-1

I have the following information regarding a application crash, I want to know the fault offset, because given a fault offset, we have a tool which can determine the line of source which caused the crash. The faulting module is a COM dll 

Exception code: C00000005 (Access Violation)

 - FALUTING_IP:MyModule!DllUnregisterServer+0x00010f0d 
 - ExceptionAddress:05d0f2ed 
 - FOLLOWUP_IP:MyModule!DllUnregisterServer+10f0d 
 - MyModule is loaded at start:05cf0000   end:05d4c000
Thomas Weller
  • 55,411
  • 20
  • 125
  • 222
user2101801
  • 719
  • 2
  • 8
  • 20
  • Possible duplicate of [How to set up symbols in WinDbg?](http://stackoverflow.com/questions/30019889/how-to-set-up-symbols-in-windbg) – Thomas Weller Nov 16 '16 at 14:02
  • Faulting offset from what? from a function ? – Nuno_147 Nov 16 '16 at 14:04
  • Possible duplicate of [Display callstack without method names](http://stackoverflow.com/questions/28451803/display-callstack-without-method-names) – Thomas Weller Nov 16 '16 at 14:10
  • @Nuno_147 , the IP is pointing to 05d0f2ed and we know the dll memory start and end range, can we determine the fault offset , which may point to the location in the dll source code, where the crash occurred. – user2101801 Nov 16 '16 at 16:19

1 Answers1

0

You can calculate the relative offset to the beginning of the DLL by

?  MyModule!DllUnregisterServer+0x00010f0d  - MyModule
// DLL Offset+ Method offset   +byte offset - DLL offset

The result will be given in decimal and hex:

Evaluate expression: 446065 = 0006ce71
Thomas Weller
  • 55,411
  • 20
  • 125
  • 222