Geoff Chappell - Software Analyst
DUMPBIN recognises three types of object file:
An import object and an anonymous object both begin similarly, with structures that Microsoft defines symbolically (in the WINNT.H header from the Platform SDK) as IMPORT_OBJECT_HEADER and ANON_OBJ_HEADER respectively. For both file types, the first and second words (Sig1 and Sig2) must be zero and 0xFFFF respectively. The third word (Version) is zero for an import object and one for an anonymous object. A COFF object begins with an IMAGE_FILE_HEADER, in which the first and second words have meanings that are not usefully satisfied by zero and 0xFFFF.
DUMPBIN recognises as an import object any file whose size is at least 0x14 bytes and whose first three words are 0x0000, 0xFFFF and 0x0000 respectively.
However, DUMPBIN also checks that the word at offset 0x12 decomposes plausibly into the expected bit fields. To fail this check means that the file type is identified but the file is rejected immediately as “invalid or corrupt”. It is a fatal error (LNK1197) for Type to exceed 2. It is a fatal error (LNK1198) for NameType to exceed 3. It is a fatal error (LNK1199) if Reserved is non-zero.
DUMPBIN recognises as an anonymous object any file whose size is at least 0x14 bytes and whose first three words are 0x0000, 0xFFFF and 0x0001 respectively.
DUMPBIN recognises as a COFF object any file that plausibly begins with an IMAGE_FILE_HEADER. The file size must be at least 0x14 bytes, the first word must be a supported type of Machine and, unless the first word is zero, the second word must be not wildly implausible as a NumberOfSections.
However, the checks have very different consequences, if failed. If the first word is not zero but the second word is 0xFF00 or greater, the consequence is a fatal error (LNK1136), with the file described as “invalid or corrupt”. If the first word is not one of the following,
0x0000, 0x014C, 0x0162, 0x0166, 0x0168, 0x01A2, 0x01A3, 0x01A6, 0x01A8, 0x01C0, 0x01C2, 0x01D3, 0x01F0, 0x01F1, 0x0200, 0x0266, 0x0366, 0x0466, 0x0520, 0x8664 and 0x9041,
the consequence is just that the file is not recognised as any sort of object file.