Borland symbol data explained.

Info retrieved from Turbo Dump 5.0.16.12 and 'Visual C++ 5.0 Symbolic Debug Information Specification'.
If you don't understand something read 'Visual C++ 5.0 Symbolic Debug Information Specification' and if
you don't understand even then, well mail me.

When new TDUMP comes out I'll try to complete this text.
Another thing, this is only for PE type programs. If someone needs this text for 16bit mail me and I'll send you
IDA4's TDUMP files.

mail: mostekaccess@mailcity.com

NOTICE!
Not all are explained (at this time) because some are not needed for sufficient Borland TASM debug info.

-------------------------------------------------------------------------------------------------------
General Format of Symbol Records

offset  size     name
0       SHORT    lenght
2       SHORT    index
4       *        data

length - Length of record, excluding the length field.
index - Type of symbol.
data - Data specific to each symbol format(explained in 'Symbol Indices Explained.txt').


Symbol Indices
0x0001    S_COMPILE      Compile flags symbol
0x0002    S_REGISTER     Register variable
0x0003    S_CONSTANT     Constant symbol
0x0004    S_UDT          User-defined type
0x0005    S_SSEARCH      Start search
0x0006    S_END          End block, procedure, with, or thunk
0x0007    S_SKIP         Skip - Reserve symbol space
0x0008    S_CVRESERVE    Reserved for CodeView internal use
0x0009    S_OBJNAME      Specify name of object file
0x000A    S_NAMESPACE    ?
0x000B    S_USING        ?

0x0020    S_GPROCREF     Global reference to a procedure
0x0021    S_GDATAREF     Global reference to data
0x0022    S_EDATA        ?
0x0023    S_EPROC        ?
0x0024    S_USES         ?
0x0025    S_NAMESPACE_   ?
0x0026    S_USING_       ?
0x0027    S_PCONSTANT    ?

If X=1 => 16bit variable, if X=2 => 32bit variable.
0x0X00    S_BPREL        BP relative 16:(16 or 32)
0x0X01    S_LDATA        Local data 16:(16 or 32)
0x0X02    S_GDATA        Global data 16:(16 or 32)
0x0X03    S_PUB          Public symbol 16:(16 or 32)
0x0X04    S_LPROC        Local procedure start 16:(16 or 32)
0x0X05    S_GPROC        Global procedure start 16:(16 or 32)
0x0X06    S_THUNK        Thunk start 16:(16 or 32)
0x0X07    S_BLOCK        Block start 16:(16 or 32)
0x0X08    S_WITH         With start 16:(16 or 32)
0x0X09    S_LABEL        Label 16:(16 or 32)
0x0X0A    S_CEXMODEL     Change execution model 16:(16 or 32)
0x0X0B    S_VFPATH       probably! Virtual function table path descriptor 16:(16 or 32)

0x0X10    S_ENTRY        ?
0x0X11    S_OPTVAR       ?
0x0X12    S_PROCRET      ?
0x0X13    S_SAVREGS      ?

0x0X30    S_SLINK        ?

-------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------
(0x0001)  S_COMPILE      Compile Flag

This symbol communicates to CodeView compile time information on a per module basis,
such as the language and version number of the language processor,
the ambient model for code and data, and the target processor. 

offset  size     name
0       SHORT    lenght(6h)
2       SHORT    S_SSEARCH
=>(Data specific to each symbol format)

4       BYTE     machine
5       BYTE     language
6       BYTE     flags1
7       BYTE     flags2
8       *        version   //normaly not present

**************************************************
machine - enumeration specifying target processor.  Values not specified below are reserved.
0x00    Intel 8080
0x01    Intel 8086
0x02    Intel 80286
0x03    Intel 80386
0x04    Intel 80486
0x05    Intel Pentium
0x06    Intel Pentium Pro

**************************************************
language  - language enumeration.
0       C
1       C++
2       Fortran
3       Tasm, Masm (in reality Assembly Language)
4       Pascal
5       Basic
6       Cobol
7 - 255    Reserved


**************************************************
flags1,2 - flags showing compile time options (bit flags(1=yes, 0=no)).

flags1
offset(bit)    size   name
0(1.bit)       1bit   PCodePresent
1(2.bit)       2bit   FloatPrecision
3(4.,5.bit)    2bit   FloatPackage
5(6.,7.,8bit)  3bit   Ambient Data

PCodePresent - 1 yes, 0 no
FloatPrecision - Ansi_floating_code(01)/Fast_floating_code(00)
                (The FloatPrecision flag is set to 1 if the compiler follows the ANSI C floating point precision rules.)
FloatPackage - Altmath(10)/Emulator(01)/Hardware_processor(00)
AmbientData - Huge(010)/Far(001)/Near(000)

flags2
offset(bit)    size   name
0(1.,2.,3.bit) 3bit   AmbientCode
3(4.bit)       1bit   Mode32
4(5.bit)       1bit   charSign
5(6.,7.,8.bit) 3bit   Reserved

AmbientCode - Huge(010)/Far(001)/Near(000)
Mode32 - 32 bit addresses(1) (in tasm this bit is set to 0)   (Compiled for 32bit addresses.)
charSign - Char_is_signed(1)/Char_is_unsigned(0)

Floating package enumeration
0        Hardware processor (80x87 for Intel 80x86 processors)
1        Emulator
2        Altmath
3        Reserved

Ambient code and data memory model enumeration
0        Near
1        Far
2        Huge
3 - 7    Reserved

**************************************************
version - Length-prefixed string specifying language processor version.
          Language processors can place additional data in version string if desired.


-------------------------------------------------------------------------------------------------------
(0x0004)  S_UDT          User-defined type

offset  size     name
0       SHORT    lenght (12h)
2       SHORT    S_UDT
=>(Data specific to each symbol format)

4       ULONG    type
8       SHORT    flags
A       ULONG    iName
E       ULONG    browserOffset
12      SHORT    ?            //probably for natural alignment


type - Type index of the symbol.(look into 'Primitive Type Listing.txt')
flags - Don't know exactly, but is a bit constructed. (Maybe is just 1byte long and the other is just for natural alignment.)
iName - Index of string in sstNames. (1 is the first string)
browserOffset - ?

**************************************************
flags:
offset(bit)    size   name
0(1.bit)       1bit   tag(1)/typeDef(0)
1(2.bit)       1bit   nest
others         *      ?

tag/typeDef - what is a tag or typeDef
              *0157E  S_UDT  Type: 1005     tag      Nest: No  @Type_ExitProcess [004]  Browser offset: 0000  //GPROC
              *015A6  S_UDT  Type: uint32   typedef  Nest: No  POINTER [006]  Browser offset: 0000            //TYPEDEF
              *015BA  S_UDT  Type: 1003     tag      Nest: No  @Type_SetOne [007]  Browser offset: 0000       //LPROC
              *0AF3E  S_UDT  Type: 1014     tag      Nest: No  OPENFILENAMEA [28E]  Browser offset: 0000      //STRUC

nest - is type nested (maybe if label is in nested procedure??) (normaly 0)


-------------------------------------------------------------------------------------------------------
(0x0005)  S_SSEARCH      Start Search

These records are always the first symbol records in a module's sstAlignSym section.
There is one Start Search symbol for each segment (PE section) to which the module contributes code.

Each Start Search symbol contains the segment (PE section) number and offset of the record
of the outermost lexical scope in this module that physically appears first in the specified segment of the load image.

This referenced symbol is the symbol used to initiate context searches within this module.


offset  size     name
0       SHORT    lenght (12h)
2       SHORT    S_SSEARCH
=>(Data specific to each symbol format)

4       ULONG    symOff
8       SHORT    segment
A       SHORT    codeSym
C       SHORT    dataSym
E       ULONG    firstData
12      SHORT    ?            //probably for natural alignment


symOff - offset of the procedure or thunk record for this module that has the lowest offset in the specified modul(segment)
         * (symOff=S_LPROC32_dataSection-S_SSEARCH_all)
         *
         * S_LPROC32_dataSection - offset to S_LPROC32+4bytes(because we must point to 'Data specific to each symbol format')
         * S_SSEARCH_all - offset to S_SSEARCH (this means we include lenght ans symbol index too)
         *
segment - Segment (PE Section) that this Start Search refers to.

codeSym - ?
dataSym - ?
firstData - ?
?IF SOMEONE KNOWS WHAT THIS VARIABLES MEAN PLEASE LET ME KNOW.
 (Normaly they are ZERO.)


-------------------------------------------------------------------------------------------------------
(0x0006)  S_END          End of Block
Closes the scope of the nearest preceding Block Start, Global Procedure Start,
Local Procedure Start, With Start, or Thunk Start definition.

offset  size     name
0       SHORT    lenght(2h)
2       SHORT    S_END

-------------------------------------------------------------------------------------------------------
0x0020    S_GPROCREF     Global reference to a procedure

This symbol in inserted into the global and static symbol tables to reference a procedure.
It is used so that the symbol procedure can be found in the hashed search of the global or static symbol table.
Otherwise, procedures could be found only by searching the symbol table for every module.

offset  size     name
0       SHORT    lenght(1Ah)
2       SHORT    S_GROCREF
=>(Data specific to each symbol format)

4       ULONG    checksum
8       ULONG    browserOffset
C       ULONG    offset
10      ULONG    type
14      ULONG    iName
18      SHORT    segment
1A      SHORT    ?            //probably for natural alignment



checksum - Checksum of the referenced symbol name.
           Offset from lfaBase to reference in sstAlignSym.
browserOffset - ?
offset - Offset of the procedure in section defined by segment.
type - Type index of the symbol.(S_UDT)
iName - Index of string in sstNames. (1 is the first string)
segment - Segment (PE Section) of the procedure.

