Question

For example, in the message:

First-chance exception at 0x757bd36f in foo.exe: Microsoft C++
exception: _ASExceptionInfo at memory location 0x001278cc..

What does 0x757bd36f and 0x001278cc mean? I think that 0x757bd36f would mean the EIP at the time the exception was thrown, but what about the second number?

Answer 1

As you’ve surmised, the first is the EIP when the exception happened (or RIP, for 64-it code).

Doing some testing, the second number is the address of the exception object being caught. Keep in mind, however, that this is not the same as the address of the exception object that was thrown. For example, I wrote the following bit of test code:

#include <iostream>
#include <conio.h>

class XXX { } xxx;

void thrower() { 
    throw xxx;
}

int main() {
    try {
        std::cout << "Address of xxx: " << (void *)&xxx << "\n";
        thrower();
    }
    catch(XXX const &x) {
        std::cout << "Address of x: " << (void *)&x << "\n";
    }
    getch();
    return 0;
}

At least in my testing, the second address VS shows in its “first chance exception” message matches with the address I get for x in the code above.