Incorrect function addresses in Visual Studio MAP-file

Question

Hi,

the function addresses (Rva+Base) in my MAP-file from visual studio doesn't match the one I see in the debugger (or when I manually inspect my stack frame).

What could be causing this?

/A.B.

Answer 1

Is the problem in an executable or a DLL?

If it's a DLL what is its preferred load address? If this clashes with any other DLL then it will be rebased by the loader, and this can lead to what you're seeing.

As part of your build process, you should ensure that all your DLLs are rebased (there's a tool to do this) so that their address spaces don't clash (this frees up some page file space as well as improving load time).

Answer 2

Both exe and dll can be relocated, unless you specify a /FIXED command line option when linking. I use following way to determine the real address to determine where my exe was loaded, so that I can compute the offset against the map file.

static void KnownFunctionAddress(){}

...

// check an address of a known function
// and compare this to the value read from the map file

intptr_t CheckRelocationOffset(MapFile map)
{
  intptr_t mapAddress = map.PhysicalAddress("?KnownFunctionAddress@@YAXXZ");
  intptr_t realAddress = (intptr_t)KnownFunctionAddress;

  return realAddress-mapAddress;
}