{"id":94316,"date":"2016-09-15T07:00:00","date_gmt":"2016-09-15T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/?p=94316"},"modified":"2019-03-13T11:06:49","modified_gmt":"2019-03-13T18:06:49","slug":"20160915-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20160915-00\/?p=94316","title":{"rendered":"Decoding the parameters of a thrown C++ exception (0xE06D7363), revisited"},"content":{"rendered":"<p>When I explained <a HREF=\"https:\/\/devblogs.microsoft.com\/oldnewthing\/\">how to decode the parameters of a thrown C++ exception<\/a>, I noted that the mysterious second parameter at index 1 &#8220;is a pointer to the object being thrown (sort of).&#8221; <\/p>\n<p>I&#8217;ve since learned more about that mysterious second parameter at index 1: It really is a pointer to the object being thrown, no header or anything. I was faked out because in the crash dumps I looked at, the object being thrown was a pointer to a stack object, so we had two things on the stack (the pointer being thrown, and the object being pointed to), and therefore I could dump my way from one to the other. <\/p>\n<p>Basically, I got lucky. <\/p>\n<p>So that&#8217;s the story of the second parameter. It&#8217;s a pointer to the object being thrown, but if the object being thrown is itself a pointer, then you&#8217;ll have to perform another indirection to find the underlying object. <\/p>\n<p>Here&#8217;s an example from a <code>throw E_FAIL<\/code>: <\/p>\n<pre>\n0:000&gt; .exr 02e0f704\nExceptionAddress: 75dd4878 (KERNELBASE!RaiseException+0x00000048)\n   ExceptionCode: e06d7363 (C++ EH exception)\n  ExceptionFlags: 00000001\nNumberParameters: 3\n   Parameter[0]: 19930520\n   Parameter[1]: 02e0fc6c\n   Parameter[2]: 00d1263c\n0:000&gt; dd 02e0fc6c l1\n02e0fc6c  80004005 \/\/ the thing being thrown is value\n<\/pre>\n<p>And here&#8217;s <code>throw \"oops\"<\/code>: <\/p>\n<pre>\n0:000&gt; .exr 02a6f3e4\nExceptionAddress: 75dd4878 (KERNELBASE!RaiseException+0x00000048)\n   ExceptionCode: e06d7363 (C++ EH exception)\n  ExceptionFlags: 00000001\nNumberParameters: 3\n   Parameter[0]: 19930520\n   Parameter[1]: 02a6f944\n   Parameter[2]: 008d22b0\n0:000&gt; dd 02a6f944 l1\n02a6f944  008d10e0\n\/\/ since the thing being thrown is a pointer, we dump what it points to.\n0:000&gt; da 008d10e0\n008d10e0  \"oops\" \/\/ what it points to\n<\/pre>\n<p><b>Bonus chatter<\/b>: The layout of the mysterious third parameter (index 2) is explained in the <code>ehdata.h<\/code> header file that comes with Visual Studio. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>The mysterious second parameter.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-94316","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"<p>The mysterious second parameter.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/94316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=94316"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/94316\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=94316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=94316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=94316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}