Header

The PDB begins with a header, consisting of:

• Signature, used to identify and validate the specific format. The length of the signature varies with the specific format.
• The remainder of the header varies with the format identified by the signature.

The header may be longer than a single page.

Microsoft tools use two PDB formats:

Version 7

Signature is "Microsoft C/C++ MSF 7.00\r\n\x1ADS\0\0\0"(32 bytes).

Remainder of the header consists of:

• Page size, 4 bytes.
• Allocation table pointer, 4 bytes. The meaning of this is unknown. There appears to be an allocation table, an array of 65,536 bits (8,192 bytes), located at the end of the PDB, and a 1-bit means a page that is not being used.
• Number of file pages, 4 bytes.
• Root stream size, 4 bytes.
• reserved, 4 bytes.
• Page number of the Root stream page number list. It does not indicate the location of the Root stream itself, only of the page containing the structure which points to its pages. At that page, the Root stream page number list indicates the pages where the Root stream is stored. It contains 4 bytes per page, enough to cover the above Root stream size.

Root stream

The root stream describes all of the PDB streams starting with stream 0. Its contents vary with the PDB format version.

Stream contents

Microsoft tools store different sorts of information in different numbered streams. Some stream numbers have a fixed information type associated with them, and other streams are identified in the aforementioned fixed type streams.

Stream 1 is used to verify that the PDB is the same file referred to in an executable or object file stream.

• Version, 4 bytes.
• Time date stamp, 4 bytes.
• Age, 4 bytes. This is the number of times this PDB has been modified since its creation.
• GUID, 16 bytes.
• Total length of following names, 4 bytes. Followed by null-terminated character strings.

Stream 2 and stream 4 hold types information. Actual type records define types used in the program. The structure of these records can be found in the file cvinfo.h provided by Microsoft. There are two flavors of records, each with its own set of index numbers: type IDs and types; only types are stored in stream 2 and only type IDs are stored in stream 4. The indices are used to refer to these records from within symbol records and other type records.

• A header:
  • Version, 4 bytes.
  • Header size, 4 bytes.
  • Minimum and maximum (last + 1) index for type records (4 bytes each).
  • Size of following data, 4 bytes, to the end of the stream.
• Hash information:
  • Stream number, 2 bytes with 2 bytes padding.
  • Hash key, 4 bytes.
  • Buckets, 4 bytes.
  • HashVals, TiOff, and HashAdj, each composed of an offset and length, each 4 bytes.
• Type records, variable length, count = (maximum - minimum) from above header.

Stream 3 is a directory for other streams. Note, it is not present in Version 2, nor in a PDB produced by a compiler. The stream starts with a header which is padded to be 64 bytes in total

   union {
       struct {
           USHORT      usVerPdbDllMin : 8; // minor version and
           USHORT      usVerPdbDllMaj : 7; // major version and
           USHORT      fNewVerFmt     : 1; // flag telling us we have rbld stored elsewhere (high bit of original major version)
       } vernew;                           // that built this pdb last.
       struct {
           USHORT      usVerPdbDllRbld: 4;
           USHORT      usVerPdbDllMin : 7;
           USHORT      usVerPdbDllMaj : 5;
       } verold;
       USHORT          usVerAll;
   };

   struct _flags {
       USHORT  fIncLink:1;     // true if linked incrmentally (really just if ilink thunks are present)
       USHORT  fStripped:1;    // true if PDB::CopyTo stripped the private data out
       USHORT  fCTypes:1;      // true if this PDB is using CTypes.
       USHORT  unused:13;      // reserved, must be 0.
   } flags;

• Module information, variable length. Total size in above header. There is one of these for each object module used by the linker
  • Opened, 4 bytes.
  • Symbol info.
    • Section number, 2 bytes + 2 bytes padding.
    • Offset and size, 4 bytes each.
    • Flags, 4 bytes.
    • Module number, 2 bytes + 2 bytes padding.
    • CRCs for section data and relocations data, 4 bytes each.
  • Flags, 2 bytes.
  • Stream number, 2 bytes.
  • Symbols size, 4 bytes.
  • Old and new line number info sizes, 4 bytes each.
  • Number of source files, 2 bytes + 2 bytes padding.
  • Offsets, 4 bytes.
  • niSource and niCompiler, 4 bytes each.
  • Module name, null terminated byte string.
  • Object name, null terminated byte string.
  • Padding to multiple of 4 bytes.
• Section contributions, section headers, file info, ts map, and EC info. Their sizes are found in the above header.
• Debug header,
  • Stream numbers for Old Frame Pointer Omission, Exceptions, Fixups, Object Maps to and from Source, Section Headers, Token Ring IDs, Xdata, Pdata, New Frame Pointer Omission, and Section Header Origin. 2 bytes each.