Reputation: 65
I have the typical AV error message from a customer, and the map file from the same build as the customer is using. I must be doing something wrong, because I just cannot find that address. The error message is:
Access violation at address 5053B2B2 in module 'ZZZZ.exe'. Read of address FFFFFFC4.
The image base used (in FinalBuilder) is $5053FFEF
. The UPX exe compressor is also used, but that should not matter, I guess.
The top of the map file looks like this (start, length, name, class):
0001:50531000 05413280H .text CODE 0002:55945000 0002EADCH .itext ICODE 0003:55974000 0011A744H .data DATA 0004:55A8F000 000B41A0H .bss BSS 0005:00000000 00000154H .tls TLS 0006:50530000 00000000H .pdata PDATA
I have read that I should take into account a code offset that is usually $1000
. Is 50531000
from the map file above the calculated address then?
Then the calculation would be 5053B2B2
minus 50531000
= A2B2
. I cannot find any relevant in the map file for that. Any tips?
Upvotes: 1
Views: 309