32-bit complex
Huge pointer to 32-bit complex
16:32 near pointer to 32-bit complex
16:32 far pointer to 32-bit complex

64-bit Real Types

T_REAL64
T_PREAL64
T_PFREAL64
T_PHREAL64
T_32PREAL64
T_32PFREAL64

80-bit Real Types

T_REAL80
T_PREAL80
T_PFREAL80
T_PHREAL80
T_32PREAL80
T_32PFREAL80

128-bit Real Types

T_REAL128
T_PREAL128
T_PFREAL128
T_PHREAL128
T_32PREAL128
T_32PFREAL128

32-bit Complex Types

T_CPLX32
T_PCPLX32
T_PFCPLX32
T_PHCPLX32
T_32PCPLX32
T_32PFCPLX32

58

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

64-bit Complex Types

T_CPLX64
T_PCPLX64
T_PFCPLX64
T_PHCPLX64
T_32PCPLX64
T_32PFCPLX64

0x0051
0x0151
0x0251
0x0351
0x0451
0x0551

64-bit complex
Near pointer to 64-bit complex
Far pointer to 64-bit complex
Huge pointer to 64-bit complex
16:32 near pointer to 64-bit complex
16:32 far pointer to 64-bit complex

0x0052
0x0152
0x0252
0x0352
0x0452
0x0552

80-bit complex
Near pointer to 80-bit complex
Far pointer to 80-bit complex
Huge pointer to 80-bit complex
16:32 near pointer to 80-bit complex
16:32 far pointer to 80-bit complex

80-bit Complex Types

T_CPLX80
T_PCPLX80
T_PFCPLX80
T_PHCPLX80
T_32PCPLX80
T_32PFCPLX80

128-bit Complex Types

T_CPLX128
T_PCPLX128
T_PFCPLX128
T_PHCPLX128
T_32PCPLX128
T_32PFCPLX128

0x0053
0x0153
0x0253
0x0353
0x0453
0x0553

128-bit complex
Near pointer to 128-bit complex
Far pointer to 128-bit complex
Huge pointer to 128-bit real
16:32 near pointer to 128-bit complex
16:32 far pointer to 128-bit complex

0x0030
0x0031
0x0032
0x0033
0x0130
0x0131
0x0132
0x0133
0x0230
0x0231
0x0232
0x0233
0x0330
0x0331
0x0332
0x0333
0x0430
0x0431
0x0432
0x0433
0x0530
0x0531
0x0532
0x0533

8-bit Boolean
16-bit Boolean
32-bit Boolean
64-bit Boolean
Near pointer to 8-bit Boolean
Near pointer to 16-bit Boolean
Near pointer to 32-bit Boolean
Near pointer to 64-bit Boolean
Far pointer to 8-bit Boolean
Far pointer to 16-bit Boolean
Far pointer to 32-bit Boolean
Far pointer to 64-bit Boolean
Huge pointer to 8-bit Boolean
Huge pointer to 16-bit Boolean
Huge pointer to 32-bit Boolean
Huge pointer to 64-bit Boolean
16:32 near pointer to 8-bit Boolean
16:32 near pointer to 16-bit Boolean
16:32 near pointer to 32-bit Boolean
16:32 near pointer to 64-bit Boolean
16:32 far pointer to 8-bit Boolean
16:32 far pointer to 16-bit Boolean
16:32 far pointer to 32-bit Boolean
16:32 far pointer to 64-bit Boolean

Boolean Types
T_BOOL08
T_BOOL16
T_BOOL32
T_BOOL64
T_PBOOL08
T_PBOOL16
T_PBOOL32
T_PBOOL64
T_PFBOOL08
T_PFBOOL16
T_PFBOOL32
T_PFBOOL32
T_PHBOOL08
T_PHBOOL16
T_PHBOOL32
T_PHBOOL64
T_32PBOOL08
T_32PBOOL16
T_32PBOOL32
T_32PBOOL64
T_32PFBOOL08
T_32PFBOOL16
T_32PFBOOL32
T_32PFBOOL64
Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

59

Microsoft Symbol and Type Information

6. Register Enumerations
When the compiler emits a symbol that has been enregistered, the symbol record specifies the
register by a register enumeration value. The enumeration is unique to each hardware
architecture supported.

6.1. Intel 80x86/80x87 Architectures

0

none

8-bit Registers
1
2
3
4
5
6
7
8

AL
CL
DL
BL
AH
CH
DH
BH

16-bit Registers
9
10
11
12
13
14
15
16

AX
CX
DX
BX
SP
BP
SI
DI

32-bit Registers
17
18
19
20
21
22
23
24

EAX
ECX
EDX
EBX
ESP
EBP
ESI
EDI

Segment Registers
25
26
27
28
29
30

60

ES
CS
SS
DS
FS
GS

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

Special Cases
31
32
33
34

IP
FLAGS
EIP
EFLAGS

PCODE Registers
40
41
42
43-47

TEMP
TEMPH
QUOTE
Reserved

System Registers
80
81
82
83
90
91
92
93
94
95
96
97

CR0
CR1
CR2
CR3
DR0
DR1
DR2
DR3
DR4
DR5
DR6
DR7

Register Extensions for 80x87

128
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

Tool Interface Standards (TIS)

ST(0)
ST(2)
ST(3)
ST(4)
ST(5)
ST(6)
ST(7)
CONTROL
STATUS
TAG
FPIP
FPCS
FPDO
FPDS
ISEM
FPEIP
FPEDO

Formats Specification for Windows

Version 1.0

61

Microsoft Symbol and Type Information

6.2. Motorola 68000 Architectures

0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40 - 50
51
52

62

Data register 0
Data register 1
Data register 2
Data register 3
Data register 4
Data register 5
Data register 6
Data register 7
Address register 0
Address register 1
Address register 2
Address register 3
Address register 4
Address register 5
Address register 6
Address register 7
??CV_R68_CCR
??CV_R68_SR
??CV_R68_USP
??CV_R68_MSP
??CV_R68_SFC
??CV_R68_DFC
??CV_R68_CACR
??CV_R68_VBR
??CV_R68_CAAR
??CV_R68_ISP
??CV_R68_PC
Reserved
??CV_R68_FPCR
??CV_R68_FPSR
??CV_R68_FPIAR
Reserved
Floating-point 0
Floating-point 1
Floating-point 2
Floating-point 3
Floating-point 4
Floating-point 5
Floating-point 6
Floating-point 7
Reserved
CV_R68_PSR
CV_R68_PCSR

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

6.3. MIPS Architectures

Integer Register
0
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

NoRegister
IntZero
IntAT
IntV0
IntV1
IntA0
IntA1
IntA2
IntA3
IntT0
IntT1
IntT2
IntT3
IntT4
IntT5
IntT6
IntT7
IntS0
IntS1
IntS2
IntS3
IntS4
IntS5
IntS6
IntS7
IntT8
IntT9
Int KT0
IntKT1
IntGP
IntSP
IntS8
IntRA
Int Lo
Int Hi

50
51

Fir
PSR

60
61
62
63
64
65
66
67
68

Floating-point register 0
Floating-point register 1
Floating-point register 2
Floating-point register 3
Floating-point register 4
Floating-point register 5
Floating-point register 6
Floating-point register 7
Floating-point register 8

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

63

Microsoft Symbol and Type Information

64

69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91

Floating-point register 9
Floating-point register 10
Floating-point register 11
Floating-point register 12
Floating-point register 13
Floating-point register 14
Floating-point register 15
Floating-point register 16
Floating-point register 17
Floating-point register 18
Floating-point register 19
Floating-point register 20
Floating-point register 21
Floating-point register 22
Floating-point register 23
Floating-point register 24
Floating-point register 25
Floating-point register 26
Floating-point register 27
Floating-point register 28
Floating-point register 29
Floating-point register 30
Floating-point register 31

92

Floating-point status register

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

7.

Symbol and Type Format for Microsoft

Executables

7.1. Introduction
This section describes the format used to embed debugging information into the executable file.

7.2. Debug Information Format

The debug information format encompasses a block of data that goes into the .exe file at a
location dependent upon the executable file format. The version of the debug information is
specified by a signature that is contained within the debug information. The signature has the
format of NBxx, where xx is the version number and has the following meanings:
NB00
NB01
NB02
NB03
NB04
NB05
NB06
NB07
NB08

NB09

Not supported.
Not supported.
Linked by a Microsoft LINK, version 5.10, or equivalent OEM linker.
Not supported.
Not supported.
Emitted by LINK, version 5.20 and later linkers for a file before it has
been packed.
Not supported.
Used for Quick C for Windows 1.0 only.
Used by Microsoft CodeView debugger, versions 4.00 through 4.05,
for a file after it has been packed. Microsoft CodeView,, version 4.00
through 4.05 will not process a file that does not have this signature.
Used by Microsoft CodeView, version 4.10 for a file after it has been
packed. Microsoft CodeView 4.10 will not process a file that does not
have this signature.

