Advertisement
Guest User

Untitled

a guest
Jul 20th, 2017
45
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.32 KB | None | 0 0
  1. VOID funcC()
  2. {
  3. CONTEXT context = { 0 };
  4. INT count = 0;
  5. STACKFRAME64 stackFrame = { 0 };
  6. DWORD dwMachineType = 0;
  7. VOID* stack[20];
  8.  
  9. RtlCaptureContext(&context);
  10.  
  11. #ifdef _WIN_64
  12. dwMachineType = IMAGE_FILE_MACHINE_AMD64;
  13. stackFrame.AddrPC.Offset = context.Rip;
  14. stackFrame.AddrFame.Offset = context.Rbp;
  15. stackFrame.AddrStack.Offset = context.Rsp;
  16. #else
  17. dwMachineType = IMAGE_FILE_MACHINE_I386;
  18. stackFrame.AddrPC.Offset = context.Eip;
  19. stackFrame.AddrFrame.Offset = context.Ebp;
  20. stackFrame.AddrStack.Offet = context.Esp;
  21. #endif
  22. stackFrame.AddrPC.Mode = AddrModeFlat;
  23. stackFrame.AddrFrame.Mode = AddrModeFlat;
  24. stackFrame.AddrStack.Mode = AddrModeFlat;
  25.  
  26. while ( StackWalk64(dwMachineType,
  27. GetCurrentProcess(),
  28. GetCurrentThread(),
  29. &stackFrame,
  30. &context,
  31. NULL,
  32. SymFunctionTableAccess64,
  33. SymGetModuleBase64,
  34. NULL) )
  35. {
  36. stack[count++] = reinterpret_cast<VOID*>(stackFrame.AddrPC.Offset);
  37. }
  38. }
  39.  
  40. VOID funcB()
  41. {
  42. funcC();
  43. }
  44.  
  45. VOID funcA()
  46. {
  47. funcB();
  48. }
  49.  
  50. int main(int argc, char* argv[])
  51. {
  52. funcA();
  53. }
  54.  
  55. stack[0] : funcB
  56. stack[1] : funcA
  57. stack[2] : main
  58.  
  59. stack[0] : funcC
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement