0

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace.

What are the differences between them?

How does IDA know what the stack trace is? And how does IDA know what the xrefs to a specific function are?

2

x-refs is just a static cross-reference in the binary that can be identified during static-analysis.

So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be sure that it will be in fact called during runtime - there might be some conditional jumps that only call funcA in a certain state.

Stacktrace presents the actual calls at a given point so it's dynamic and might change after another instruction execution.

Stack trace information is gathered by looking at EBP on the stack ref. x-refs are done by analyzing the binary.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.