Is it a Read, Write or Execute AV?


I didn’t find this documented in the Visual Studio documentation, but it is in the latest Windows SDK. In case anyone was interested, and would like to be able to tell from inside an app whether an AV was triggered by NX, this will do it:

 

DWORD FilterFunc( LPEXCEPTION_POINTERS pExcept )

{

    if( pExcept != NULL )

    {

        if( pExcept->ExceptionRecord->ExceptionCode == EXCEPTION_ACCESS_VIOLATION )

        {

            switch( pExcept->ExceptionRecord->ExceptionInformation[0] )

            {

            case 0:

                printf(“Read AV\n”);

            case 1:

                printf(“Write AV\n”);

            case 8:

                printf(“Execute AV\n”);

            }

        }

    }

    return EXCEPTION_CONTINUE_SEARCH;

}

 

You’d call it like so:

 

    __except( FilterFunc( GetExceptionInformation() ) )

    {

    }

 

 


Comments (1)

  1. molotov says:

    Ran accross this last September (http://mygreenpaste.blogspot.com/2006/09/softwarenxfault-exceptioninformation0.html) when I was trying to figure out why Outlook was crashing.  Of course, the location of the documentation for EXCEPTION_RECORD (now at http://msdn2.microsoft.com/en-us/library/aa363082.aspx) has changed since then…