LandShark
LandShark

Reputation: 65

Using Delphi map file to find source of AV

I have the typical AV error message from a customer, and the map file from the same build as the customer is using. I must be doing something wrong, because I just cannot find that address. The error message is:

Access violation at address 5053B2B2 in module 'ZZZZ.exe'. Read of address FFFFFFC4.

The image base used (in FinalBuilder) is $5053FFEF. The UPX exe compressor is also used, but that should not matter, I guess.

The top of the map file looks like this (start, length, name, class):

0001:50531000 05413280H .text                   CODE
0002:55945000 0002EADCH .itext                  ICODE
0003:55974000 0011A744H .data                   DATA
0004:55A8F000 000B41A0H .bss                    BSS
0005:00000000 00000154H .tls                    TLS
0006:50530000 00000000H .pdata                  PDATA

I have read that I should take into account a code offset that is usually $1000. Is 50531000 from the map file above the calculated address then?

Then the calculation would be 5053B2B2 minus 50531000 = A2B2. I cannot find any relevant in the map file for that. Any tips?

Upvotes: 1

Views: 309

Answers (0)

Related Questions