-
-
[求助] SymGetSymFromAddr 函数失败,返回错误码487
-
发表于: 2018-7-27 13:39 2809
-
BOOL CSDExceptionHandler::GetTraceBack(PCONTEXT pContext) { SymInitialize(m_hProcess, NULL, TRUE); STACKFRAME sf = { 0 }; sf.AddrPC.Offset = pContext->Eip; sf.AddrPC.Mode = AddrModeFlat; sf.AddrFrame.Offset = pContext->Ebp; sf.AddrFrame.Mode = AddrModeFlat; sf.AddrStack.Offset = pContext->Esp; sf.AddrStack.Mode = AddrModeFlat; while (StackWalk(IMAGE_FILE_MACHINE_I386, m_hProcess, m_hThread, &sf, pContext, NULL, SymFunctionTableAccess, SymGetModuleBase, NULL)) { DWORD dwDisplament = 0; IMAGEHLP_SYMBOL_PACKAGE stack_info = {0}; PIMAGEHLP_SYMBOL pSym = (PIMAGEHLP_SYMBOL)&stack_info; pSym->SizeOfStruct = sizeof(IMAGEHLP_SYMBOL); pSym->MaxNameLength = sizeof(IMAGEHLP_SYMBOL_PACKAGE) - offsetof(IMAGEHLP_SYMBOL_PACKAGE, sym.Name); IMAGEHLP_LINE ImageLine = { 0 }; ImageLine.SizeOfStruct = sizeof(IMAGEHLP_LINE); if(!SymGetSymFromAddr(m_hProcess, sf.AddrPC.Offset, &dwDisplament, pSym)) { _tprintf(_T("SymGetSymFromAddr Error:%08x, Addres:%08x \r\n"), GetLastError(), (DWORD)sf.AddrPC.Offset); continue; } if (!SymGetLineFromAddr(m_hProcess, sf.AddrPC.Offset, &dwDisplament, &ImageLine)) { _tprintf(_T("SymGetLineFromAddr Error:%08x, Address:%08x \r\n"), GetLastError(), (DWORD)sf.AddrPC.Offset); continue; } USES_CONVERSION; _tprintf(_T("当前调用函数 : %08x+%s(FILE[%s]LINE[%d])\r\n"), pSym->Address, A2T(pSym->Name),A2T(ImageLine.FileName), ImageLine.LineNumber); } return TRUE; }
在程序发生异常时会调用这个函数记录当前崩溃时的堆栈调用情况,但是SymGetSymFromAddr 和 SymGetLineFromAddr 失败,返回的错误码是487,打印的日志大致如下,
TraceBack: SymGetLineFromAddr Error:000001e7, Address:00653018 SymGetSymFromAddr Error:000001e7, Addres:77bb9479 SymGetSymFromAddr Error:000001e7, Addres:77bb965b SymGetSymFromAddr Error:000001e7, Addres:77ba7330 SymGetSymFromAddr Error:000001e7, Addres:77b8c307 SymGetSymFromAddr Error:000001e7, Addres:77b8baef SymGetLineFromAddr Error:000001e7, Address:006773a5 SymGetSymFromAddr Error:000001e7, Addres:77b8ba62 SymGetLineFromAddr Error:000001e7, Address:006441a8
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
看原图
赞赏
雪币:
留言: