The symbol table lists the names the object defines and the ones it needs. It starts at the file header’s PointerToSymbolTable and has NumberOfSymbols records of 18 bytes each. A record may be followed by auxiliary records, which are the same size and count towards NumberOfSymbols, so a relocation’s symbol index can point past them.
The symbol record
IMAGE_SYMBOL, 18 bytes:
0Name: 8 bytes, or 4 zero bytes and a string table offset8 bytes8Value4 bytes12SectionNumber2 bytes14Type2 bytes16StorageClass1 byte17NumberOfAuxSymbols1 byte
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 8 | Name | A name of up to 8 bytes, padded with zero bytes. A longer one is written as 4 zero bytes and a 4-byte offset into the string table. |
| 8 | 4 | Value | Its meaning depends on the storage class. For a symbol in a section it is the symbol’s offset there; for a common symbol, its size; for .file, 0. |
| 12 | 2 | SectionNumber | A signed number: the section the symbol is defined in, counted from 1; or one of the special values below. |
| 14 | 2 | Type | Microsoft’s tools write only 0x00 or 0x20 (a function). The original format had a base type in the low 4 bits and a derived type above them. |
| 16 | 1 | StorageClass | What kind of symbol it is; see Storage classes. |
| 17 | 1 | NumberOfAuxSymbols | How many auxiliary records follow. |
| SectionNumber | Meaning |
|---|---|
0 | UNDEFINED: an external. A non-zero Value makes it a common symbol of that size. |
−1 | ABSOLUTE: Value is a constant, not an address |
−2 | DEBUG: debugging information only |
Storage classes
| Value | Constant | Meaning |
|---|---|---|
| 2 | IMAGE_SYM_CLASS_EXTERNAL | Visible outside the file; defined here when SectionNumber is positive, otherwise needed from elsewhere |
| 3 | IMAGE_SYM_CLASS_STATIC | Local to this file; a section’s name symbol has this class |
| 6 | IMAGE_SYM_CLASS_LABEL | A code label |
| 101 | IMAGE_SYM_CLASS_FUNCTION | The .bf, .lf and .ef records that frame a function’s line numbers |
| 103 | IMAGE_SYM_CLASS_FILE | The .file record that names the source file |
| 105 | IMAGE_SYM_CLASS_WEAK_EXTERNAL | A weak external |
| 107 | IMAGE_SYM_CLASS_CLR_TOKEN | A .NET token symbol |
The specification also defines values from 0 (NULL) and 1 (AUTOMATIC) up to 0xFF (END_OF_FUNCTION) that Microsoft’s tools do not write.
Auxiliary record formats
Each is one record the size of a symbol. Its layout depends on the symbol before it.
Section definition
After a section’s name symbol (STATIC, Value 0):
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 4 | Length | The size of the section’s data |
| 4 | 2 | NumberOfRelocations | The number of relocations |
| 6 | 2 | NumberOfLinenumbers | The number of line numbers |
| 8 | 4 | CheckSum | A checksum of the contents, used for COMDAT |
| 12 | 2 | Number | For an associative COMDAT, the section it goes with |
| 14 | 1 | Selection | The COMDAT selection number |
| 15 | 3 | Unused |
Function definition
After a function (EXTERNAL, Type 0x20, in a section):
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 4 | TagIndex | The symbol index of the function’s .bf record |
| 4 | 4 | TotalSize | The size of the code |
| 8 | 4 | PointerToLinenumber | The file offset of the function’s line numbers, or 0 |
| 12 | 4 | PointerToNextFunction | The symbol index of the next function, or 0 |
| 16 | 2 | Unused |
.bf and .ef records
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 4 | Unused | |
| 4 | 2 | Linenumber | The source line, from 1 |
| 6 | 6 | Unused | |
| 12 | 4 | PointerToNextFunction | In .bf only: the symbol index of the next .bf, or 0 |
| 16 | 2 | Unused |
Weak external
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 4 | TagIndex | The symbol index of the fallback definition |
| 4 | 4 | Characteristics | 1 SEARCH_NOLIBRARY, 2 SEARCH_LIBRARY, 3 SEARCH_ALIAS |
| 8 | 10 | Unused |
File name
After a .file record: 18 bytes of file name, padded with zero bytes. A longer name continues in the next auxiliary record.
CLR token
| Offset | Size | Field | Meaning |
|---|---|---|---|
| 0 | 1 | bAuxType | Must be 1 |
| 1 | 1 | bReserved | Reserved, 0 |
| 2 | 4 | SymbolTableIndex | The symbol this token is for |
| 6 | 12 | Reserved | Reserved |
The string table
It comes immediately after the symbol table, at the offset PointerToSymbolTable plus 18 times NumberOfSymbols. It starts with a 4-byte size, counting those 4 bytes: an empty table has the value 4. The strings follow, each ending with a zero byte. A long symbol name or section name holds an offset from the start of this table, so the first string is at offset 4.