The method for finding the debug information depends upon the executable format.
OMF
For OMF executables, the debug information is at the end of the .exe file, i.e., after the header
plus load image, the overlays, and the Windows resource compiler information. The lower
portion of the file is unaffected by the additional data. The last eight bytes of the file contain a
signature and a long file offset from the end of the file (lfoBase). The long offset indicates the
position in the file (relative to the end of the file) of the base address.
The value
lfaBase = length of the file - lfoBase
gives the base address of the start of the Symbol and Type OMF information relative to the
beginning of the file.

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

65

Microsoft Symbol and Type Information

executable header
executable code + ...
NBxx
lfoDirectory
Subsection tables
.
.
.
Subsection Directory
NBxx
lfoBase

Signature at lfaBase
Offset of directory from base address (lfoDir)
sstModule, sstType, sstLibraries, ...

At file offset lfaBase + lfoDir

Signature
Offset of repeated signature from end of file

PE Format
For PE format executables, the base address lfaBase is found by examining the executable
header. Note, currently Microsoft code uses the same method that is used for OMF format
executables to find the debug information.

executable header
executable code + ...
NBxx
lfoDirectory
Subsection tables
.
.
.
Subsection Directory
other information

Contains pointer to debug information

Signature at lfaBase
Offset of directory from base address (lfoDir)
sstModule, sstType, sstLibraries, ...

At file offset lfaBase + lfoDir

All other file offsets in the Symbol and Type OMF are relative to lfaBase. At the base address,
the signature is repeated, followed by the long displacement to the subsection directory (lfoDir).
All subsections start on a long word boundary and are designed to maintain natural alignment
internally in each subsection and within the subsection directory.

66

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

7.3. Subsection Directory

The subsection directory has the following format:

Directory header
Directory entry 0
Directory entry 1
.
.
.
Directory entry n
The subsection directory is prefixed with a directory header structure indicating size and number
of subsection directory entries that follow.

2
cbDirHeader
cbDirHeader
cbDirEntry
cDir
lfoNextDir

flags

2
cbDirEntry

4
cDir

4
lfoNextDir

4
flags

Length of directory header.

Length of each directory entry.
Number of directory entries.
Offset from lfaBase of next directory. This field is currently unused,
but is intended for use by the incremental linker to point to the next
directory containing Symbol and Type OMF information from an
incremental link.
Flags describing directory and subsection tables. No values have been
defined for this field.

The directory header structure is followed by the directory entries, which specify the subsection
type, module index, if applicable, the subsection offset, and subsection size.

2
subsection
subsection
iMod

lfo
cb

Tool Interface Standards (TIS)

2
iMod

4
lfo

4
cb

Subdirectory index. See the table below for a listing of the valid
subsection indices.
Module index. This number is 1 based and zero (0) is never a valid
index. The index 0xffff is reserved for tables that are not associated
with a specific module. These tables include sstLibraries,
sstGlobalSym, sstGlobalPub, and sstGlobalTypes.
Offset from the base address lfaBase.
Number of bytes in subsection.

Formats Specification for Windows

Version 1.0

67

Microsoft Symbol and Type Information

There is no requirement for a particular subsection to exist for a particular module. There is a
preferred order for subsections within the Symbol and Type OMF portion and the subsection
directory of the file, as emitted by the linker (NB05 signature). The preferred order is the
following:

sstModule1
.
sstModulen
sstTypes1
sstPublics1
sstSymbols1
sstSrcModule1
.
sstTypesn
sstPublicsn
sstSymbolsn
sstSrcModulen
sstLibraries
directory

Module 1
.
Module n
Module 1
Module 1
Module 1
Module 1
Module n
Module n
Module n
Module n

