The bigobj header is a structure Microsoft’s winnt.h calls ANON_OBJECT_HEADER_BIGOBJ. It is 56 bytes, all little-endian.
ANON_OBJECT_HEADER_BIGOBJ
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 2 | Sig1 | 0: IMAGE_FILE_MACHINE_UNKNOWN |
| 2 | 2 | Sig2 | 0xFFFF |
| 4 | 2 | Version | The version; 2 or more for a bigobj |
| 6 | 2 | Machine | The processor, as in the COFF machine values: 0x8664 for x64, 0x14C for x86, 0xAA64 for ARM64 |
| 8 | 4 | TimeDateStamp | Seconds since 1970, or a hash in a reproducible build |
| 12 | 16 | ClassID | D1BAA1C7-BAEE-4BA9-AF20-FAF66AA4DCB8, stored as the bytes C7 A1 BA D1 EE BA A9 4B AF 20 FA F6 6A A4 DC B8 |
| 28 | 4 | SizeOfData | Not used by a bigobj; 0 |
| 32 | 4 | Flags | Bit 0: the object holds metadata |
| 36 | 4 | MetaDataSize | 0 here |
| 40 | 4 | MetaDataOffset | 0 here |
| 44 | 4 | NumberOfSections | How many entries the section table has |
| 48 | 4 | PointerToSymbolTable | The file offset of the symbol table |
| 52 | 4 | NumberOfSymbols | How many 20-byte records it has, counting the auxiliary records |
The section table starts at offset 56, with no optional header.
Telling the anonymous headers apart
The first four bytes, 00 00 FF FF, are shared with other Microsoft
formats. A reader looks at the version and the class identifier:
| Version | Class identifier | Format |
|---|---|---|
| 0 | none | Short import object |
| 2 or more | The value above | Bigobj |
| 1 or more | Another value | Anonymous object |
Sections and relocations
Each section has a 40-byte entry in the section table, and its relocations are 10 bytes each: the same layout as in a classic COFF object file. A long section name is written as a slash and a decimal offset into the string table. Section numbers in the symbol table are 32 bits wide here, which is what allows more than 65,279 sections.