如何通过崩溃地址找到出错的代码行(zt)——请斑竹加精~ vc-mfc - 基础类 - csdn社区 community_csdn_net.htm

很好的收集,看了以后都不知道说什么了. 都是关于内存调试方面的.十分有用.

<BR>&nbsp; 0003:0000092c &nbsp; 00000104H &nbsp; .CRT$XTZ &nbsp; DATA &nbsp; 
<BR>&nbsp; 0003:00000a30 &nbsp; 00000b93H &nbsp; .data &nbsp; DATA &nbsp; 
<BR>&nbsp; 0003:000015c4 &nbsp; 00001974H &nbsp; .bss &nbsp; DATA &nbsp; 
<BR>&nbsp; 0004:00000000 &nbsp; 00000014H &nbsp; .idata$2 &nbsp; DATA &nbsp; 
<BR>&nbsp; 0004:00000014 &nbsp; 00000014H &nbsp; .idata$3 &nbsp; DATA &nbsp; 
<BR>&nbsp; 0004:00000028 &nbsp; 00000110H &nbsp; .idata$4 &nbsp; DATA &nbsp; 
<BR>&nbsp; 0004:00000138 &nbsp; 00000110H &nbsp; .idata$5 &nbsp; DATA &nbsp; 
<BR>&nbsp; 0004:00000248 &nbsp; 000004afH &nbsp; .idata$6 &nbsp; DATA &nbsp; 
<BR>&nbsp; <SPAN>问题点数：0、回复次数：18</SPAN><A 
href="http://topic.csdn.net/t/20040416/08/2971645.html#">Top</A> </P>
<DIV class=tagad><IFRAME 
src="如何通过崩溃地址找到出错的代码行(ZT)——请斑竹加精~ VC-MFC - 基础类 - CSDN社区 community_csdn_net.files/Board.htm" 
frameBorder=0 scrolling=no></IFRAME></DIV>
<H3><STRONG><A class=anchor name=r_20832039>1 楼</A>fzd999（花差花差）<INPUT class=star2 title="二星用户 该版得分小于等于30000分，大于10000分" type=button></STRONG><SPAN>回复于 
2004-04-16 08:59:51 得分 0 </SPAN></H3>
<P>Address &nbsp; Publics &nbsp; by &nbsp; Value &nbsp; Rva+Base &nbsp; 
Lib:Object &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 0001:00000020 &nbsp; 
?Crash@@YAXXZ &nbsp; 00401020 &nbsp; f &nbsp; CrashDemo.obj &nbsp; <BR>&nbsp; 
0001:00000070 &nbsp; _main &nbsp; 00401070 &nbsp; f &nbsp; CrashDemo.obj &nbsp; 
<BR>&nbsp; 0004:00000000 &nbsp; __IMPORT_DESCRIPTOR_KERNEL32 &nbsp; 00424000 
&nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000014 &nbsp; 
__NULL_IMPORT_DESCRIPTOR &nbsp; 00424014 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:00000138 &nbsp; __imp__GetCommandLineA@0 &nbsp; 00424138 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:0000013c &nbsp; __imp__GetVersion@0 
&nbsp; 0042413c &nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000140 
&nbsp; __imp__ExitProcess@4 &nbsp; 00424140 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:00000144 &nbsp; __imp__DebugBreak@0 &nbsp; 00424144 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000148 &nbsp; 
__imp__GetStdHandle@4 &nbsp; 00424148 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:0000014c &nbsp; __imp__WriteFile@20 &nbsp; 0042414c &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000150 &nbsp; 
__imp__InterlockedDecrement@4 &nbsp; 00424150 &nbsp; kernel32:KERNEL32.dll 
&nbsp; <BR>&nbsp; 0004:00000154 &nbsp; __imp__OutputDebugStringA@4 &nbsp; 
00424154 &nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000158 &nbsp; 
__imp__GetProcAddress@8 &nbsp; 00424158 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:0000015c &nbsp; __imp__LoadLibraryA@4 &nbsp; 0042415c &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000160 &nbsp; 
__imp__InterlockedIncrement@4 &nbsp; 00424160 &nbsp; kernel32:KERNEL32.dll 
&nbsp; <BR>&nbsp; 0004:00000164 &nbsp; __imp__GetModuleFileNameA@12 &nbsp; 
