[Wine] Re: debugging an app

[Henry Gomersall]

On Thu, 2007-05-24 at 11:52 -0700, Duane Clark wrote:
> Well, those are not the actual last few lines before the crash,
> because 
> I see a return from KERNEL32.UnhandledExceptionFilter() without the 
> call. I think the program actually crashed somewhere before the call
> to 
> that function. I often grep through the log for "xception" (without 
> "E"/"e" so that case does not matter) to find the first place in the
> log 
> where that word shows up. 

Well, I have several of these in the relay log. The following snippets
show the ones before the crash:

Ok [0009]:   ntdll.NtClose from 7b87cf8e with none.
Ok [0009]:   ntdll.NtAllocateVirtualMemory from 7b8977a7 with none.
Ok [0009]:   ntdll.RtlAddVectoredExceptionHandler from 7b8407ed with
none.
--
Ok [000b]:   ntdll.NtClose from 7b87cf8e with none.
Ok [000b]:   ntdll.NtAllocateVirtualMemory from 7b8977a7 with none.
Ok [000b]:   ntdll.RtlAddVectoredExceptionHandler from 7b8407ed with
none.
--
Ok [0009]:    ntdll.NtQuerySystemTime from 7b893f25 with none.
Ok [0009]:   KERNEL32.GetSystemTimeAsFileTime from 7c34207b with none.
Ok [0009]:   KERNEL32.SetUnhandledExceptionFilter from 7c3411b1 with
none.
--
Ok [0009]:     ntdll.RtlInitializeCriticalSection from 7b887e8d with
none.
Ok [0009]:    KERNEL32.InitializeCriticalSection from 7e0c7349 with
none.
Ok [0009]:    ntdll.RtlAddVectoredExceptionHandler from 7e0c7433 with
none.
--
Ok [0009]:                      ntdll.RtlFreeUnicodeString from 7b875493
with none.
Ok [0009]:                      ntdll.NtWaitForMultipleObjects from
7b8881c6 with none.
Ok [0009]:                     KERNEL32.UnhandledExceptionFilter from
7c34c456 with none.
Ok [0009]:                     ntdll.NtQueryVirtualMemory from 7b897aa1
with none.
Unhandled exception: page fault on write access to 0x035b2000 in 32-bit
code (0x678ead31).
--

Running the debugger I can get each of the above exceptions to show (by
pressing c on in the debug console). However, I still cannot work out
where to discover which function is actually giving the error. The
backtrace refers to the library xtp9601lib, which is a dll included with
the program (and the function that originates the page fault is in this
address range - at least that is my interpretation).

I presume I should be able to, in principle, find the offending function
call?

Thanks,

Henry