However, if the tables are not written in this order by the linker, the CVPACK utility will sort
the subsection table into this order and read the subsections in this order by seeking the correct
location. The net effect is that packing will be less efficient, but it will work.
CVPACK will write the Symbol and Type OMF back to the file in the order listed below. The
Microsoft debugger requires that the sstModule entries be first and sequential in the subsection
directory. For performance reasons, it is recommended that the order of the subsections in the
file match the order of the subsection directory entries.
For signatures prior to NB09, the packed file has the following subsections and ordering:
NBxx
lfoDir
sstModule1
.
sstModulen
sstAlignSym1
sstSrcModule1
.
sstAlignSymn
sstSrcModulen
sstGlobalPub
sstGlobalSym
sstLibraries
sstGlobalTypes
Directory
NBxx
lfoBase

68

Signature
Directory offset
Module 1
.
Module n
Module 1
Module 1
Module n
Module n
Global Publics
Global Symbols
Libraries
Global Types
Signature, if OMF executable
Offset of base, if OMF executable

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

For NB09 signatures, the packed file has the following subsections and ordering:
NBxx
lfoDir
sstModule1
.
sstModulen
sstAlignSym1
sstSrcModule1
.
sstAlignSymn
sstSrcModulen
sstGlobalPub
sstGlobalSym
sstLibraries
sstGlobalTypes
sstStaticSym
sstFileIndex
Directory
NBxx
lfoBase

Signature
Directory offset
Module 1
.
Module n
Module 1
Module 1
Module n
Module n
Global Publics
Global Symbols
Libraries
Global Types
Static Symbols
File Index

signature
offset

7.4. SubSection Types (sst...)

All values not defined in the following list are reserved for future use:
sstModule
sstTypes
sstPublic
sstPublicSym
sstSymbols
sstAlignSym
sstSrcLnSeg
sstSrcModule
sstLibraries
sstGlobalSym
sstGlobalPub
sstGlobalTypes
sstMPC
sstSegMap
sstSegName
sstPreComp
unused
reserved
reserved
sstFileIndex
sstStaticSym

Tool Interface Standards (TIS)

0x120
0x121
0x122
0x123
0x124
0x125
0x126
0x127
0x128
0x129
0x12a
0x12b
0x12c
0x12d
0x12e
0x12f
0x130
0x131
0x132
0x133
0x134

Formats Specification for Windows

Version 1.0

69

Microsoft Symbol and Type Information

(0x0120) sstModule
This describes the basic information about an object module, including code segments, module
name, and the number of segments for the modules that follow. Directory entries for sstModules
precede all other subsection directory entries.

2
ovlNumber

2
iLib

ovlNumber
iLib

2
cSeg

2
Style

*
SegInfo

*
Name

Overlay number.
Index into sstLibraries subsection if this module was linked from a
library
Count or number of code segments to which this module contributes.
Debugging style for this module. Currently only "CV" is defined. A
module can have only one debugging style. If a module contains
debugging information in an unrecognized style, the information will
be discarded.
Detailed information about each segment to which code is
contributed. This is an array of cSeg count segment information
descriptor structures.
Length-prefixed name of module

cSeg
Style

SegInfo

Name

SegInfo is a structure that describes each segment to which a module contributes code. It is
formatted as follows:

2
Seg

2
pad

Seg
pad
offset
cbSeg

4
offset

4
cbSeg

Segment that this structure describes.

Padding to maintain alignment This field is reserved for future use
and must be emitted as zeroes.
Offset in segment where the code starts.
Count or number of bytes of code in the segment.

(0x0121) sstTypes
The linker emits one of these subsections for every object file that contains a $$TYPES segment.
CVPACK combines all of these subsections into an sstGlobalTypes subsection and deletes the
sstTypes tables. The sstTypes table contains the contents of the $$TYPES segment, except that
addresses within the $$TYPES segment have been fixed by the linker. (See also sstPreComp.)

(0x0122) sstPublic
The linker fills each subsection of this type with entries for the public symbols of a module. The
CVPACK utility combines all of the sstPublics subsections into an sstGlobalPub subsection.
This table has been replaced with the sstPublicSym, but is retained for compatibility with
previous linkers.

