Q

Looking up crash addresses in MAP files

John, I have set up two test applications to implement the steps required to use a .map file to find a program's crash lien number. The steps I took were as your book "Debugging Applications" described:

  1. Obtain the crash address.
  2. Look for an address bigger than the crash address in the map file and note the preceding address.
  3. Calculate the offset.

    crash_address - preferred_load_address - 0x1000 = offset

  4. Look for a greater offset value in the line number section of the .map file.
  5. Note the line number of the previous offset value.

Although the procedure successfully identifies the exact line number for a forced crash in my Win32testApp

app (i.e. 	char* pEmpty = NULL;
	*pEmpty = 'x')

it doesn't appear to be as accurate in my equivalent MFCtestApp.

In the MFC test the calculations only ever point to the entry point of the function with the crash, and not the line number itself. I suspect it has something to do with Win32's InitInstance() vs MFC's CTestApp::InitInstance(), which is in a class. This is just a hunch.

I would appreciate any ideas on how to make your procedure work with both Win32 and MFC applications. I can send you the two VC projects with their map files if more convenient (115k and 200k). Any help would be most appreciated. Thank you very much.
The technique for looking up crash addresses in MAP files works regardless of C or C++. Are you creating release builds of the two applications? Send me a private mail with the answers. If you have my book, my e-mail address is listed in the forward.

This was first published in September 2003

Dig deeper on Windows File Management

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close