CODEWITHSUNDEEP
c++windowsdebugging
mituba
mituba

Reputation: 73

How to retrive the function names from callstack addresses of another process

I'm just curious how does a profiler/debugger work so that they can load the PDBs and get the stacktrace information from another process? Or even from a dump file?

More description:

I have implemented a simple memory tracker, which collects every single memory allocation of my program, get the stacktrace addresses and function names of those, and send to another tool that visualized these.

But I think, resolving stacktrace function names inside my main program isn't a very good idea. This could introduce a significant amount of memory footprint and runtime overhead. Which will mess up my program.

So I wonder if I could just recording those stacktrace addresses inside the main program, and resolve those function names, file names, and line numbers within my debug tools?

I have read windows dbghelp documentations, but didn't really understand what can I do to achieve this.

What I precisely want to know, is the way I can implement the feature in c++ for my debug tool, which can take a call stack frame address comes from another program, and get information about that call stack frame.

Upvotes: 1

Views: 918

Answers (1)

mksteve
mksteve

Reputation: 13085

First they need to know where the modules are loaded from, EnumProcessModules

Then they can use the symbol helper functions in dbghelp to create a "virtual" copy of the process state SymLoadModuleEx

Check around the library which delivers SymLoadModuleEx to see how the symbolic information can be decoded.

What I precisely want to know, is the way I can implement the feature in c++ for my debug tool, which can take a call stack frame address from another program, and get information about that call stack frame.

Yes this is completely possible, from the results of a loaded symbol file, you can resolve the address from the original machine, to a function in a DLL. However, you need to know where the DLL has been loaded in the target process, for this to work.

This could be an extra piece of information from the target process when it initializes, or by using EnumProcessModules.

Upvotes: 0

Related Questions