Map File Browser

Are you tired of manually turning crash addresses into symbols? Do you know how to read a MAP file?

The Problem : A non-linear address space

MAP files description the memory regions (also known as sections or segments) of an executable image, the addresses of functions and variables, and the symbols, filenames and line numbers that correspond to those functions and variables.

Addresses are specified as an offset from a section / segment, making a direct search for a memory address unviable. The offset inside the section needs to be turned into an offset inside the module and that then needs to be turned into an address inside the application by adding the module load address. Only then do you have something that you can compare to the crash address you are concerned with.

Each linker creates the executable image in its own particular way, with its own naming conventions for sections. Similarly each linker has it’s own MAP file format. Some MAP files include source filenames and line numbers, some only include binary filenames.

Manually looking up a crash address in a MAP file, performing the calculations to identify which segment + offset combination maps to which symbol, and then identifying the symbol that matches the crash address is a slow, boring and error prone process.

Interactive MAP file viewer

MAP File Browser is an interactive MAP file viewer and crash address converter, reading MAP files for Visual Studio, C++ Builder, Delphi, Qt Creator, Cygwin, MSYS2, Dev C++, gcc and g++.

Sorting

You can sort the MAP file symbols by name, section, symbol address, symbol size, type, filename and line. Clicking a column header sorts the symbols according to that column. Clicking the same column again reverses the sort direction

Select any entry in the list of symbols, the source code will be displayed below, as will the line numbers for that symbol.

Filters

You can filter the map file symbols by function/data name allowing you to quickly and easily find the symbols of interest.

Turning crash addresses into symbols

Once you’ve loaded your MAP file an interactive query browser allows you to find the right symbol for four different crash address calculations:

• Absolute crash address. You know the address of the crash and the load address of the DLL containing that address.
  
• DLL relative crash address. You know the crash offset inside the DLL
  
• Symbol relative crash address. You know the crash offset from a symbol inside the DLL.
  
• XML Data from a Windows event log crash event.
  

MAP files may be human readable, but they come in different formats for each compiler and linker you use, and knowing how to read a MAP file correctly and doing that reliably all the time is hard work. Developers make mistakes with tasks like this – the common mistake is assuming the wrong segment for the relative address (very easy to do if you’re stressed or tired).

Doing this in reverse, which you need to do to look up symbols, is even harder. That’s why we wrote MAP File Browser – to make our own debugging experience easier.

Get started now. Load your map file and identify the crash location in a few minutes.