CODEWITHSUNDEEP
c++winapi
Ivan G.
Ivan G.

Reputation: 5225

Tracing Native Calls

This is Win32 related problem and all the code is native.

I have 3 layers compiled as dll libraries depending on each other:

[Module 1] -> [Module 2] -> [Module 3] -> [My Module 4]

Module 1 is an app loading Module 2. Module 2 loads Module 3. Module 3 loads My Module 4.

Whenever a call is made from Module 1 it goes through all layers up to module 4.

In Module 4 I would like to somehow trace that it's called by Module 3 from Module 2 from Module 1 by getting for example HMOUDLE handle for each of them or anything else uniquely identifying them. I can't think of any Win32 API allowing me to perform such a trace, can you advise?

Upvotes: 1

Views: 146

Answers (2)

Bukes
Bukes

Reputation: 3718

Short answer - sort of, but you probably don't want to do this :)

Longish answer - The Debug Help Library can be used to generate a stack trace (via StackWalk64), which you could use in concert with module information retrieved via PSAPI to get what you want.

The basic approach would be to obtain the base address and size of each module in your process, then have a look at the return addresses of each stack frame, matching by range. If all you want to do is determine if a call to a function in module 4 originated from within module 1, this'll get you where you want to be.

Edit: If you've access to symbols to the modules in question, then Steve T's answer is a bit more robust.

Upvotes: 2

Steve Townsend
Steve Townsend

Reputation: 54178

You should be able to use StackWalk64 along with SymFromAddr on the relevant address from the STACKFRAME64 structures of interest. Not quite what you want but cannot think of any other way to get close.

Upvotes: 3

Related Questions