Logo Questions Linux Laravel Mysql Ubuntu Git Menu
HTML CSS JAVASCRIPT SQL PYTHON PHP BOOTSTRAP JAVA JQUERY R React Kotlin
 

How to find a method in assembly code

Tags:

c++

assembly

From a memory leak log I have the following info:

TestApp.exe! + 2238ch

Let us say this means that method at offset '2238c' (hex value) is leaking.

How can I locate the corresponding method in my source code? I have the linker map (testapp.map) but not sure how to use it.

This is a C++ application compiled in VS2008.

like image 603
Sesh Avatar asked Mar 11 '09 17:03

Sesh

People also ask

How do you call a function in assembly?

To call an external function, such as NetRun's "print_int", or a standard C library function like "exit", you need to tell the assembler the function is "extern". "extern" isn't actually an instruction--it doesn't show up in the disassembly--it's just a message to the assembler, often called a pseudoinstruction.

What does RET do in assembly?

The ret instruction transfers control to the return address located on the stack. This address is usually placed on the stack by a call instruction. Issue the ret instruction within the called procedure to resume execution flow at the instruction following the call .

What does JMP do in assembly?

In the x86 assembly language, the JMP instruction performs an unconditional jump. Such an instruction transfers the flow of execution by changing the program counter.

What is function in assembly language?

A function is a piece of code that is designed to perform a subtask in the program. Functions can have local variables, receive arguments, and pass a result back to the calling program. Consider the following subroutine foo that return the value 4 to main. A function is called with the instruction “call foo”.

2 Answers

Your map file will have a bunch of entries like these:

 0001:00000070       ??0logic_error@std@@QAE@ABV01@@Z 00401070 f i scratch.obj
 0001:000000e0       _main                      004010e0 f   scratch.obj
 0001:00000310       ??1?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@QAE@XZ 00401310 f i scratch.obj
 0001:00000330       ??1?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@QAE@XZ 00401330 f i scratch.obj
 0001:00000360       ?_Buynode@?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@IAEPAU_Node@?$_List_nod@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@2@XZ 00401360 f i scratch.obj
 0001:00000380       ?clear@?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@QAEXXZ 00401380 f i scratch.obj
 0001:000003f0       ?_Buynode@?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@IAEPAU_Node@?$_List_nod@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@2@PAU342@0ABV?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@Z 004013f0 f i scratch.obj
 0001:00000480       ?_Incsize@?$list@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@V?$allocator@V?$variant@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_NUvoid_@0detail@boost@@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@U3045@@boost@@@std@@@std@@IAEXI@Z 00401480 f i scratch.obj

This shows you exactly how your code is laid out in memory. e.g. main() starts at E0 and ends at 30F in segment 1.

You just need to go through the address list to see where the address you were given lands. One thing to look out for is there are usually multiple segments, but you can usually deduce which one has the code you're interested in.

like image 184
Ferruccio Avatar answered Sep 20 '22 15:09

Ferruccio

Use objdump -- that should tell you the function-address mapping.

From Ferruccio: The Windows version of that is dumpbin, it comes with Visual Studio

like image 26
dirkgently Avatar answered Sep 21 '22 15:09

dirkgently
Sign in to Comment

Related questions

What exactly is decltype(std::get<0>(tup))?
Is there a linux equivalent of _aligned_realloc
In C++20, how do I write a contiguous iterator?
Why clang-tidy suggests to add [[nodiscard]] everywhere?
Class can't have constants of own type inside?
std::unordered_map gives error when inserting using emplace function
Weird C++14 and C++17 difference in assignment operator
Beginner C++ Array
void(os << args). What does void mean in this context?
With std::optional, what does it mean to "remove the move constructor from overload resolution"?
Is std::ranges::size supposed to return an unsigned integer?
How to measure performance in a C++ (MFC) application?
Getting rid of the evil delay caused by ShellExecute
Use Compiler/Linker for C++ Code Clean-up
Anything I should know before converting a large C++ program from VS2005 to VS2008?
Store 2D points for quick retrieval of those inside a rectangle
Fast container for setting bits in a sparse domain, and iterating (C++)?
Why won't cout << work with overloaded * operator?
Is there any good example of http upload using WinInet c++ library
How might I retrieve the version number of a Windows EXE or DLL?

Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!