70

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

2/4
offset

2
seg

offset

2
type

*
name

Offset of public within segment. This will be a 16-bit offset unless

the executable is a 32-bit executable. Note that if any public symbols
are 16:32 model, then all publics are emitted as 16:32 addresses.
Segment index.
Type index of the symbol. This will be zero if the module was
compiled without Microsoft symbol and type information.
Length-prefixed name of public

seg
type
name

(0x0123) sstPublicSym
This table replaces the sstPublic subsection. The format of the public symbols contained in this
table is that of an S_PUB16 or S_PUB32 symbol, as defined in Sections 2.3 and 2.4. This
allows an executable to contain both 16:16 and 16:32 public symbols for mixed-mode
executable files. As with symbols sections, public section records must start on a 4-byte
boundary.

(0x0124) sstSymbols
The linker emits one of these subsections for every object file that contains a $$SYMBOLS
segment. The sstSymbols table contains the contents of the $$SYMBOLS segment, except that
addresses within the $$SYMBOLS segment have been fixed by the linker. The CVPACK utility
moves global symbols from the sstSymbols subsection to the sstGlobalSum subsection during
packing. When the remaining symbols are written executables, the subsection type is changed to
sstAlignSym.

(0x0125) sstAlignSym
CVPACK writes the remaining unpacked symbols for a module back to the executable in a
subsection of this type. All symbols have been padded to fall on a long word boundary, and the
lexical scope linkage fields have been initialized.

(0x0126) sstSrcLnSeg
The linker fills in each subsection of this type with information obtained from any LINNUM
records in the module. This table has been replaced by the sstSrcModule, but is retained for
compatibility with previous linkers. CVPACK rewrites sstSrcLnSeg tables to sstSrcModule
tables.

*
name
name
seg
cPair

Tool Interface Standards (TIS)

2
seg

2
cPair

*
line/offset

Length-prefixed name of source file.

Segment.
Count or number of line number offset pairs to follow.

Formats Specification for Windows

Version 1.0

71

Microsoft Symbol and Type Information

line/offset

Line/offset pairs. This pair consists of the line number followed by

the offset of the start of the code for that line within the segment. All
offsets are relative to the beginning of the segment, not the start of the
contribution of the module to the segment. For example, if the
module contributes to segment _TEXT starting at offset 0x0100, and
the code offset of the first line number is 0x0010 relative to the
module, it will show up in the subsection as 0x0110. The offsets are
16 bits if the executable is a 16:16 executable. If any segment in the
executable is 16:32 model, then all offsets in the line/offset pairs are
32-bit offsets.

(0x0127) sstSrcModule
The following table describes the source line number for addressing mapping information for a
module. The table permits the description of a module containing multiple source files with
each source file contributing code to one or more code segments. The base addresses of the
tables described below are all relative to the beginning of the sstSrcModule table.
Module header
Information for source file 1
Information for segment 1
Information for segment 2
.
Information for source file 2
Information for segment 1
Information for segment 2
.
.
The module header structure describes the source file and code segment organization of the
module.
2
cFile

2
cSeg
cFile
cSeg
baseSrcFile
start/end

seg

72

4*cFile
baseSrcFile

8*cSeg
start/end

2*cSeg
seg

Number of source files contributing code to segments.

Number of code segments receiving code from this module.
An array of base offsets from the beginning of the sstSrcModule table.
An array of two 32-bit offsets per segment that receives code from
this module. The first offset is the offset within the segment of the
first byte of code from this module. The second offset is the ending
address of the code from this module. The order of these pairs
corresponds to the ordering of the segments in the seg array. Zeroes
in these entries means that the information is not known, and the file
and line tables described below need to be examined to determine if
an address of interest is contained within the code from this module.
An array of segment indices that receive code from this module. If
the number of segments is not even, two pad characters are inserted to
maintain natural alignment.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

The file table describes the code segments that receive code from each source file.

2
cSeg

2
pad

4*cSeg
baseSrcLn

cSeg

pad
baseSrcLn
start/end

cbName
Name

8*cSeg
start/end

2
cbName

*
Name

Number of segments that receive code from this source file. If the
source file contributes code multiple times to a segment, it is reflected
in this count.
Pad field used to maintain alignment. This field is reserved for future
use and must be emitted as zero.
An array of offsets for the line/address mapping tables for each of the
segments that receive code from this source file.
An array of two 32-bit offsets per segment that receives code from
this module. The first offset is the offset within the segment of the
first byte of code from this module. The second offset is the ending
address of the code from this module. The order of these pairs
corresponds to the ordering of the segments in the seg array. Zeroes
in these entries means that the information is not known, and the file
and line tables described below need to be examined to determine if
an address of interest is contained within the code from this module.
Count or number of bytes in source file name.
Source file name. This can be a fully or partially qualified path name.

