How can I find the line of code failure from the stack?

Now I have crash information:

TestAPP caused an access violation (0xc0000005) in the XCrashReportTest.exe module at 0023: 5763c230.

Context: EDI: 0x002aee0c ESI: 0x002ad7f4 EAX: 0x00000000 EBX: 0x00000000 ECX: 0x57635670 EDX: 0x028c1d27 EIP: 0x5763c230 EBP: 0x002aee18 SegCs: 0x00000023 EFlags: 0x00010246 ESP: 0x002ad554 SegSs: 0x0000002b Bytes at CS:EIP: 8b 08 52 50 8b 41 18 ff d0 8b 0d c8 e0 66 57 8b Stack: 0x002ad554: 576504f7 002aee0c 002ad7f4 002ad570 ..eW..*...*.p.*. 0x002ad564: 002aee0c 5763c201 002aee18 002ad59c ..*...cW..*...*. 0x002ad574: 576490b1 5763c201 002aee0c 00000100 ..dW..cW..*..... 0x002ad584: 002ad5f4 57648d9f 75785eaa 57668e70 ..*...dW.^xup.fW 0x002ad594: 002aee0c 00000001 002ad604 5764d4d2 ..*.......*...dW 0x002ad5a4: 002aee0c 57668e70 5763c201 00000000 ..*.p.fW..cW.... 0x002ad5b4: 00000100 75785d2a 57668e5c 002aee0c ....*]xu\.fW..*. 0x002ad5c4: 57668e4c 002add84 00000000 00000000 L.fW..*......... 

I mean XCrashReport [XCrashReport: Exception Handling and Alarm Reporting - Part 1

But I find that sometimes EIP was different when I ran the same * .exe on the same machine. Thus, sometimes I cannot match the line of emergency code with EIP (the methods described in XCrashReport: exception handling and crash reports - part 1. I do not know how to use the stack information.

Can anybody help me?

+4
source share
1 answer

The only reasonable way to do this is to load your crash dump into the debugger and provide characters, i.e. .pdb files. This can be tricky because pdb files may not have enough information. Companies such as Microsoft provide public PDB files that do not have information about local var names and other data. PDBs, which with full details are called public PDBs.

Sometimes the stack gets corrupted, and this leads to a "loss of control." The code gets the return address, that is, some garbage, loads this value into EIP and starts executing instructions from there. In this case, the accident occurs very soon, after only a few β€œinstructions” have been completed.

I mean, you need to find out if your EIP points to any code.

+3
source

Source: https://habr.com/ru/post/1439659/


All Articles