views:

304

answers:

2

For some reason I have only the linker map for an application I am debugging. There is a crash log which says crash occurred at offset "myApp.exe! + 4CA24".

From the linker map I am able to locate the method. Say this is at offset "myApp.exe! + 4BD7C".

Is there anyway to figure out the exact line in source code using just the above info?

I know if we have a .cod file it makes it very easy, but I don't have one (and can't create).

A: 

It depends on the actual information in the map file - if it has line number information (which is pretty rare nowadays), it'll be obvious and you'll be able to do it. Otherwise the best you can do is guess.

Michael Burr
+2  A: 

The best you can do if you only have MAP-files is to study the EXE-file in a disassembler and compare to constructs that you recognize from the common ways the compiler generates code. These you have to learn. That means learning at least some assembler is required. This is good knowledge that will help you in the future, especially if you have to debug a lot of code.

A slightly simpler approach is to download the free Intel-books on processor instructions and simply check out their sizes. This way you can count your way to the faulting instruction. For best results the two methods should be used in conjunction with each other.

Typically what you'd be looking for is something that looks a bit like this:

mov DWORD PTR [edi+40], eax

(Instruction, register, offset, size and order can be different but indirection is typically where most code crashes)

Whatever you do you should seriously consider turning on COD-file generation for the future as that makes it super-easy to find the faulting line.

Andreas Magnusson