How to get MapFileBrowser

Navigation: »No topics above this level«

How to get MapFileBrowser

 Return to chapter overview

MapFileBrowser is free for commercial use. MapFileBrowser can be downloaded for Software Verify's website at https://www.softwareverify.com/product/map-file-browser/.

This help manual is available in Compiled HTML Help (Windows Help files), PDF, and online.

Windows Help | https://www.softwareverify.com/documentation/chm/mapFileBrowser.chm
PDF | https://www.softwareverify.com/documentation/pdfs/mapFileBrowser.pdf
Online | https://www.softwareverify.com/documentation/html/mapFileBrowser/index.html

Whilst MapFileBrowser is free for commercial use, MapFileBrowser is copyrighted software and is not in the public domain.

You are free to use the software at your own risk.

You are not allowed to distribute the software in any form, or to sell the software, or to host the software on a website.

Contact Software Verify at:

Software Verify Limited

Suffolk Business Park

Eldo House

Kempson Way

Bury Saint Edmunds

IP32 7AR

United Kingdom

email | sales@softwareverify.com
web | https://www.softwareverify.com
blog | https://www.softwareverify.com/blog
twitter | http://twitter.com/softwareverify

Visit our blog to read our articles on debugging techniques and tools.

Follow us on twitter to keep track of the latest software tools and updates.


What does MapFileBrowser do?

Navigation: »No topics above this level«

What does MapFileBrowser do?

 Return to chapter overview

MapFileBrowser allows you to inspect the contents of a linker MAP file.

You can sort the data, filter the data by name.

You can also query the data by address which can be useful for identifying what function is at a given address if all you have is a crash address and nothing else.

Query by address is supported three ways:

·Query by absolute address.

·Query by address offset from a DLL load address.

·Query by address offset from a symbol.

32 bit and 64 bit

MAP files created by 32 bit and 64 bit software are supported. On 64 bit Operating systems if a 64 bit MAP file is opened the 64 bit version MAP File Browser is automatically started.

History

MapFileBrowser has been an internal tool at Software Verify for many years. We recently decided to make it a bit more user friendly and to make it available for public use.


What is a module?

Navigation: »No topics above this level«

What is a module?

 Return to chapter overview

A module is a contained block of executable code and data. For example, a DLL or EXE.

Some software vendors name their DLLs with different file extensions, for example .BPL, .ARX.

When you call LoadLibrary to load a module, you are returned a HMODULE, which is an opaque handle to a module. The HMODULE is most often the same as the module load address, but not always.

The lower few bits of the HMODULE can get OR'd with some flags to create a HMODULE value that is not the same as the module load address.

You can get the load address of a module from it's HMODULE by masking out the lower 16 bits of the HMODULE value then casting to a DWORD_PTR.

In this documentation when you read EXE or DLL or module, we are effectively referring to the same thing. It's easier to read and write "DLLs" rather than "DLLs or EXE".


MAP File contents

Navigation: »No topics above this level«

MAP File contents

 Return to chapter overview

MapFileBrowser can read MAP files generated by Microsoft Visual Studio, Delphi, C++ Builder and various other MAP files.

Some MAP files contain line numbers, some don't. The options for adding line numbers to MAP files have changed with different versions of compilers and linkers.

Even if a MAP file doesn't contain line numbers, the MAP can still be useful in guiding you to the correct function that is related to an address.

Visual Studio 6

Visual Studio 6 will add line numbers to your MAP file if you add the following option to your linker settings /MAPINFO:LINES

Visual Studio 7 (2002) and later

Visual Studio 7 and later will not add line numbers to your MAP file. The linker option /MAPINFO:LINES is not supported.

This means you can't create MAP files containing line numbers for anything you build with Visual Studio 7 (2002) or later, or for any 64 bit builds.

You can still use MapFileBrowser to identify the function which contains a given address.

Delphi

To create MAP files containing line numbers you need to specify that you want a "detailed" MAP file in the options for your Delphi or C++ Builder project.

C++ Builder

To create MAP files containing line numbers you need to specify that you want a "detailed" MAP file in the options for your Delphi or C++ Builder project.

Other Compilers

If you find that MapFileBrowser cannot read your MAP file, please contact us at support@softwareverify.com, attaching your MAP file to the email.

We will try to add support for your MAP file format as soon as we can.