-------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------
0x0X00    S_BPREL        BP relative 16:(16 or 32)

NOTICE!
This text will explain 0x0200 - S_BPREL32.

his symbol specifies symbols that are allocated on the stack for a procedure.
For C/C++, these include the actual parameters to a function and the local nonstatic variables of functions.


offset  size     name
0       SHORT    lenght(12h)
2       SHORT    S_BPREL32
=>(Data specific to each symbol format)

4       ULONG    offset
8       ULONG    type
C       ULONG    iName
10      ULONG    browserOffset


offset - Signed offset relative to BP.  If offset is 0, then the symbol was assigned to a register
         or never instantiated by the optimizer and cannot be evaluated because its location is unknown.
type - Type index of the symbol.(look into 'Primitive Type Listing.txt')
iName - Index of string in sstNames. (1 is the first string)
browserOffset - ? (Normaly 0)

-------------------------------------------------------------------------------------------------------
(0x0X01)  S_LDATA        Local data 16:(16 or 32)

NOTICE!
This text will explain 0x0201 - S_LDATA32.

These symbols are used for data that is not exported from a module.
In C/C++, symbols that are declared static are emitted as Local Data symbols.

offset  size     name
0       SHORT    lenght(16h)
2       SHORT    S_LDATA32
=>(Data specific to each symbol format)

4       ULONG    offset
6       SHORT    segment
8       SHORT    flags
A       ULONG    type
E       ULONG    iName
12      ULONG    browserOffset
16      SHORT    ?            //probably for natural alignment



offset - Offset of the symbol in specified segment
* ex.
* One  DWORD ? ;LOCAL
* Two  DWORD ? ;LOCAL
* Three DWORD ? ; GLOBAL
* Four DWORD ? ;LOCAL
*
* offsets in S_LDATA32 will be 0, 4, C, when offset in S_GDATA32 will be 8
*
segment - segment where symbol is defined(in PE 1 or 2 or 3 or ... (normaly CODE=1, DATA=2))
flags - don't know (normaly 0)
type - Type index of the symbol.(look into 'Primitive Type Listing.txt')
iName - Index of string in sstNames. (1 is the first string)
browserOffset - don't know (normaly 0)
-------------------------------------------------------------------------------------------------------
0x0X02    S_GDATA        Global data 16:(16 or 32)

Same as S_LDATA
-------------------------------------------------------------------------------------------------------
0x0X03    S_PUB          Public symbol 16:(16 or 32)

Same as S_LDATA
-------------------------------------------------------------------------------------------------------
0x0X04    S_LPROC        Local procedure start 16:(16 or 32)

NOTICE!
This text will explain 0x0209 - S_LPROC32.

This symbol record defines local (file static) procedure definition.
For C/C++, functions that are declared static to a module are emitted as Local Procedure symbols.
Functions not specifically declared static are emitted as Global Procedures.

offset  size     name
0       SHORT    lenght (2Eh)
2       SHORT    S_LPROC32
=>(Data specific to each symbol format)

4       ULONG    pParent
8       ULONG    pEnd
C       ULONG    pNext

10      ULONG    procLenght
14      ULONG    debugStart
18      ULONG    debugEnd
1C      ULONG    procOffset

20      SHORT    segment
22      SHORT    ?       //probably some flags
24      ULONG    procType
28      ULONG    iName
2C      ULONG    browserOffset

!NOTICE
For next 3 variables read 'Lexical scope linkage'. It talks about nested procedures and ....

pParent -If the scope is not enclosed by another lexical scopes, then pParent is zero.
         Otherwise, the parent of this scope is the symbol (within this module)
         that opens the outer scope (that encloses this scope) but  encloses no other scope that encloses this scope.
         The pParent field contains the offset from the begining of the module's symbol table
         of the symbol that opens the enclosing lexical scope.
         *ex.
         *
         *ZERO = not nested
         *NOTZERO = The pParent field contains the offset from the begining of the module's symbol table
         *          of the symbol that opens the enclosing lexical scope.
         *          (read S_SSEARCH symOff and mybe something will become clearer)

pEnd - The end field contains the offset from the start of the symbols for this module
       to the matching block end symbol that terminates the lexical scope.
       *ex.
       *
       *offset    symboIndex
       *0133A     S_SSEARCH     0001:0008C  CodeSyms: 0000  DataSyms 0000  FirstData: 00000000
       *......
       *......
       *0141E     S_LPROC32 
       *  0001:00048-00053  SetOnly [010]
       *  Debug: 0001:00048-00054  Type: 1003
       *  Parent: 00000  End: 00118  Next: 00000
       *  Browser offset: 0000
       *.....
       *0144E     S_END    
       *
       *01452     S_BLOCK32   Parent: 00000  End: 00138  0001:00000-0000A  <none> [000]
       *...
       *
       *
       *Well:  0133A(offset of S_SSEARCH)+End(pEnd)=01452(offset to the end of S_LPROC32 definition)
       *
pNext - The end field contains the offset from the start of the symbols for this module
        to the matching block end symbol that terminates the lexical scope.
        *In normal words:
        *
        *pNext=S_LPROC32_Next_dataSection-S_SSEARCH_all
        *
        * S_LPROC32_Next_dataSection - offset to NEXT S_LPROC32+4bytes(because we must point to 'Data specific to each symbol format')
        * S_SSEARCH_all - offset to S_SSEARCH (this means we include lenght ans symbol index too)
        *
procLenght - Lenght of this procedure.
debugStart - Offset in bytes from the start of the procedure to the point where the stack frame has been set up.
             Parameter and frame variables can be viewed at this point.
debugEnd - Offset in bytes from the start of the procedure to the point where the procedure is
           ready to return and has calculated its return value, if any.
           Frame and register variables can still be viewed.
offset - Offset from start(of CODE) in specified segment.
segment - Segment where this procedure is defined.

procType - Type of the procedure type record. (sstGlobalTypes)
iName - Index of string in sstNames. (1 is the first string)
browserOffset - ? (Normaly 0)

-------------------------------------------------------------------------------------------------------
0x0X05    S_GPROC        Global procedure start 16:(16 or 32)

Same as S_LPROC.

-------------------------------------------------------------------------------------------------------
0x0X07    S_BLOCK        Block start 16:(16 or 32)

NOTICE!
This text will explain 0x0209 - S_BLOCK32.

In Borland TASM S_BLOCK32 is used only in 'Main:' part of the code down to first 'PROC' definition.
S_BLOCK32 is used from 'Previous:' label to 'Next:' label.
*ex.
*
*.code
*Main:
*	call GetModuleHandle, NULL
*	jmp	JumpSetOne
*	nop
*	nop
*JumpSetOne:
*	call	SetOne
*	mov	NextData, eax
*	call	SetOnly
*	push	eax
*	pop	ecx
*	call	GetOnly, offset Only, offset NextData
*	call	ExitProcess, NULL
*
*GetOnly PROC pOnly:POINTER, pNextData:POINTER
*	mov	eax, [pOnly]
*    ....
*
*Well:
*1. S_BLOCK32 from 'Main:' to 'JumpSetOne:'
*2.&(the last) S_BLOCK32 from 'JumpSetOne:' to 'GetOnly PROC ...'
*


offset  size     name
0       SHORT    lenght(1Ah)
2       SHORT    S_BLOCK32
=>(Data specific to each symbol format)

4       ULONG    pParent
8       ULONG    pEnd
C       ULONG    lenght
10      ULONG    offset
14      SHORT    segment
16      ULONG    iName
1A      SHORT    ?            //probably for natural alignment



pParent - Look up at S_LPROC32.
pEnd - Look up at S_LPROC32.
       (Normaly it's offset to end of this S_BLOCK32+S_END pack.)
       *ex.
       *
       *0133A  S_SSEARCH  0001:0008C  CodeSyms: 0000  DataSyms 0000  FirstData: 00000000
       *.......
       *01452  S_BLOCK32   Parent: 00000  End: 00138  0001:00000-0000A  <none> [000]
       *0146E  S_END
       *01472  S_BLOCK32   Parent: 00000  End: 00158  0001:0000B-00031  <none> [000]
       *0148E  S_END
       *
       *Well: 0133A+End(pEnd)=1472
       *
lenght - Length in bytes of the scope of this block. (ex. bytes used by code from 'Main:' to 'JumpSetOne')
offset - Offset from start(of CODE) in specified segment to the 'label'.
segment - Segment where this procedure is defined.
iName - Index of string in sstNames. (1 is the first string)

-------------------------------------------------------------------------------------------------------
0x0X09    S_LABEL        Label 16:(16 or 32)

NOTICE!
This text will explain 0x0209 - S_LABEL32.


offset  size     name
0       SHORT    lenght(12h)
2       SHORT    S_LABEL32
=>(Data specific to each symbol format)

4       ULONG    offset
8       SHORT    segment
A       BYTE     flags
B       ULONG    iName
F     5*BYTE     ?            //probably for natural alignment


offset - Offset from start(of CODE) in specified segment
segment - segment where label is defined
flags - flags
iName - Index of string in sstNames. (1 is the first string)

flags:    
number    name
    4     FAR
not 4     NEAR

-------------------------------------------------------------------------------------------------------

