Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like
SERVER+0x78123
When I return back to IDA to see the code inside the function by getting the 0x78123+10001000 "which is dll start address" from IDA top list I can't see the function. Appreciating your help
When you see a large offset in windbg it is usually suspect
windbg resolves offset based on the nearest symbol
in most of the case where a large offset is seen symbols may not be properly available
and windbg uses the nearest symbol which may not be correct
also optimized binaries have functions chunked but pdbs often have the unchunked offsets which windbg uses and may return improper large offsets
you should use the address instead of symbol+offset and do calculations with address instead of symbol+offset value
for example in the stack below notice the vc__filt+0x12f3 and the warning above the line
the vc__filt+0x12f3 is the return address on the stack which is resolved as
00 0012ff38 004012f3 msvcrt!_controlfp
you should mostly use such resolved address instead of symbol+offset
0:000> k
# ChildEBP RetAddr
00 0012ff38 004012f3 msvcrt!_controlfp
WARNING: Stack unwind information not available. Following frames may be wrong.
01 0012ff88 76faed6c vc__filt+0x12f3
02 0012ff94 77c537eb kernel32!BaseThreadInitThunk+0xe
03 0012ffd4 77c537be ntdll!__RtlUserThreadStart+0x70
04 0012ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
in case you cant resolve manually you can ask windbg to override the local context and access the return address on each frame using the PseudoRegister @$ra
see below the resolved return address for each frame
0:000> .cxr
0:000> .frame /c /r 0 ; ? @$ra
00 0012ff38 004012f3 msvcrt!_controlfp
msvcrt!_controlfp:
778de1e1 8bff mov edi,edi
Evaluate expression: 4199155 = 004012f3 <<<<<<<<<<<<<<<<
0:000> .frame /c /r 1 ; ? @$ra
01 0012ff44 00401237 vc__filt+0x12f3
vc__filt+0x12f3:
004012f3 59 pop ecx
Evaluate expression: 4198967 = 00401237 <<<<<<<<<<
0:000> .frame /c /r 2 ; ? @$ra
02 0012ff88 76faed6c vc__filt+0x1237
vc__filt+0x1237:
00401237 680c304000 push offset vc__filt+0x300c (0040300c)
Evaluate expression: 1996156268 = 76faed6c<<<<<<<
0:000> k
*** Stack trace for last set context - .thread/.cxr resets it
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
02 0012ff88 76faed6c vc__filt+0x1237 <<<<<<<<< return address of last set context
03 0012ff94 77c537eb kernel32!BaseThreadInitThunk+0xe
04 0012ffd4 77c537be ntdll!__RtlUserThreadStart+0x70
05 0012ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