Menu

Navigation: »No topics above this level«

Menu

 Return to chapter overview

The main menu contains five menus, File, Edit, Query, Software Updates and Help.


File

Navigation: Menu >

File

 Return to chapter overview

The File menu controls loading of MAP file information, clearing the display and exiting the program.

File menu instructionStep Load MAP file... instructionStep loads a MAP file and displays it.

File menu instructionStep Close instructionStep clear all results, unloads the MAP file information.

File menu instructionStep Exit instructionStep closes MapFileBrowser.


Settings

Navigation: Menu >

Settings

 Return to chapter overview

The Settings menu controls editing settings.

Settings menu instructionStep Edit Settings... instructionStep displays the settings dialog.


Query

Navigation: Menu >

Query

 Return to chapter overview

The Query menu controls searching for symbols.

Query menu instructionStep Find Symbol with Absolute Address... instructionStep Use this option to turn an absolute address in a process into a symbol, filename and line number.

See Decoding an absolute crash address for more details.

Query menu instructionStep Find Symbol with DLL Relative Address... instructionStep use this option to turn a relative address inside a DLL into a symbol, filename and line number.

See Decoding a relative crash address for more details.

Query menu instructionStep Find Symbol with Symbol Relative Address... instructionStep use this option to turn a address that is relative to a symbol inside a DLL into a symbol, filename and line number.

See Decoding a symbol relative crash address for more details.

Query menu instructionStep Find Symbol from Event Viewer XML crash log... instructionStep use this option to turn an XML crash log from the Microsoft Event Viewer to a symbol inside a DLL into a symbol, filename and line number.

See Decoding an Event Viewer XML crash log for more details.

Query menu instructionStep View Map File Information... instructionStep use this option to view information about the MAP file.


Software Updates

Navigation: Menu >

Software Updates

 Return to chapter overview

The Software Updates menu controls how often software updates are downloaded.

If you've been notified of a new software release to Map File Browser or just want to see if there's a new version, this feature makes it easy to update.

menu Software Updates menu instructionStep Check for software updates instructionStep checks for updates and shows the software update dialog if any exist

An internet connection is needed to be able to make contact with our servers.

note Before updating the software, close the help manual, and end any active session by closing target programs.

If no updates are available, you'll just see this message:

Software Update dialog

If a software update is available for Map File Browser you'll see the software update dialog.

·Download and install instructionStep downloads the update, showing progress

Once the update has downloaded, Map File Browser will close, run the installer, and restart.

You can stop the download at any time, if necessary.

·Don't download... instructionStep Doesn't download, but you'll be prompted for it again next time you start Map File Browser

·Skip this version... instructionStep Doesn't download the update and doesn't bother you again until there's an even newer update

·Software update options... instructionStep edit the software update schedule

Problems downloading or installing?

If for whatever reason, automatic download and installation fails to complete:

·Download the latest installer manually from the software verify website.

Make some checks for possible scenarios where files may be locked by Map File Browser as follows:

·Ensure Map File Browser and its help manual is also closed

·Ensure any error dialogs from the previous installation are closed

You should now be ready to run the new version.

Software update schedule

Map File Browser can automatically check to see if a new version of Map File Browser is available for downloading.

menu Software Updates menu instructionStep Configure software updates instructionStep shows the software update schedule dialog

The update options are:

·never check for updates

·check daily (the default)

·check weekly

·check monthly

The most recent check for updates is shown at the bottom.

Software update directory

It’s important to be able to specify where software updates are downloaded to because of potential security risks that may arise from allowing the TMP directory to be executable. For example, to counteract security threats it's possible that account ownership permissions or antivirus software blocks program execution directly from the TMP directory.

The TMP directory is the default location but if for whatever reason you're not comfortable with that, you can specify your preferred download directory. This allows you to set permissions for TMP to deny execute privileges if you wish.

menu Software Updates menu instructionStep Set software update directory instructionStep shows the Software update download directory dialog

An invalid directory will show the path in red and will not be accepted until a valid folder is entered.

Example reasons for invalid directories include:

·the directory doesn't exist

·the directory doesn't have write privilege (update can't be downloaded)

·the directory doesn't have execute privilege (downloaded update can't be run)

note When modifying the download directory, you should ensure the directory will continue to be valid. Updates may no longer occur if the download location is later invalidated.

·Reset instructionStep reverts the download location to the user's TMP directory

The default location is c:\users\[username]\AppData\Local\Temp


Help

Navigation: Menu >

Help

 Return to chapter overview

The Help menu controls displaying this help document and displaying information about Map File Browser.

Help menu instructionStep About Map File Browser... instructionStep displays information about Map File Browser.

Help menu instructionStep Readme and Version History... instructionStep displays the readme and version history.

Help menu instructionStep Help Topics... instructionStep displays this help file.

Help menu instructionStep Help PDF... instructionStep displays this help file in PDF format.

Help menu instructionStep Help on softwareverify.com... instructionStep display the Software Verify documentation web page where you can view online documentation or download compiled HTML Help and PDF help documents.

Help menu instructionStep Blog... instructionStep display the Software Verify blog.

Help menu instructionStep Library... instructionStep display the Software Verify library - our best blog articles grouped by related topics.

Help menu instructionStep Contact customer support... instructionStep displays the options for contacting customer support.

Click a link to contact customer support.

Help menu instructionStep How do I?... instructionStep displays the options for asking us how to do a particular task.


The user interface

Navigation: »No topics above this level«

The user interface

 Return to chapter overview

The MapFileBrowser user interface is shown below.

The user interface consists of a main grid showing functions in the MAP file.

Below is a display for line numbers and a source code display for viewing the source code of any function or variable that is selected.

Selecting any item in the grid populates the line numbers and source code display as appropriate.

Querying any value will select the nearest item in the main grid and populate the other displays as appropriate.

Some basic filtering functionality is also provided.

MAP File Information

The MAP File information shows you the symbol name, segment number, segment name, symbol address, symbol size, symbol type, and the filename and line number for the symbol.

You can sort the data by clicking no the column header and clicking again to reverse the direction of the sort.

If you select any item in the grid the lower grids and source code display are populated with data as appropriate.

If you right click any item a context is displayed which will allow you to perform a symbol relative query.

Line Numbers

The line numbers section lists each line number, the address of that line and the offset of that line from the start of the owning function. Note that offsets can be negative as well as positive depending on how the compiler did it's work.

Source Code

The source code section displays the source code, highlights the selected line and displays information relating to filename, line number, function and address.

Filters

The filters section allows you to filter data by symbol name.

Name Filter

Filtering by symbol name allows you to easily find a particular symbol. This is very useful when wanting to decode a crash address that has been provided as relative to a symbol (symbol + offset).


Settings dialog

Navigation: »No topics above this level«

Settings dialog

 Return to chapter overview

The settings dialog allows you to control the behaviour of Map File Browser.

There are three main sections: Symbols, Data display and source code paths.


Symbols

Navigation: Settings dialog >

Symbols

 Return to chapter overview

The Symbols settings allow you to choose how symbols are displayed.

Depending upon the task you are performing you may wish to read the symbols as human readable symbols or compiler decorated C++ symbols.

Reset - Resets the settings on the current page.

Reset All - Resets all global settings, not just those on the current page.


Data display

Navigation: Settings dialog >

Data display

 Return to chapter overview

The Symbols settings allow you to choose how symbols are displayed.

For MAP files that have line numbers you may wish to view additional information as well as the line numbers.

·If line numbers in MAP file instructionStep display all information relating to symbols that have line information

oDisplay Imported Functions instructionStep functions imported from other DLLs will be displayed

oDisplay Compiler Generated Code instructionStep compiler generated code will be displayed

oDisplay Linked Code instructionStep linked object code from .obj and .lib will be displayed

oDisplay Functions that have no size instructionStep symbols with no size will be displayed

·If no line numbers in MAP file instructionStep display all information that was found in the MAP file

Reset - Resets the settings on the current page.

Reset All - Resets all global settings, not just those on the current page.


Source code paths

Navigation: Settings dialog >

Source code paths

 Return to chapter overview

The Source code paths settings allow you to specify where Map File Browsers looks for source code files.

Manually adding path type directories

The Path list shows all the paths that will be searched for debug information in PDB files.

You can modify the list of files for each path type in the following ways:

·Add instructionStep appends a row to the directory list instructionStep enter the directory path

Edit a directory path by double clicking the entry. The usual controls apply for removing list items:

·Remove instructionStep removes selected items from the list

·Remove All instructionStep clears the list

·Set Default instructionStep populates the list with each directory found in the PATH environment variable

Alternatively, press [image] to delete selected items, and [image] + [image] to select all items in the list first.

Reset - Resets the settings on the current page.

Reset All - Resets all global settings, not just those on the current page.


MAP File Information

Navigation: »No topics above this level«

MAP File Information

 Return to chapter overview

The MAP File Information dialog displays information about a MAP file that is not displayed by the main display.

This information includes the DLL/EXE name, timestamp, preferred load address, entry point and a list of the segments that make up the binary image.


How to use MapFileBrowser

Navigation: »No topics above this level«

How to use MapFileBrowser

 Return to chapter overview

Load MAP File Information

Use the File > Load MAP file... option to load the appropriate MAP file.

The grid displays various attributes of each symbol in the MAP file. You can sort the grid by clicking the appropriate column header. Click the same header to reverse the sort order.

Select a symbol to see information about the line numbers and source code.

Filtering

You can filter by name by typing the name into the Name Filter box and clicking the Filter button to perform the filtering.

Viewing function data

As each item in the list is selected the Line Numbers are updated and the source code display updates to show the source code for the function. All lines in the function that contain executable code (as indicated by the line number information) are coloured grey. The current line for the function is coloured bright green.

Querying data

You can query data by using the two Query fields below the main grid.

Relative query

Type the relative address (also know as address offset) into the Query by Offset field, then click Query. The symbol information is displayed.

The field accepts decimal or hexadecimcal values. Hex values must be prefixed with 0x.

Absolute query

Type the absolute address into the Query by Address field, type the absolute DLL load address into the Alternate Load Address field, then click Query. The symbol information is displayed.

The fields accept decimal or hexadecimcal values. Hex values must be prefixed with 0x.


Decoding an absolute crash address

Navigation: How to use MapFileBrowser >

Decoding an absolute crash address

 Return to chapter overview

Scenario:

A customer has supplied you with a crash report containing a callstack with addresses. The callstack also indicates which module relates to which address.

The customer has also supplied you with a list of module load addresses.

Example Data:

Exception code: C0000005 ACCESS_VIOLATION
Fault address: 0x005f5eec (base 0x00400000) C:\Program Files (x86)\Software Verification\C++ Memory Validator\memoryValidator.exe
Exception Parameters:
0: 0x00000000 [Read Error]
1: 0x035f0034 [Address]

Registers:
EAX:035F0034
EBX:00000000
ECX:FFFDD000
EDX:00002370
ESI:006F7D58
EDI:035F0034
CS:EIP:0023:005F5EEC
SS:ESP:002B:0018FE14 EBP:0018FE3C
DS:002B ES:002B FS:0053 GS:002B
Flags:00010202

StackTrace

C:\Program Files (x86)\Software Verification\C++ Memory Validator\memoryValidator.exe : 0x00400000 : 0x005F249C
C:\Program Files (x86)\Software Verification\C++ Memory Validator\memoryValidator.exe : 0x00400000 : 0x005F23C3
C:\Windows\syswow64\msvcrt.dll : 0x75D70000 : 0x75D7C3E4
C:\Windows\syswow64\msvcrt.dll : 0x75D70000 : 0x75D836B6
C:\Program Files (x86)\Software Verification\C++ Memory Validator\memoryValidator.exe : 0x00400000 : 0x0060AA42
C:\Windows\syswow64\kernel32.dll : 0x754D0000 : 0x754E3365
C:\Windows\SysWOW64\ntdll.dll : 0x77920000 : 0x77959F6D
C:\Windows\SysWOW64\ntdll.dll : 0x77920000 : 0x77959F40
C:\Windows\SysWOW64\ntdll.dll : 0x77920000 : 0x77959F40

This is data from a real crash a few years ago, from C++ Memory Validator 5.80.

Question:

How do you decode these absolute addresses?

Answer:

In the above data we can see a callstack containing entries for ntdll.dll, msvcrt.dll, and memoryValidator.exe.

All the modules are Microsoft DLLs except for the EXE, which is part of C++ Memory Validator, one of our tools.

To decode these values, we load memoryValidator.map into MapFileBrowser, then for each symbol we take the following actions.

For our purposes here, we're going to show how to convert one symbol. We're going to use the first symbol from memoryValidator.exe in the example data above.

0x005f5eec (base 0x00400000)

The address is 0x005f5eec. The DLL loaded at 0x00400000. You'll notice the load address for all MemoryValidator.exe entries is 0x00400000.