00424164 &nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000168 &nbsp; 
__imp__TerminateProcess@8 &nbsp; 00424168 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:0000016c &nbsp; __imp__GetCurrentProcess@0 &nbsp; 0042416c 
&nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000170 &nbsp; 
__imp__UnhandledExceptionFilter@4 &nbsp; 00424170 &nbsp; kernel32:KERNEL32.dll 
&nbsp; <BR>&nbsp; 0004:00000174 &nbsp; __imp__FreeEnvironmentStringsA@4 &nbsp; 
00424174 &nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000178 &nbsp; 
__imp__FreeEnvironmentStringsW@4 &nbsp; 00424178 &nbsp; kernel32:KERNEL32.dll 
&nbsp; <BR>&nbsp; 0004:0000017c &nbsp; __imp__WideCharToMultiByte@32 &nbsp; 
0042417c &nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000180 &nbsp; 
__imp__GetEnvironmentStrings@0 &nbsp; 00424180 &nbsp; kernel32:KERNEL32.dll 
&nbsp; <BR>&nbsp; 0004:00000184 &nbsp; __imp__GetEnvironmentStringsW@0 &nbsp; 
00424184 &nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000188 &nbsp; 
__imp__SetHandleCount@4 &nbsp; 00424188 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:0000018c &nbsp; __imp__GetFileType@4 &nbsp; 0042418c &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000190 &nbsp; 
__imp__GetStartupInfoA@4 &nbsp; 00424190 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:00000194 &nbsp; __imp__HeapDestroy@4 &nbsp; 00424194 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:00000198 &nbsp; 
__imp__HeapCreate@12 &nbsp; 00424198 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:0000019c &nbsp; __imp__HeapFree@12 &nbsp; 0042419c &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001a0 &nbsp; 
__imp__VirtualFree@12 &nbsp; 004241a0 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001a4 &nbsp; __imp__RtlUnwind@16 &nbsp; 004241a4 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001a8 &nbsp; 
__imp__GetLastError@0 &nbsp; 004241a8 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001ac &nbsp; __imp__SetConsoleCtrlHandler@8 &nbsp; 004241ac 
&nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001b0 &nbsp; 
__imp__IsBadWritePtr@8 &nbsp; 004241b0 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001b4 &nbsp; __imp__IsBadReadPtr@8 &nbsp; 004241b4 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001b8 &nbsp; 
__imp__HeapValidate@12 &nbsp; 004241b8 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001bc &nbsp; __imp__GetCPInfo@8 &nbsp; 004241bc &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001c0 &nbsp; __imp__GetACP@0 
&nbsp; 004241c0 &nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001c4 
&nbsp; __imp__GetOEMCP@0 &nbsp; 004241c4 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001c8 &nbsp; __imp__HeapAlloc@12 &nbsp; 004241c8 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001cc &nbsp; 
