Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- VOID funcC()
- {
- CONTEXT context = { 0 };
- INT count = 0;
- STACKFRAME64 stackFrame = { 0 };
- DWORD dwMachineType = 0;
- VOID* stack[20];
- RtlCaptureContext(&context);
- #ifdef _WIN_64
- dwMachineType = IMAGE_FILE_MACHINE_AMD64;
- stackFrame.AddrPC.Offset = context.Rip;
- stackFrame.AddrFame.Offset = context.Rbp;
- stackFrame.AddrStack.Offset = context.Rsp;
- #else
- dwMachineType = IMAGE_FILE_MACHINE_I386;
- stackFrame.AddrPC.Offset = context.Eip;
- stackFrame.AddrFrame.Offset = context.Ebp;
- stackFrame.AddrStack.Offet = context.Esp;
- #endif
- stackFrame.AddrPC.Mode = AddrModeFlat;
- stackFrame.AddrFrame.Mode = AddrModeFlat;
- stackFrame.AddrStack.Mode = AddrModeFlat;
- while ( StackWalk64(dwMachineType,
- GetCurrentProcess(),
- GetCurrentThread(),
- &stackFrame,
- &context,
- NULL,
- SymFunctionTableAccess64,
- SymGetModuleBase64,
- NULL) )
- {
- stack[count++] = reinterpret_cast<VOID*>(stackFrame.AddrPC.Offset);
- }
- }
- VOID funcB()
- {
- funcC();
- }
- VOID funcA()
- {
- funcB();
- }
- int main(int argc, char* argv[])
- {
- funcA();
- }
- stack[0] : funcB
- stack[1] : funcA
- stack[2] : main
- stack[0] : funcC
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement