{"id":138,"date":"2009-08-26T03:46:31","date_gmt":"2009-08-26T07:46:31","guid":{"rendered":"http:\/\/www.cchsu.com\/art-en\/?p=138"},"modified":"2009-08-26T04:24:52","modified_gmt":"2009-08-26T08:24:52","slug":"the-first-step-of-windows-post-mortem-debugging","status":"publish","type":"post","link":"http:\/\/www.cchsu.com\/art-en\/2009\/08\/26\/138\/","title":{"rendered":"The First Step of Windows Post-Mortem Debugging"},"content":{"rendered":"

I’m starting a new series of posts talking about something I’ve learned in past few years with respect to debugging. You can find the sample code used in these articles in Codeplex<\/a>. (I use Codeplex instead of SourceForge simply because it is much faster for my network. There is no endorsement nor affiliation with Microsoft.)<\/p>\n

Let’s start with the simplest program, HelloCrash. Compile and run this program introduces a crash.<\/p>\n

\"hellocrash1\"<\/a><\/p>\n

Most users will click Close here, but that’s ok. We can still find some traces in the Windows Logs, Application:<\/p>\n

\"hellocrash2\"<\/a> <\/p>\n

This actually gives out quite a few important information as highlighted. We can do some work here before jumping into dump collection and analysis. Interestingly, I’ve seen so many people has blind belief of memory dump analysis so that they forgot there are still easy<\/em> ways of doing things \ud83d\ude42<\/p>\n

In this case, we have the module name and offset, which means we could directly find out the crashing line from map files and assembly outputs. Although these information could be misleading, but it’s worth a try. We know the faulting module is HelloCrash.exe, and offset is 0x1002. The map file said<\/p>\n

\nPreferred load address is 00400000<\/font><\/b>
\n…<\/p>\n

Address Publics by Value Rva+Base Lib:Object<\/p>\n

0000:00000001 ___safe_se_handler_count 00000001
\n0000:00000000 ___ImageBase 00400000 \n0001:00000000 _wmain 00401000<\/font><\/b> f HelloCrash.obj
\n0001:00000017 @__security_check_cookie@4 00401017<\/font><\/b> f MSVCRT:secchk.obj
\n…\n<\/p><\/blockquote>\n

So it seems that the crash is from _wmain function (offset 0x1000 to 0x1016), and the offset within the function is 0x2. If your project has assembly file generated, it’s almost immediate that you can find the line<\/p>\n

\n; 9 : TCHAR* p = NULL;<\/p>\n

00000\t33 c0\t\t xor\t eax, eax<\/p>\n

; 10 : _tprintf(_T(“Hello, crash: %s\\n”), *p); \/\/ deref NULL pointer<\/p>\n

00002<\/font><\/b>\t0f b7 00\t movzx\t eax, WORD PTR [eax]\n<\/p><\/blockquote>\n

This example is so simple that we can see a deref of NULL pointer from assembly output directly, and then we can correct the error.<\/p>\n

I’ll discuss some more ways of getting to the crashing point in coming articles. Stay tuned \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

How to use map file and assembly listing to find the crash point.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,13,2,6],"tags":[],"_links":{"self":[{"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/posts\/138"}],"collection":[{"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/comments?post=138"}],"version-history":[{"count":12,"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/posts\/138\/revisions"}],"predecessor-version":[{"id":150,"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/posts\/138\/revisions\/150"}],"wp:attachment":[{"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/media?parent=138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/categories?post=138"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.cchsu.com\/art-en\/wp-json\/wp\/v2\/tags?post=138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}