The preferred ordering for this table is by offset order. Line number and offsets must be unique.
The line number to address mapping information is contained in a table with the following
format:

2
Seg

2
cPair

Seg
cPair
offset
linenumber

4*cPair
offset

2*cPair
linenumber

Segment index for this table.

Count or number of source line pairs to follow.
An array of 32-bit offsets for the offset within the code segment of the
start of the line contained in the parallel array linenumber.
An array of 16-bit line numbers for the numbers of the lines in the
source file that cause code to be emitted to the code segment. This
array is parallel to the offset array. If cPair is not even, then a zero
word is emitted to maintain natural alignment in the sstSrcModule
table.

(0x0128) sstLibraries
There can be at most one sstLibraries SubSection. The format is an array of length-prefixed
names, which define all the library files used during linking. The order of this list defines the
library index number (seethe sstModules subsection). The first entry should be empty, i.e., a
zero-length string, because library indices are 1-based.

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

73

Microsoft Symbol and Type Information

(0x0129) sstGlobalSym
This subsection contains globally compacted symbols. The format of the table is a header
specifying the symbol and address hash functions, the length of the symbol information, the
length of the symbol hash function data, and the length of address hash function data. This is
followed by the symbol information, which followed by the symbol hash tables, and then
followed by the address hash tables. When the pack utility writes the sstGlobals subsection,
each symbol is zero-padded such that the following symbol starts on a long boundary, and the
length field is adjusted by the pad count. Note that symbol and/or address hash data can be
discarded and the globally packed symbols are linearly searched. A hash function index 0
means that no hash data exists. See Section 7.5 for more information about the hashing
functions.
The header has the following format:
2
symhash

2
addrhash

symhash
addrhash
cbSymbol
cbSymHash
cbAddrHash

4
cbSymbol

4
cbSymHash

4
cbAddrHash

Index of the symbol hash function.

Index of the address hash function.
Count or number of bytes in the symbol table.
Count or number of bytes in the symbol hash table.
Count or number of bytes in the address hashing table.

Starting with the NB09 signature files, the sstGlobalSym table can contain S_ALIGN symbols to
maintain a 4-K alignment of symbols. Also, starting with NB09 signature files, the sstGlobal
can contain S_PROCREF and S_DATAREF symbols to global procedures and to global data
symbols that would not otherwise have been globally packed because of symbol type
mismatches. See Section 2.6 for more information about the S_PROCREF and S_DATAREF
symbols.

(0x012a) sstGlobalPub
This subsection contains the globally compacted public symbols from the sstPublics. The format
of the table is a header specifying the symbol and address hash functions, the length of the
symbol information, the length of the symbol hash function data, and the length of address hash
function data. This is followed by symbol information, which is followed by the symbol hash
tables, and then followed by the address hash tables. When the pack utility writes the sstGlobals
subsection, each symbol is zero-padded such that the following symbol starts on a long
boundary, and the length field of the symbol is adjusted by the pad count. Note that symbol
and/or address hash data can be discarded and the globally packed symbolscan be linearly
searched in low-memory situations. A hash function index 0 means that no hash data exists.
See Section 7.5 for more information about the hashing functions.
The header has the following format:
2
symhash
symhash
addrhash
74

2
addrhash

4
cbSymbol

4
cbSymHash

4
cbAddrHash

Index of the symbol hash function.

Index of the address hash function.
Formats Specification for Windows
Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

cbSymbol
cbSymHash
cbAddrHash

Count or number of bytes in the symbol table.

Count or number of bytes in the symbol hash table.
Count or number of bytes in the address hashing table.

Starting with the NB09 signature files, the sstGlobalSym table can contain S_ALIGN symbols to
maintain a 4-K alignment of symbols.
They contain S_ALIGN symbol records to maintain a 4-K alignment of tables. Note also that
sstGlobalPub table contains S_PROCREF symbols.

(0x012b) sstGlobalTypes
This subsection contains the packed type records for the executable file. The first long word of
the subsection contains the number of types in the table. This count is followed by a count-sized
array of long offsets to the corresponding type record. As the sstGlobalTypes subsection is
written, each type record is forced to start on a long word boundary. However, the length of the
type string is not adjusted by the pad count. The remainder of the subsection contains the type
records. This table is invalid for NB05 signatures.
Types are 48-K aligned as well as naturally aligned, so linear traversal of the type table is nontrivial. The 48-K alignment means that no type record crosses a 48-K boundary.
flags
cType
offType[cType]
type string 0
type string 1
.
type string n

Types table flag

Count or number of types
Offset of each type See note below.
Type string for type index 0x1000
Type string for type index 0x1001
Type string for type index 0x1000 + n

Note that for NB07 and NB08 executables, the type string offset is from the beginning of the
subsection table. For NB09 executables, the type string offset is from the first type record of the
sstGlobalTypes subsection. Using the offset from the first type record simplifies demand
loading of the sstGlobalTypes table.

The types table flags entry has the following format:

3
unused
unused
signature

Tool Interface Standards (TIS)

1
signature
Reserved for future use. Must be emitted as zeroes.
Global types table signature.

Formats Specification for Windows

Version 1.0

75

Microsoft Symbol and Type Information

(0x012c) sstMPC
This table is emitted by the Pcode MPC program when a segmented executable is processed into
a non-segmented executable file. The table contains the mapping from segment indices to frame
numbers.
2
cSeg

2*cSeg
mpSegFrame

cSeg
mpSegFrame

Count or number of segments converted

Segment-to-frame mapping table. A segmented address
segment:offset is converted to a frame by mpSegFrame[segment-1]*16
+ offset

(0x012d) sstSegMap
This table contains the mapping between the logical segment indices used in the symbol table
and the physical segments where the program was loaded
There is one sstSegMap per executable or DLL.

2
2
20

cSeg
cSegLog
SegDesc 0
.
.
SegDesc N

20

cSeg
cSegLog

SegDescN

Count or number of segment descriptors in table

Count or number of logical segment descriptors
First segment descriptor

cSeg'th segment descriptor

Total number of segment descriptors.

Total number of logical segments. All group descriptors follow the
logical segment descriptors. The number of group descriptors is given
by cSeg - cSegLog.
Array of segment descriptors. Information about a logical segment
can be found by using logical segment number - 1 as an index into this
array. Subtract 1 because the logical segment number is 1 based.

Each element of the segment descriptor array has the following format:

2
flags

2
ovl
flags
ovl
group

76

2
group

2
frame

2
iSegName

2
iClassName

4
offset

4
cbseg

Descriptor flags bit field. See below for details.

Logical overlay number.
Group index into the descriptor array. The group index must either be
0 or cSegLog <= group < cSeg.

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

frame

This value has the following different meanings depending upon the
values of fAbs and fSel in the flags bit array and ovl:
fAbs
fSel ovl Operation
0
0 0 Frame is added to PSP + 0x10 if not a .com file
0
0 0 Frame is added to PSP if it is a .com file
0
0 != 0 Frame is added to current overlay base
1
0
x
Frame is absolute address
0
1 x Frame contains a selector
Byte index of the segment or group name in the sstSegName table. A
value of 0xffff indicates that there is no name.
Byte index of the class name in the sstSegName table. A value of
0xffff indicates that there is no name.
Byte offset of the logical segment within the specified physical
segment. If fGroup is set in flags, offset is the offset of the group in
the physical segment. Currently all groups define physical segments,
so offset will be zero for groups.
Byte count of the logical segment or group.

iSegName
iClassName
offset

cbSeg

The descriptor flags bit field flags has the following format:

:3
res

:1
fGroup

:2
res

:1
fAbs

res
fGroup

fAbs
fSel
f32Bit
fExecute
fWrite
fRead

:1
fSel

:4
res

:1
f32Bit

:1
fExecut
e

:1
fWrite

:1
fRead

Reserved and set to zero.

If set, the descriptor represents a group. Because groups are not
assigned logical segment numbers, these entries are placed after the
logcial segment descriptors in the descriptor array.
frame represents an absolute address.
frame represents a selector.
The descriptor describes a 32-bit linear address.
The segment is executable.
The segment is writable.
The segment is readable.

(0x012e) sstSegName
The sstSegName table contains all of the logical segment and class names. The table is an array
of zero-terminated strings. Each string is indexed by its beginning from the start of the table.
See sstSegMap above.

