Microsoft KB Archive/74951

{|
 * width="100%"|

How to Remove CodeView Symbolic Data from an .EXE or DLL

 * }

Q74951

-

The information in this article applies to:


 * Microsoft CodeView for MS-DOS
 * Microsoft CodeView for OS/2
 * Microsoft CodeView for Windows

-

SUMMARY
The standard method for removing CodeView symbolic debugging information from an executable file (.EXE) or a dynamic-link library (DLL) file is to relink the .OBJ files without specifying the /CO (CodeView) option, but in some cases it may be desirable to remove the CodeView data without relinking.

As demonstrated below, this can be done by writing a small program to remove the CodeView debug information, since this information is appended to the end of a file and does not interfere in any way with the preceding .EXE or DLL file contents.

MORE INFORMATION
Any file that contains CodeView information can be identified by a special signature and a file offset in the last 8 bytes of the file. The signature is the first 4 of these 8 bytes and consists of &quot;NB&quot; followed by a 2-digit ASCII number corresponding to the .EXE format produced by the version of the LINK that was used.

The next 4 bytes after the signature contain a long value representing the negative offset from the end of the file where the CodeView symbols actually start. The signature at the end of the file is also repeated at the beginning of the appended CodeView data in order to provide verification that the file does indeed contain CodeView symbolic information.

The sample program below removes CodeView symbolic data from an .EXE by executing the following steps. If any step is unsuccessful, the program halts and produces an appropriate message.


 * 1) Check for the CodeView signature 8 bytes from the end of the file.
 * 2) Extract the offset value for the symbolic information from the last 4 bytes of the file and compute the offset of the symbolic data.
 * 3) Move to that file location and check for a matching CodeView signature.
 * 4) Truncate the file at that point.

For further information on the format and signatures used for CodeView 3.x debugging information, see Section 3.3 on page 44 of the &quot;Microsoft C Developer's Toolkit Reference,&quot; which is included in the Microsoft Developer's Toolkit (product number 048-044-060).

Sample Code
/* Compile options needed: none


 * 1) include 
 * 2) include 
 * 3) include 
 * 4) include 

int main(int argc, char *argv[]) {  FILE *fptr; unsigned long cvsize = 0L, filesize; int fhandle; char cv_sig1[5], cv_sig2[5];

// get filename argument from command line and open it  if (argc < 2) {     printf(&quot;\nUsage: %s \n\n&quot;, argv[0]); return 1; }

if ((fptr = fopen(argv[1], &quot;rb+&quot;)) == NULL) {     printf(&quot;\nUnable to open file: %s\n\n&quot;, argv[1]); return 1; }

// get handle to the file and determine file size fhandle = fileno(fptr); filesize = filelength(fhandle);

// go to the last 8 bytes in the file and read the signature fseek(fptr, (long)(filesize - 8), SEEK_SET); fread(cv_sig1, sizeof(char), 4, fptr); cv_sig1[4] = '\0';

// verify that the signature is valid if (!(cv_sig1[0] == 'N' && cv_sig1[1] == 'B')) {     printf(&quot;\n%s contains no CodeView symbols\n\n&quot;, argv[1]); return 1; }

// read the symbol table offset fread(&cvsize, sizeof(long), 1, fptr);

// go to the start of the symbol table and read the signature fseek(fptr, (long)(filesize - cvsize), SEEK_SET); fread(cv_sig2, sizeof(char), 4, fptr); cv_sig2[4] = '\0';

// compare the two signatures if (strcmp(cv_sig1, cv_sig2) != 0) {     printf(&quot;\nSignature Cross Match Failed on %s!\n\n&quot;, argv[1]); return 1; }

// truncate the file, since all tests have been successful chsize(fhandle, (long)(filesize - cvsize)); fclose(fptr); printf(&quot;\nCodeView information successfully removed from %s!\n\n&quot;,         argv[1]); return 0; } Additional query words: kbinf 2.20 3.00 3.50 4.00 4.10

Keywords : kb16bitonly

Issue type :

Technology : kbAudDeveloper kbCodeView kbZNotKeyword3