sh: add dynamic crash base address support