(0x012f) sstPreComp
The linker emits one of these sections for every OMF object that has the $$TYPES table flagged
as sstPreComp and for every COFF object that contains a .debug$P section. During packing, the
CVPACK utility processes modules with a types table having the sstPreComp index before
modules with types table having the sstTypes index.

(0x0131) Reserved
Reserved for internal use.
Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

77

Microsoft Symbol and Type Information

(0x0132) Reserved
Reserved for internal use.

(0x0133) sstFileIndex
This subsection contains a list of all of the sources files that contribute code to any module
(compiland) in the executable. File names are partially qualified relative to the compilation
directory.

2
cMod

2
cRef
cMod
cRef
ModStart
cRefCnt
NameRef

Names

2 * cMod
ModStart

2 * cModules
cRefCnt

4 * cRef
NameRef

*
Names

Count or number of modules in the executable.

Count or total number of file name references.
Array of indices into the NameOffset table for each module. Each
index is the start of the file name references for each module.
Number of file name references per module.
Array of offsets into the Names table. For each module, the offset to
first referenced file name is at NameRef[ModStart] and continues for
cRefCnt entries.
List of zero-terminated file names. Each file name is partially
qualified relative to the compilation directory.

(0x0134) sstStaticSym
This subsection is structured exactly like the sstGlobalPub and sstGlobalSym subsections. It
contains S_PROCREF for all static functions, as well as S_DATAREF for static module level
data and non-static data that could not be included (due to type conflicts) in the sstGlobalSym
subsection.

78

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

7.5. Hash table and sort table descriptions

The NB09 signature Microsoft symbol and type information contains hash/sort tables in the
sstGlobalSym, sstGlobalPub, and sstStaticSym subsections.

Name hash table (symhash == 10):

The symbol name hash table uses the following checksum algorithm to generate the hash.

byt_toupper(b)
dwrd_toupper(dw)

<- (b&0xDF)
<- (dw&0xDFDFDFDF)

cb = {Number of characters in the name}

lpbName = {pointer to the first character of the name}
ulEnd = 0;
while ( cb & 3 ) {
ulEnd |= byt_toupper ( lpbName [ cb - 1 ] );
ulEnd <<= 8;
cb -= 1;
}
cul = cb / 4;
lpulName = lpbName;
for ( iul = 0; iul < cul; iul++ ) {
ulSum ^= dwrd_toupper(lpulName[iul]);
_lrotl ( ulSum, 4 );
}
ulSum ^= ulEnd;

The hash bucket number is derived from ulSum, by taking the modulo of ulSum with the total
number of hash buckets.

The format of the table is as follows:

2
2
4n

cHash(n)
Alignment
Hash Table[n]

4n

Bucket Counts[n]

8m

Chain table[m]

Number of hash buckets.

Filler to preserve alignment.
Each ulong entry is a file offset from the beginning of
the chain table to the first chain item for each hash
bucket.
Each ulong entry is the count of items in the chain for
each hash bucket.
Each entry is a pair of dwords. The first dword is the
file offset of the referenced symbol from the
beginning of the symbols. The second dword is the
checksum of the referenced symbol generated by the
above algorithm.

n = the number of hash buckets.

m = the number of symbols (with names) = the number of entries in the chain table.
Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

79

Microsoft Symbol and Type Information

Address sort table (addrhash == 12):

The address sort table is a grouping of logical segments (or sections) in which each symbol
reference within the segment/section is sorted by its segment/section relative offset.

The format of the table is as follows:

2
2
4n

cSeg(n)
Alignment
Segment Table[n]

4n

Offset Counts[n]

8m

Offset Table[m]

Number of logical segments/sections.

Filler to preserve alignment.
Each ulong entry is a file offset from the beginning of
the offset table to the first offset item for each
segment/section.
Each ulong entry is the count of items in the offset
table for each segment.
Each entry is a pair of dwords. The first dword is the
file offset of the referenced symbol from the
beginning of the symbols. The second dword is the
segment/section relative offset of the referenced
symbol in memory.

n = the number of segments/sections.

m = the number of symbols (with addresses) = the number of entries in the offset table.

80

Formats Specification for Windows

Version 1.0

Tool Interface Standards (TIS)

Microsoft Symbol and Type Information

Tool Interface Standards (TIS)

Formats Specification for Windows

Version 1.0

81