When an EXE raised an exception message like “access violation at address XXXXXXXX…”, the address XXXXXXXX is a hex value, and we can get the source code line number that caused the exception, by looking at the map file. Details below (by madshi at EE):
you need to substract the image base,
which is most probably $400000.
Furthermore you need to substract the
“base of code” address, which is
stored in the image nt headers of each
module (exe/dll). It’s usually $1000.
You can check which value it has by
using the freeware tool “PEProwse
Pro”. It’s the field “Base Of Code” in
the “Details” of the “Optional
Header”. You’ll also find the image
base address there.
My question is: How to get the source line number for a DLL? Does the same calculation apply? Thanks!
Note 1: the map file is generated by Delphi and I’m not sure if this matters.
Note 2: I’ve been using JCL DEBUG but it couldn’t catch the exception which seems occurred at the startup of the DLL (an Office add-in, actually).
Same calculations apply, with the following note: instead of image base address of EXE you’ll need to take actual address where DLL had been loaded. Base of code for a DLL should taken in the same manner as for EXE (stored in PE’s
IMAGE_OPTIONAL_HEADER).Btw, EXE and DLL are actually the same thing from the point of view of PE format.