From the Query menu choose Find Symbol with Absolute Address....

The Query Symbol by Absolute Address dialog is displayed.

Type the DLL load address into the DLL Load Address field. Prefix any hexadecimal addresses with 0x.

Type the symbol address into the Address field. Prefix any hexadecimal addresses with 0x.

Click the Find Symbol button.

The appropriate location in the code is found and displayed.

Results:

Repeating the process for the data shown above resulted in this information.

0x005f5eec (base 0x00400000) C:\Program Files (x86)\Software Verification\C++ Memory Validator\memoryValidator.exe MemorySettingsData::saveCoverageFilters MemorySettinData.cpp 5365
C:\Program Files (x86)\Software Verification\C++ Memory Validator\memoryValidator.exe : 0x00400000 : 0x005F249C MemorySettingData::writeRegistrySimple MemorySettingData.cpp 3827
C:\Program Files (x86)\Software Verification\C++ Memory Validator\memoryValidator.exe : 0x00400000 : 0x005F23C3 MemorySettingData::writeRegistrySimple MemorySettingData.cpp 3821
C:\Windows\syswow64\msvcrt.dll : 0x75D70000 : 0x75D7C3E4
C:\Windows\syswow64\msvcrt.dll : 0x75D70000 : 0x75D836B6
C:\Program Files (x86)\Software Verification\C++ Memory Validator\memoryValidator.exe : 0x00400000 : 0x0060AA42 std::_Tree<...very big template...>::erase xtree Line 351
C:\Windows\syswow64\kernel32.dll : 0x754D0000 : 0x754E3365
C:\Windows\SysWOW64\ntdll.dll : 0x77920000 : 0x77959F6D
C:\Windows\SysWOW64\ntdll.dll : 0x77920000 : 0x77959F40
C:\Windows\SysWOW64\ntdll.dll : 0x77920000 : 0x77959F40

Help! I have a crash address but I don't know what the load address is? What do I do?

You need to read about load addresses.


Decoding a relative crash address

Navigation: How to use MapFileBrowser >

Decoding a relative crash address

 Return to chapter overview

Scenario:

A customer has supplied you with a crash report containing a callstack with relative offsets from DLLs. The callstack also indicates which module relates to which address.

Example Data:

Exception code: C0000005 ACCESS_VIOLATION
Fault offset: 00x00036FA3 C:\WINDOWS\system32\MSVCRT.dll
Exception Parameters:
0: 0x00000000 [Read Error]
1: 0x5f8f2000 [Address]

Registers:
EAX:B3BEB6D4
EBX:5F8CB6C8
ECX:150BE5B5
EDX:00000000
ESI:5F8F2000
EDI:01B98DEC
CS:EIP:001B:77C46FA3
SS:ESP:0023:0012F158 EBP:0012F160
DS:0023 ES:0023 FS:003B GS:0000
Flags:00010212

StackTrace

C:\WINDOWS\system32\MFC42u.DLL : 0x0000270a
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x000db989
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x000db1f8
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x00121a83
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x00121b7e
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x00174ec5
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x00175094
C:\WINDOWS\system32\MFC42u.DLL : 0x00013724
C:\WINDOWS\system32\MFC42u.DLL : 0x00014245
C:\WINDOWS\system32\MFC42u.DLL : 0x00001b31
C:\WINDOWS\system32\MFC42u.DLL : 0x0008cba7

This is data from a real crash many years ago.

Question:

There are no DLL load addresses and the addresses aren't addresses, but offsets from the start of a DLL. How do you decode these relative offsets?

Answer:

In the above data we can see a callstack containing entries for mfc42u.dll, and memoryValidator.exe.

All the modules are Microsoft DLLs except for the EXE, which is part of C++ Memory Validator, one of our tools.

To decode these values, we load memoryValidator.exe into MapFileBrowser.exe, then for each symbol we take the following actions.

For our purposes here, we're going to show how to convert one symbol. We're going to use the first symbol from memoryValidator.exe in the example data above.

C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x000db989

The relative address (or offset) is 0x000db989. We don't know the DLL load address.

From the Query menu choose Find Symbol with DLL Relative Address....

The Query Symbol by Absolute Address dialog is displayed.

Type the relative address into the Offset field. Prefix any hexadecimal addresses with 0x.

Click the Find Symbol button.