__imp__VirtualAlloc@16 &nbsp; 004241cc &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001d0 &nbsp; __imp__HeapReAlloc@16 &nbsp; 004241d0 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001d4 &nbsp; 
__imp__MultiByteToWideChar@24 &nbsp; 004241d4 &nbsp; kernel32:KERNEL32.dll 
&nbsp; <BR>&nbsp; 0004:000001d8 &nbsp; __imp__LCMapStringA@24 &nbsp; 004241d8 
&nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001dc &nbsp; 
__imp__LCMapStringW@24 &nbsp; 004241dc &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001e0 &nbsp; __imp__GetStringTypeA@20 &nbsp; 004241e0 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001e4 &nbsp; 
__imp__GetStringTypeW@16 &nbsp; 004241e4 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001e8 &nbsp; __imp__SetFilePointer@16 &nbsp; 004241e8 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001ec &nbsp; 
__imp__SetStdHandle@8 &nbsp; 004241ec &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001f0 &nbsp; __imp__FlushFileBuffers@4 &nbsp; 004241f0 &nbsp; 
kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; 0004:000001f4 &nbsp; 
__imp__CloseHandle@4 &nbsp; 004241f4 &nbsp; kernel32:KERNEL32.dll &nbsp; 
<BR>&nbsp; 0004:000001f8 &nbsp; \177KERNEL32_NULL_THUNK_DATA &nbsp; 004241f8 
&nbsp; kernel32:KERNEL32.dll &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; entry &nbsp; 
point &nbsp; at &nbsp; 0001:000000f0 &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; &nbsp; 
<BR>&nbsp; Line &nbsp; numbers &nbsp; for &nbsp; 
.\Debug\CrashDemo.obj(d:\msdev\myprojects\crashdemo\crashdemo.cpp) &nbsp; 
segment &nbsp; .text &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 13 &nbsp; 0001:00000020 
&nbsp; 14 &nbsp; 0001:00000038 &nbsp; 15 &nbsp; 0001:0000003f &nbsp; 16 &nbsp; 
0001:00000046 &nbsp; <BR>&nbsp; 17 &nbsp; 0001:00000050 &nbsp; 20 &nbsp; 
0001:00000070 &nbsp; 21 &nbsp; 0001:00000088 &nbsp; 22 &nbsp; 0001:0000008d 
&nbsp; &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 如果仔细浏览 &nbsp; Rva+Base &nbsp; 
这栏，你会发现第一个比崩溃地址 &nbsp; 0x0040104a &nbsp; 大的函数地址是 &nbsp; 0x00401070 &nbsp; ，所以在 
&nbsp; 0x00401070 &nbsp; 这个地址之前的那个入口就是产生崩溃的函数，也就是这行： &nbsp; <BR>&nbsp; &nbsp; 
<BR>&nbsp; 0001:00000020 &nbsp; ?Crash@@YAXXZ &nbsp; 00401020 &nbsp; f &nbsp; 
CrashDemo.obj &nbsp; &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 因此，发生崩溃的函数就是 &nbsp; 
?Crash@@YAXXZ &nbsp; ，所有以问号开头的函数名称都是 &nbsp; C++ &nbsp; 修饰的名称。在我们的源程序中，也就是 &nbsp; 
Crash() &nbsp; 这个子函数。 &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 
OK，现在我们轻而易举地便知道了发生崩溃的函数名称，你是不是很兴奋呢？呵呵，先别忙，接下来，更厉害的招数要出场了。 &nbsp; <BR>&nbsp; 
&nbsp; <BR>&nbsp; 请注意 &nbsp; MAP &nbsp; 文件的最后部分--代码行信息（Line &nbsp; numbers 
&nbsp; information），它是以这样的形式显示的： &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 13 &nbsp; 
0001:00000020 &nbsp; &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 
第一个数字代表在源代码中的代码行号，第二个数是该代码行在所属的代码段中的偏移量。 &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 
如果要查找代码行号，需要使用下面的公式做一些十六进制的减法运算： &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 崩溃行偏移 
