The Old New Thing

Identifying an object whose underlying DLL has been unloaded

April 25, 2007 Apr 25, 2007 04/25/07

Raymond Chen

Okay, so I gave it away in the title, but follow along anyway. Your program chugs along and then suddenly it crashes like this: Instantly you recognize the following: This is a virtual method call. (Call indirect through register plus offset.) — Very high confidence. The vtable is in . (That is the base register of ...