The appropriate location in the code is found and displayed. In this example MapFileBrowser could not locate the source code (as the file location is not valid on this machine)

Results:

Repeating the process for the data shown above resulted in this information.

Exception code: C0000005 ACCESS_VIOLATION
Fault offset: 00x00036FA3 C:\WINDOWS\system32\MSVCRT.dll
Exception Parameters:
0: 0x00000000 [Read Error]
1: 0x5f8f2000 [Address]

Registers:
EAX:B3BEB6D4
EBX:5F8CB6C8
ECX:150BE5B5
EDX:00000000
ESI:5F8F2000
EDI:01B98DEC
CS:EIP:001B:77C46FA3
SS:ESP:0023:0012F158 EBP:0012F160
DS:0023 ES:0023 FS:003B GS:0000
Flags:00010212

StackTrace

C:\WINDOWS\system32\MFC42u.DLL : 0x0000270a
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x000db989 CMap<...big template definition...> afxtempl.h 1270
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x000db1f8 CMap<...big template definition...>::~CMap<...big template definition...> afxtempl.h 1270
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x00121a83 CVirtualTreeBase::Draw VirtualTreeBase.cpp 176
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x00121b7e CVirtualTreeBase::Draw VirtualTreeBase.cpp 198
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x00174ec5 LocalAllocStackTrace::getStringRepresentation LocalAllocTrace.cpp Line 182
C:\Program Files\Software Verification\Memory Validator\memoryValidator.exe : 0x00175094 LocalFreeStackTrace::getStringInfo LocalAllocTrace.cpp 296
C:\WINDOWS\system32\MFC42u.DLL : 0x00013724
C:\WINDOWS\system32\MFC42u.DLL : 0x00014245
C:\WINDOWS\system32\MFC42u.DLL : 0x00001b31
C:\WINDOWS\system32\MFC42u.DLL : 0x0008cba7


Decoding a symbol relative crash address

Navigation: How to use MapFileBrowser >

Decoding a symbol relative crash address

 Return to chapter overview

Scenario:

A customer has supplied you with a crash report containing a callstack with symbol relative offsets from DLLs. The callstack also indicates which module relates to which address.

Example Data:

ntoskrnl.exe!KeSynchronizeExecution+0x2246
ntoskrnl.exe!KeWaitForMultipleObjects+0x135e
ntoskrnl.exe!KeWaitForMultipleObjects+0xdd9
ntoskrnl.exe!KeWaitForSingleObject+0x373
ntoskrnl.exe!KeStallWhileFrozen+0x1977
ntoskrnl.exe!_misaligned_access+0x13f9
ntoskrnl.exe!KeWaitForMultipleObjects+0x152f
ntoskrnl.exe!KeWaitForMultipleObjects+0xdd9
ntoskrnl.exe!KeWaitForSingleObject+0x373
ntoskrnl.exe!NtWaitForSingleObject+0xb2
ntoskrnl.exe!setjmpex+0x34a3
ntdll.dll!ZwWaitForSingleObject+0xa
KERNELBASE.dll!WaitForSingleObjectEx+0x98
svlcoveragevalidatorstub.dll!sendCommandLineAndStartTimeToGUI+0x2868
svlcoveragevalidatorstub.dll!setValidatorFeedbackHookingComplete+0x1fa6
svlcoveragevalidatorstub.dll!svl_sendMessageRawToUserInterface+0x21837
svlcoveragevalidatorstub.dll!svl_sendMessageRawToUserInterface+0x218cb
KERNEL32.DLL!BaseThreadInitThunk+0x22
ntdll.dll!RtlUserThreadStart+0x34

This is real data from a bug at Software Verify Ltd. This is one thread from many in a dump relating to a deadlock bug we were investigating.

Question:

How do you decode these symbol relative offsets?

Answer:

In the above data we can see a callstack containing entries for ntoskrnl.exe, ntdll.dll, kernelbase.dll, kernel32.dll and svlcoveragevalidatorstub.dll.

All the modules are Microsoft DLLs except for one DLL, which is part of C++ Coverage Validator, one of our tools.

To decode these values, we load svlCoverageValidatorStub.dll into MapFileBrowser, then for each symbol we take the following actions.

For our purposes here, we're going to show how to convert one symbol. We're going to use the first symbol from svlCoverageValidatorStub.dll in the example data above.

svlcoveragevalidatorstub.dll!sendCommandLineAndStartTimeToGUI+0x2868

Type the symbol name into the Name Filter field, then click Filter. This makes it easy to find the symbol we want.

