{"id":3138,"date":"2015-07-30T04:41:41","date_gmt":"2015-07-30T04:41:41","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3138"},"modified":"2017-03-28T23:08:01","modified_gmt":"2017-03-28T23:08:01","slug":"gctl-debug-section-in-windows-10-binaries","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/07\/30\/gctl-debug-section-in-windows-10-binaries\/","title":{"rendered":"GCTL debug section in Windows 10 binaries"},"content":{"rendered":"

Update<\/strong><\/p>\n

Recently I got a message from Axel S. (Thanks!) who explains that:<\/p>\n

It’s emitted by the linker in Visual Studio 2015 and later. The linker calls it “COFF group information” and you can prevent this directory from being emitted by specifying the additional linker option \/nocoffgrpinfo.<\/p>\n

He also provided a syntax for link.exe that can be used to dump the data from an executable:<\/p>\n

link \/dump \/headers \/coffgroup <file><\/pre>\n
The below example is for Notepad.exe from Windows 10:<\/p>\n
POGO Phase<\/tt>
\n<\/tt>
\n<\/tt>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RVA\u00a0\u00a0\u00a0\u00a0 Size\u00a0 Name<\/tt>
\n<\/tt>\u00a0 -------- --------\u00a0 ----<\/tt>
\n<\/tt>\u00a0 00001000\u00a0\u00a0\u00a0\u00a0\u00a0 328\u00a0 .rdata$brc<\/tt>
\n<\/tt>\u00a0 00001328\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0 .CRT$XCA<\/tt>
\n<\/tt>\u00a0 0000132C\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0 .CRT$XCAA<\/tt>
\n<\/tt>\u00a0 00001330\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10\u00a0 .CRT$XCU<\/tt>
\n<\/tt>\u00a0 00001340\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0 .CRT$XCZ<\/tt>
\n<\/tt>\u00a0 00001344\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0 .CRT$XIA<\/tt>
\n<\/tt>\u00a0 00001348\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0 .CRT$XIAA<\/tt>
\n<\/tt>\u00a0 0000134C\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0 .CRT$XIY<\/tt>
\n<\/tt>\u00a0 00001350\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0 .CRT$XIZ<\/tt>
\n<\/tt>\u00a0 00001354\u00a0\u00a0\u00a0\u00a0\u00a0 15C\u00a0 .cfguard<\/tt>
\n<\/tt>\u00a0 000014B0\u00a0\u00a0\u00a0\u00a0 2FE0\u00a0 .rdata<\/tt>
\n<\/tt>\u00a0 00004490\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 8\u00a0 .rdata$sxdata<\/tt>
\n<\/tt>\u00a0 00004498\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10\u00a0 .rdata$zETW0<\/tt>
\n<\/tt>\u00a0 000044A8\u00a0\u00a0\u00a0\u00a0\u00a0 3BB\u00a0 .rdata$zETW1<\/tt>
\n<\/tt>\u00a0 00004863\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 38\u00a0 .rdata$zETW2<\/tt>
\n<\/tt>\u00a0 0000489B\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1\u00a0 .rdata$zETW9<\/tt>
\n<\/tt>\u00a0 0000489C\u00a0\u00a0\u00a0\u00a0\u00a0 2D0\u00a0 .rdata$zzzdbg<\/tt>
\n<\/tt>\u00a0 00004B6C\u00a0\u00a0\u00a0\u00a0\u00a0 1C6\u00a0 .text<\/tt>
\n<\/tt>\u00a0 00004D32\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6E\u00a0 .text$di<\/tt>
\n<\/tt>\u00a0 00004DA0\u00a0\u00a0\u00a0 16172\u00a0 .text$mn<\/tt>
\n<\/tt>\u00a0 0001AF12\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 20\u00a0 .text$x<\/tt>
\n<\/tt>\u00a0 0001AF32\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 76\u00a0 .text$yd<\/tt>
\n<\/tt>\u00a0 0001AFA8\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 FC\u00a0 .xdata$x<\/tt>
\n<\/tt>\u00a0 0001C000\u00a0\u00a0\u00a0\u00a0\u00a0 180\u00a0 .data$brc<\/tt>
\n<\/tt>\u00a0 0001C180\u00a0\u00a0\u00a0\u00a0\u00a0 660\u00a0 .data<\/tt>
\n<\/tt>\u00a0 0001C7E0\u00a0\u00a0\u00a0\u00a0 1EC4\u00a0 .bss<\/tt>
\n<\/tt>\u00a0 0001F000\u00a0\u00a0\u00a0\u00a0\u00a0 4B4\u00a0 .idata$5<\/tt>
\n<\/tt>\u00a0 0001F4B4\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0 .00cfg<\/tt>
