Jump to content
Tuts 4 You

CaptureStackbackTrace


Pancake

Recommended Posts

Hello. I was wondering how can i create a call stack to view the return addresses. So i found that fancy function, it worked prefrectly in one .exe, showing call stack up to ntdll but it does not show full backtrace when called from a hook. Sometimes it prints 1, 2, 3 addresses but i know how that program is working and the call stack is much bigger. The "Call Stack" function from olly shows exactly same not full result but i can view stack and see which address is a return address, but i cant dereference values from the stack to see if its a return address because i would crash on access vioaltion very quickly. How can i make it work properly?


Edited by Pancake
Link to comment
  • 2 weeks later...

but i cant dereference values from the stack to see if its a return address because i would crash on access vioaltion very quickly.

You are on the right track. Handle exceptions.

  • Like 1
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...