Once we have found the symbol, right click on the symbol to display the context menu and choose Offset from this symbol....

An alternate method is to click on the symbol to select it, then from the Query menu choose Find Symbol with Symbol Relative Address....

Or, from the Query menu choose Find Symbol with Symbol Relative Address... then choose the symbol you want from the combo box.

Type the offset into the dialog (hex values must be prefixed with 0x) and click OK.

The appropriate location in the code is found and displayed.

Results:

Repeating the process for the data shown above resulted in this information.

svlcoveragevalidatorstub.dll!sendCommandLineAndStartTimeToGUI+0x2868 doStackTrace stackStuff.cpp 736
svlcoveragevalidatorstub.dll!setValidatorFeedbackHookingComplete+0x1fa6 stubSendComm::stubSendProc stubsendcomm.cpp 611
svlcoveragevalidatorstub.dll!svl_sendMessageRawToUserInterface+0x21837 memcpy
svlcoveragevalidatorstub.dll!svl_sendMessageRawToUserInterface+0x218cb wcscpy


Decoding an Event Viewer XML crash log

Navigation: How to use MapFileBrowser >

Decoding an Event Viewer XML crash log

 Return to chapter overview

Scenario:

A customer has supplied you with data from Windows Event Viewer about a crash. The log contains XML and you don't know which values are relevant.

The event log data will have a provider name of "Windows Error Reporting" or "Application Error".

The XML data is found on the "Details" tab with the XML View radio box selected.

Example Data:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-02-11T10:42:39.000000000Z" />
<EventRecordID>260330</EventRecordID>
<Channel>Application</Channel>
<Computer>hydra</Computer>
<Security />
</System>
<EventData>
<Data>testDeliberateCrashVS6.exe</Data>
<Data>1.0.0.1</Data>
<Data>5e42850d</Data>
<Data>testDeliberateCrashVS6.exe</Data>
<Data>1.0.0.1</Data>
<Data>5e42850d</Data>
<Data>c0000005</Data>
<Data>00001d07</Data>
<Data>1490</Data>
<Data>01d5e0c7fa70e745</Data>
<Data>E:\om\c\testApps\testDeliberateCrashVS6\Debug\testDeliberateCrashVS6.exe</Data>
<Data>E:\om\c\testApps\testDeliberateCrashVS6\Debug\testDeliberateCrashVS6.exe</Data>
<Data>390bde30-4cbb-11ea-83d3-001e4fdb3956</Data>
<Data />
<Data />
</EventData>
</Event>

This is data from a test program that is designed to crash.

Question:

There the event log indicates a DLL, but no load address, two different addresses, an exception code and an offset from the start of the DLL. How do you decode this relative offset?

Answer:

MapFileBrowser has an option specifically for this occasion.

The XML data indicates the crash happened in testDeliberateCrashVS6.exe. Load this into MapFileBrowser being sure to load the correct build version and that the PDB file can be found so that symbols get loaded.

From the Query menu choose Find Symbol from Event Viewer XML crash log....

The Query Symbol by Absolute Address dialog is displayed.

Paste the XML data from the Event Viewer into the text field.

Click the Find Symbol button.

The appropriate location in the code is found and displayed.


What is a load address?

Navigation: How to use MapFileBrowser >

What is a load address?

 Return to chapter overview

A load address is the address at which a DLL loads.

All versions of Microsoft Windows load modules (.dll, .exe) into address space that is reserved using a call to VirtualAlloc().

The allocation of VirtualAlloc() can be queried by calling Win32 API GetSystemInfo() and examining the value returned in dwAllocationGranularity. For all versions of Microsoft Windows this has been 64KB.

Why is the load address important?

The load address is important because without it we can't calculate the offset inside the DLL so that we can obtain a symbol.

That's why a crash address with no DLL Load Address isn't very useful - we don't know which DLL the crash is in, nor do we know where the DLL was loaded.

But I don't have a load address. What can I do?

Depending upon how your module (DLL/EXE) was built we may be able to guess the correct load address.

If the OS you are using is Windows XP or earlier, we can guess the address.

First a brief chat about Address Space Layout Randomisation...

