0
# Debug Information
1

2
Access to debug directories and related debugging information embedded in PE files. Debug information helps with debugging, profiling, and reverse engineering of PE files.
3

4
## Capabilities
5

6
### Debug Directory Parsing
7

8
Parse debug directory entries that contain debugging information.
9

10
```python { .api }
11
def parse_debug_directory(self, rva, size):
12
    """
13
    Parse debug directory at specified RVA.
14
    
15
    Args:
16
        rva (int): RVA of debug directory
17
        size (int): Size of debug directory
18
        
19
    Populates:
20
        self.DIRECTORY_ENTRY_DEBUG: List of DebugData objects
21
    """
22
```
23

24
## Usage Examples
25

26
### Debug Directory Analysis
27

28
```python
29
import pefile
30

31
with pefile.PE('executable.exe') as pe:
32
    # Check for debug information
33
    if hasattr(pe, 'DIRECTORY_ENTRY_DEBUG'):
34
        print("Debug Information:")
35
        print("-" * 40)
36
        
37
        for debug_entry in pe.DIRECTORY_ENTRY_DEBUG:
38
            debug_type = debug_entry.struct.Type
39
            
40
            # Map debug type to name
41
            debug_type_names = {
42
                0: "IMAGE_DEBUG_TYPE_UNKNOWN",
43
                1: "IMAGE_DEBUG_TYPE_COFF", 
44
                2: "IMAGE_DEBUG_TYPE_CODEVIEW",
45
                3: "IMAGE_DEBUG_TYPE_FPO",
46
                4: "IMAGE_DEBUG_TYPE_MISC",
47
                5: "IMAGE_DEBUG_TYPE_EXCEPTION",
48
                6: "IMAGE_DEBUG_TYPE_FIXUP",
49
                7: "IMAGE_DEBUG_TYPE_OMAP_TO_SRC",
50
                8: "IMAGE_DEBUG_TYPE_OMAP_FROM_SRC",
51
                9: "IMAGE_DEBUG_TYPE_BORLAND",
52
                10: "IMAGE_DEBUG_TYPE_RESERVED10",
53
                11: "IMAGE_DEBUG_TYPE_CLSID",
54
                12: "IMAGE_DEBUG_TYPE_VC_FEATURE",
55
                13: "IMAGE_DEBUG_TYPE_POGO",
56
                14: "IMAGE_DEBUG_TYPE_ILTCG",
57
                15: "IMAGE_DEBUG_TYPE_MPX",
58
                16: "IMAGE_DEBUG_TYPE_REPRO"
59
            }
60
            
61
            type_name = debug_type_names.get(debug_type, f"Unknown({debug_type})")
62
            
63
            print(f"Debug Type: {type_name}")
64
            print(f"Size: {debug_entry.struct.SizeOfData}")
65
            print(f"RVA: 0x{debug_entry.struct.AddressOfRawData:08x}")
66
            print(f"File Offset: 0x{debug_entry.struct.PointerToRawData:08x}")
67
            print(f"Timestamp: {debug_entry.struct.TimeDateStamp}")
68
            print(f"Major Version: {debug_entry.struct.MajorVersion}")
69
            print(f"Minor Version: {debug_entry.struct.MinorVersion}")
70
            
71
            # Extract debug data if present
72
            if debug_entry.struct.SizeOfData > 0:
73
                if debug_entry.struct.AddressOfRawData != 0:
74
                    debug_data = pe.get_data(debug_entry.struct.AddressOfRawData, 
75
                                           debug_entry.struct.SizeOfData)
76
                elif debug_entry.struct.PointerToRawData != 0:
77
                    debug_data = pe.get_data(pe.get_rva_from_offset(debug_entry.struct.PointerToRawData),
78
                                           debug_entry.struct.SizeOfData)
79
                else:
80
                    debug_data = None
81
                
82
                if debug_data:
83
                    print(f"Debug Data: {debug_data[:50].hex()}{'...' if len(debug_data) > 50 else ''}")
84
            
85
            print()
86
    else:
87
        print("No debug information found")
88
```