Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to find a method in assembly code

Tags:

c++

assembly

From a memory leak log I have the following info:

TestApp.exe! + 2238ch

Let us say this means that method at offset '2238c' (hex value) is leaking.

How can I locate the corresponding method in my source code? I have the linker map (testapp.map) but not sure how to use it.

This is a C++ application compiled in VS2008.

like image 603
Sesh Avatar asked Mar 11 '09 17:03

Sesh


People also ask

How do you call a function in assembly?

To call an external function, such as NetRun's "print_int", or a standard C library function like "exit", you need to tell the assembler the function is "extern". "extern" isn't actually an instruction--it doesn't show up in the disassembly--it's just a message to the assembler, often called a pseudoinstruction.

What does RET do in assembly?

The ret instruction transfers control to the return address located on the stack. This address is usually placed on the stack by a call instruction. Issue the ret instruction within the called procedure to resume execution flow at the instruction following the call .

What does JMP do in assembly?

In the x86 assembly language, the JMP instruction performs an unconditional jump. Such an instruction transfers the flow of execution by changing the program counter.

What is function in assembly language?

A function is a piece of code that is designed to perform a subtask in the program. Functions can have local variables, receive arguments, and pass a result back to the calling program. Consider the following subroutine foo that return the value 4 to main. A function is called with the instruction “call foo”.


2 Answers

Your map file will have a bunch of entries like these:

 0001:00000070       ??0logic_error@std@@QAE@ABV01@@Z 00401070 f i scratch.obj
 0001:000000e0       _main                      004010e0 f   scratch.obj
 0001:00000310       ??1?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@QAE@XZ 00401310 f i scratch.obj
 0001:00000330       ??1?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@QAE@XZ 00401330 f i scratch.obj
 0001:00000360       ?_Buynode@?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@IAEPAU_Node@?$_List_nod@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@2@XZ 00401360 f i scratch.obj
 0001:00000380       ?clear@?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@QAEXXZ 00401380 f i scratch.obj
 0001:000003f0       ?_Buynode@?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@IAEPAU_Node@?$_List_nod@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@2@PAU342@0ABV?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@Z 004013f0 f i scratch.obj
 0001:00000480       ?_Incsize@?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@IAEXI@Z 00401480 f i scratch.obj

This shows you exactly how your code is laid out in memory. e.g. main() starts at E0 and ends at 30F in segment 1.

You just need to go through the address list to see where the address you were given lands. One thing to look out for is there are usually multiple segments, but you can usually deduce which one has the code you're interested in.

like image 184
Ferruccio Avatar answered Sep 20 '22 15:09

Ferruccio


Use objdump -- that should tell you the function-address mapping.

From Ferruccio: The Windows version of that is dumpbin, it comes with Visual Studio

like image 26
dirkgently Avatar answered Sep 21 '22 15:09

dirkgently