If the OS you are using is Windows Vista or later, we may be able to guess the load address. The reason this is not precises is because something known as Address Space Layout Randomisation (ASLR) was introduced with Microsoft Vista to improve security against many malicious computer attacks. Any program built with ASLR enabled when run on Vista (or later) will have the load address for all modules (including the .exe) randomised, making guessing the load address a waste of time.

ASLR is enabled by the /DYNAMICBASE in the linker settings of Visual Studio.

If you are using Visual Studio 2005 or earlier this setting is not available, your program is not affected by ASLR.

If you are using Visual Studio 2008 or later you will need to check to see if this option is present. If it is not present, your program is not affected by ASLR.

If you are not using Visual Studio to build your program then you may not be affected by this option, consult your compiler/linker documentation.

If your program is not affected by ASLR...

We can try to guess the load address of your DLL/EXE. We can do this regardless of which compiler/linker you used to build your program. All the programs I mention here are free to download at the time of writing this help file.

VM Validator

https://www.softwareverify.com/cpp-virtual-memory.php

This works for 32 bit and 64 bit programs.

Method 1

·Start your program using VM Validator or attach to your running program with VM Validator.

·On the Summary tab, inspect the DLLs sub tab in the lower half of the display.

·Find the DLL name in the DLL column.

·The load address is the value in the Address column.

Method 2

·Start your program using VM Validator or attach to your running program with VM Validator.

·Go to the Paragraphs tab.

·Find any purple entry, check the DLL name in the Description field.

·The load address is the value in the Address column.

In the example above, for dbgHelpBrowser.exe, the load address is 0x00400000.

Process Explorer

https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx

This works for 32 bit and 64 bit programs.

·Start your program

·Start Process Explorer. If your program is a service or runs as administrator you'll need to start Process Explorer as administrator.

·In Process Explorer, enable View -> Show Lower Pane. Then for View -> Lower Pane Window, choose DLLs.

·Select your program in the top window.

·Find your DLL in the bottom window. Right click. Choose Properties from the Context menu.

·In the Properties dialog, read the load address.

In the example above, for dbgHelpBrowser.exe, the load address is 0x00400000.

Visual Studio (any version)

https://www.visualstudio.com/

·Start Visual Studio.

·From the Project menu, choose File -> Open -> Solution. Choose your executable.

·From the Debug menu, choose Start Debugging.

·From the Debug menu, choose Windows -> Modules.

·In the Modules window, find your DLL, then read the Address column.

In the example above, for threadLockChecker.exe, the load address is 0x00130000.

WinDbg

https://msdn.microsoft.com/en-gb/library/windows/hardware/ff551063(v=vs.85).aspx

·Start WinDbg

·From the File menu, choose Open Executable. Choose your executable.

·Type lm, then press return.

·All modules are listed. Find your module. The start address is the load address.

In the example above, for threadLockChecker.exe, the load address is 0x00130000.

Final Comments

OK, you should now know how to find the load address of a DLL or an EXE (or any module type). Remember that a load address obtained this way is only valid for symbol decoding if the executable doesn't have ASLR applied to it.

If your crash reporting code only grabs crash addresses and not DLL load addresses, you need to update your code so that you grab DLL load addresses at the time of the crash. That way you know for sure what the load addresses were and you won't have to guess the load addresses in future.


Command Line Interface

Navigation: »No topics above this level«

Command Line Interface

 Return to chapter overview

MapFileBrowser can be used from the command line as well as with the GUI.

The command line options allow you to view debug information that is in a MAP file, and optionally highlight a symbol at a specified offset.

/fileName

Specifies the module to load. This is typically a .exe or a .dll.

/fileName path-to-executable

Example: /fileName e:\om\c\test\release\test.exe

/offset

Specifies an offset inside the executable. MapFileBrowser will highlight the symbol that occupies this location.

Typically this offset will be calculated from a crash location.

For example:

If a DLL is loaded at 0x00400000 and a crash happens at 0x00420192, the offset is calculated by subtracting the DLL load address from the crash address.

That is: 0x00420192 - 0x00400000, which gives 0x00020192.

The offset is 0x00020192.

The offset must be specified in hexadecimal with a leading 0x.

/offset value

Example: /offset 0x00020192

Example Command Line

32 bit applications

MapFileBrowser.exe /fileName e:\test\release\test.map /offset 0x00020192

64 bit applications

MapFileBrowser_x64.exe /fileName e:\test\release\test.map /offset 0x00020192