\n<\/tt>\u00a0 0001F4B8\u00a0\u00a0\u00a0\u00a0\u00a0 230\u00a0 .idata$2<\/tt>
\n<\/tt>\u00a0 0001F6E8\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 14\u00a0 .idata$3<\/tt>
\n<\/tt>\u00a0 0001F6FC\u00a0\u00a0\u00a0\u00a0\u00a0 4B4\u00a0 .idata$4<\/tt>
\n<\/tt>\u00a0 0001FBB0\u00a0\u00a0\u00a0\u00a0 14A4\u00a0 .idata$6<\/tt>
\n<\/tt>\u00a0 00022000\u00a0\u00a0\u00a0\u00a0\u00a0 530\u00a0 .rsrc$01<\/tt>
\n<\/tt>\u00a0 00022530\u00a0\u00a0\u00a0 197B0\u00a0 .rsrc$02<\/tt>
\n<\/tt><\/p>\n
Update<\/strong><\/p>\n
Okay, so after googling around I think I figured it out – the section is actually called LTCG (read it backwards \ud83d\ude42 and is related to Link Time Code Generation and Profile Guided Optimization (PGO or pogo<\/a>):<\/p>\n
Link Time Code Generation (AKA Whole Program Optimization) produces better code quality as we have additional whole program optimization to further optimize the code leveraging the bigger picture of the entire program that is only available during LTCG. LTCG is great for code quality, and it\u2019s the foundation for Pogo; however throughput is its downside and developers today have to wait for full clean LTCG build times even on making trivial edits. This often kills the popularity of this feature and developers today are forced away to throw these extra performance improvements away in favor of productivity.<\/p>\n
– as explained here<\/a>. Still don’t know what is a full meaning of the data, but hopefully structures are already documented somewhere.<\/p>\n
Here is how latest winedump ‘sees’ the file:<\/p>\n
Debug Table (2 directories)\r\nDirectory 01\r\n\u00a0 Characteristics:\u00a0\u00a0 00000000\r\n\u00a0 TimeDateStamp:\u00a0\u00a0\u00a0\u00a0 559F3C62 Fri Jul 10 11:30:42 2015\r\n\u00a0 Version\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.00\r\n\u00a0 Type:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2 (CODEVIEW)\r\n\u00a0 SizeOfData:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 37\r\n\u00a0 AddressOfRawData:\u00a0 000016A4\r\n\u00a0 PointerToRawData:\u00a0 00000AA4\r\n\u00a0\u00a0\u00a0 CodeView Data\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 Signature:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RSDS\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 Guid:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 {401da8a1-859a-4c87-a389-dbddda54527d}\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 Age:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 00000001\r\n\u00a0\u00a0\u00a0\u00a0\u00a0 Filename:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 DirectDB.pdb\r\n\r\nDirectory 02\r\n\u00a0 Characteristics:\u00a0\u00a0 00000000\r\n\u00a0 TimeDateStamp:\u00a0\u00a0\u00a0\u00a0 559F3C62 Fri Jul 10 11:30:42 2015\r\n\u00a0 Version\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.00\r\n\u00a0 Type:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 13 (POGO)\r\n\u00a0 SizeOfData:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 432\r\n\u00a0 AddressOfRawData:\u00a0 000016E0\r\n\u00a0 PointerToRawData:\u00a0 00000AE0<\/pre>\n
Older post<\/strong><\/p>\n
While looking at the Windows 10 binaries I noticed it contains an extra debug section marked as ‘GCTL’. I don’t know what is the purpose of it and after asking on Twitter Reversing on Windows<\/a> suggested it could be “Garbage Collection Table “.<\/p>\n
Any ideas?<\/p>\n
Here are some details from the 32-bit Windows:<\/p>\n
Example debug section from “\\Program Files\\Common Files\\System\\DirectDB.dll” as seen by Lord PE:<\/p>\n
\"GCTL1\"<\/a>and<\/p>\n
 <\/p>\n
\"GCTL2\"<\/a>Update:<\/strong><\/p>\n
