Timeline for Understanding the output of Windbg's `dds esp`
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 9, 2017 at 20:31 | comment | added | blabb | @ForeverLearning you can tell (how does k in windbg or bt in gdb tells it there are heuristics to tell and if symbols are correct the results will be almost always correct and in x64 the unwind information lets anyone decipher the stack correctly) only caveat is you should know that doing dds esp and blindly assuming every symbol is a return address is wrong you need to validate every symbol and discard possible bogus symbols | |
| Oct 9, 2017 at 13:55 | vote | accept | ForeverLearning | ||
| Oct 9, 2017 at 13:55 | comment | added | ForeverLearning |
@IgorSkochinsky blabb answered my confusion below. Basically I wasn't sure if the addresses resolving to a symbol pointing to a Win32 API were real calls to that function with their return addresses pushed on to the stack or just bogus. I guess there is no way to tell?
|
|
| Oct 7, 2017 at 11:18 | answer | added | blabb | timeline score: 2 | |
| Oct 6, 2017 at 22:54 | comment | added | Igor Skochinsky♦ | i think this may be somewhat difficult to answer without some concrete examples. remember that we can't see your screen and don't know what "proper" stack you expected to see. | |
| Oct 6, 2017 at 16:38 | answer | added | peter ferrie | timeline score: 3 | |
| Oct 6, 2017 at 16:33 | history | asked | ForeverLearning | CC BY-SA 3.0 |