NB00 Not supported
NB01 Not supported
NB02 Linked by a Microsoft LINK, version 5.10, or equivalent OEM linker
NB03 Not supported
NB04 Not supported
NB05 The signature emitted by LINK 5.20 and later linkers for a file before it has been packed.
NB06 Not supported.
NB07 This signature is used for Quick C for Windows 1.0 only.
NB08 The signature CodeView 4.00 through CodeView 4.05 uses for a file after it has been packed. CodeView 4.00 - 4.05 will not process a file that does not have this signature.
NB09 The signature for CodeView 4.10 for a file after it has been packed. CodeView 4.10 will not process a file that does not have this signature.
NB10 The signature for an executable with the debug information stored in a separate PDB file. Corresponds with the formats set forth in NB09 or NB11.
NB11 The signature for Visual C++ 5.0 debug information that has been packed and bonded to the executable. This includes all 32-bit type indices.
The method for finding the debug information depends upon the executable format. PE Format: For PE format executables, the base address lfaBase is found by examining the executable header.executable header | Contains pointer to debug information |
executable code + ... | |
NBxx | Signature at lfaBase |
lfoDirectory | Offset of directory from base address (lfoDir) |
Subsection tables | sstModule, sstType, sstLibraries, ... |
. | |
. | |
. | |
Subsection Directory | At file offset lfaBase + lfoDir |
other information |