The type is 0xD – 13 –\u00a0 the largest \u00a0IMAGE_DEBUG_TYPE_xxx constant I could find documented in SDK is 11 (IMAGE_DEBUG_TYPE_CLSID, but I came across the new types added to wine<\/a> in May 2015:<\/p>\n
IMAGE_DEBUG_TYPE_VC_FEATURE\u00a0\u00a0\u00a0 12\r\nIMAGE_DEBUG_TYPE_POGO\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 13 <-this is our guy\r\nIMAGE_DEBUG_TYPE_ILTCG\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 14\r\nIMAGE_DEBUG_TYPE_MPX\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 15<\/pre>\n
Older post<\/strong><\/p>\n
The hexadecimal dump of a part of the file storing 2 debug sections:<\/p>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F\u00a0\u00a0 0123456789ABCDEF\r\n--------------------------------------------------------------------------------\r\n00AA0 : 30 60 00 00 52 53 44 53 A1 A8 1D 40 9A 85 87 4C\u00a0\u00a0 0`..RSDS...@...L 2720\r\n00AB0 : A3 89 DB DD DA 54 52 7D 01 00 00 00 44 69 72 65\u00a0\u00a0 .....TR}....Dire 2736\r\n00AC0 : 63 74 44 42 2E 70 64 62 00 00 00 00 00 00 00 00\u00a0\u00a0 ctDB.pdb........ 2752\r\n00AD0 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\u00a0\u00a0 ................ 2768\r\n00AE0 : 47 43 54 4C 00 10 00 00 04 00 00 00 2E 43 52 54\u00a0\u00a0 GCTL.........CRT 2784\r\n00AF0 : 24 58 43 41 00 00 00 00 04 10 00 00 04 00 00 00\u00a0\u00a0 $XCA............ 2800\r\n00B00 : 2E 43 52 54 24 58 43 5A 00 00 00 00 08 10 00 00\u00a0\u00a0 .CRT$XCZ........ 2816\r\n00B10 : 04 00 00 00 2E 43 52 54 24 58 49 41 00 00 00 00\u00a0\u00a0 .....CRT$XIA.... 2832\r\n00B20 : 0C 10 00 00 04 00 00 00 2E 43 52 54 24 58 49 41\u00a0\u00a0 .........CRT$XIA 2848\r\n00B30 : 41 00 00 00 10 10 00 00 04 00 00 00 2E 43 52 54\u00a0\u00a0 A............CRT 2864\r\n00B40 : 24 58 49 5A 00 00 00 00 14 10 00 00 00 01 00 00\u00a0\u00a0 $XIZ............ 2880\r\n00B50 : 2E 67 66 69 64 73 24 78 00 00 00 00 20 11 00 00\u00a0\u00a0 .gfids$x.... ... 2896\r\n00B60 : 80 05 00 00 2E 72 64 61 74 61 00 00 A0 16 00 00\u00a0\u00a0 .....rdata...... 2912\r\n00B70 : 04 00 00 00 2E 72 64 61 74 61 24 73 78 64 61 74\u00a0\u00a0 .....rdata$sxdat 2928\r\n00B80 : 61 00 00 00 A4 16 00 00 EC 01 00 00 2E 72 64 61\u00a0\u00a0 a............rda 2944\r\n00B90 : 74 61 24 7A 7A 7A 64 62 67 00 00 00 90 18 00 00\u00a0\u00a0 ta$zzzdbg....... 2960\r\n00BA0 : 1E 4A 00 00 2E 74 65 78 74 24 6D 6E 00 00 00 00\u00a0\u00a0 .J...text$mn.... 2976\r\n00BB0 : B0 62 00 00 04 01 00 00 2E 78 64 61 74 61 24 78\u00a0\u00a0 .b.......xdata$x 2992\r\n00BC0 : 00 00 00 00 C0 63 00 00 6B 00 00 00 2E 65 64 61\u00a0\u00a0 .....c..k....eda 3008\r\n00BD0 : 74 61 00 00 00 70 00 00 20 00 00 00 2E 64 61 74\u00a0\u00a0 ta...p.. ....dat 3024\r\n00BE0 : 61 00 00 00 20 70 00 00 98 03 00 00 2E 62 73 73\u00a0\u00a0 a... p.......bss 3040\r\n00BF0 : 00 00 00 00 00 80 00 00 10 01 00 00 2E 69 64 61\u00a0\u00a0 .............ida 3056\r\n00C00 : 74 61 24 35 00 00 00 00 10 81 00 00 04 00 00 00\u00a0\u00a0 ta$5............ 3072\r\n00C10 : 2E 30 30 63 66 67 00 00 14 81 00 00 8C 00 00 00\u00a0\u00a0 .00cfg.......... 3088\r\n00C20 : 2E 69 64 61 74 61 24 32 00 00 00 00 A0 81 00 00\u00a0\u00a0 .idata$2........ 3104\r\n00C30 : 14 00 00 00 2E 69 64 61 74 61 24 33 00 00 00 00\u00a0\u00a0 .....idata$3.... 3120\r\n00C40 : B4 81 00 00 10 01 00 00 2E 69 64 61 74 61 24 34\u00a0\u00a0 .........idata$4 3136\r\n00C50 : 00 00 00 00 C4 82 00 00 90 04 00 00 2E 69 64 61\u00a0\u00a0 .............ida 3152\r\n00C60 : 74 61 24 36 00 00 00 00 00 90 00 00 58 00 00 00\u00a0\u00a0 ta$6........X... 3168\r\n00C70 : 2E 72 73 72 63 24 30 31 00 00 00 00 60 90 00 00\u00a0\u00a0 .rsrc$01....`... 3184\r\n00C80 : A8 03 00 00 2E 72 73 72 63 24 30 32 00 00 00 00\u00a0\u00a0 .....rsrc$02.... 3200<\/pre>\n
Strings – they all look like section names:<\/p>\n