&nbsp; = &nbsp; 崩溃地址（Crash &nbsp; Address） &nbsp; - &nbsp; 基地址（ImageBase &nbsp; 
Address） &nbsp; - &nbsp; 0x1000 &nbsp; &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 
为什么要这样做呢？细心的朋友可能会留意到 &nbsp; Rva+Base &nbsp; 这栏了，我们得到的崩溃地址都是由 &nbsp; 偏移地址（Rva）+ 
&nbsp; 基地址（Base） &nbsp; 得来的，所以在计算行号的时候要把基地址减去，一般情况下，基地址的值是 &nbsp; 0x00400000 
&nbsp; 。另外，由于一般的 &nbsp; PE &nbsp; 文件的代码段都是从 &nbsp; 0x1000 &nbsp; 偏移开始的，所以也必须减去 
&nbsp; 0x1000 &nbsp; 。 &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 
好了，明白了这点，我们就可以来进行小学减法计算了： &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 崩溃行偏移 &nbsp; = 
&nbsp; 0x0040104a &nbsp; - &nbsp; 0x00400000 &nbsp; - &nbsp; 0x1000 &nbsp; = 
&nbsp; 0x4a &nbsp; &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 如果浏览 &nbsp; MAP &nbsp; 
文件的代码行信息，会看到不超过计算结果，但却最接近的数是 &nbsp; CrashDemo.cpp &nbsp; 文件中的： &nbsp; <BR>&nbsp; 
&nbsp; <BR>&nbsp; 16 &nbsp; 0001:00000046 &nbsp; &nbsp; <BR>&nbsp; &nbsp; 
<BR>&nbsp; 也就是在源代码中的第 &nbsp; 16 &nbsp; 行，让我们来看看源代码: &nbsp; <BR>&nbsp; &nbsp; 
<BR>&nbsp; 16 &nbsp; i &nbsp; /= &nbsp; j; &nbsp; &nbsp; <BR>&nbsp; &nbsp; 
<BR>&nbsp; 哈！！！果然就是第 &nbsp; 16 &nbsp; 行啊！ &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 
兴奋吗？我也一样！ &nbsp; ：） &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 
方法已经介绍完了，从今以后，我们就可以精确地定位到源代码中的崩溃行，而且只要编译器可以生成 &nbsp; MAP &nbsp; 文件（包括 &nbsp; 
VC、MASM、VB、BCB、Delphi……），本方法都是适用的。我们时常抱怨 &nbsp; M$ &nbsp; 的产品如何如何差，但其实 &nbsp; M$ 
&nbsp; 
还是有意无意间提供了很多有价值的信息给我们的，只是我们往往不懂得怎么利用而已……相信这样一来，你就可以更为从容地面对“非法操作”提示了。你甚至可以要求用户提供崩溃的地址，然后就可以坐在家中舒舒服服地找到出错的那行，并进行修正。 
&nbsp; <BR>&nbsp; <A 
href="http://topic.csdn.net/t/20040416/08/2971645.html#">Top</A></P>
<H3><STRONG><A class=anchor name=r_20832751>2 楼</A>satanmonkey（撒旦）<INPUT class=user3 title="三级用户 该版得分小于等于1000分，大于500分" type=button></STRONG><SPAN>回复于 
2004-04-16 09:13:54 得分 0 </SPAN></H3>
<P>DLL的怎么找？<A 
href="http://topic.csdn.net/t/20040416/08/2971645.html#">Top</A></P>
<H3><STRONG><A class=anchor name=r_20833000>3 楼</A>lanstar200（待我景天大侠斩妖除魔）<INPUT class=star1 title="一星用户 该版得分小于等于10000分，大于5000分" type=button></STRONG><SPAN>回复于 
2004-04-16 09:18:56 得分 0 </SPAN></H3>
<P>嚴重的頂頂<A href="http://topic.csdn.net/t/20040416/08/2971645.html#">Top</A></P>
<H3><STRONG><A class=anchor name=r_20833223>4 楼</A>happyparrot（快乐鹦鹉）<INPUT class=star4 title="四星用户 该版得分小于等于100000分，大于50000分" type=button></STRONG><SPAN>回复于 
2004-04-16 09:24:34 得分 0 </SPAN></H3>
<P>你写结贴才能加。<A 
href="http://topic.csdn.net/t/20040416/08/2971645.html#">Top</A></P>
<H3><STRONG><A class=anchor name=r_20833225>5 楼</A>GodInNight（夜游神）<INPUT class=user3 title="三级用户 该版得分小于等于1000分，大于500分" type=button></STRONG><SPAN>回复于 
2004-04-16 09:24:39 得分 0 </SPAN></H3>
<P>我来csdn所见过最最有用的文章。 &nbsp; <BR>&nbsp; &nbsp; <BR>&nbsp; 呵呵，我的意思是说其他文章都没用。<A 
href="http://topic.csdn.net/t/20040416/08/2971645.html#">Top</A></P>
<H3><STRONG><A class=anchor name=r_20833238>6 楼</A>greensofter（MC.CN）<INPUT class=star1 title="一星用户 该版得分小于等于10000分，大于5000分" type=button></STRONG><SPAN>回复于 
2004-04-16 09:24:48 得分 0 </SPAN></H3>