Why IDA can't find the function named by windbg

Question

This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like

SERVER+0x78123

When I return back to IDA to see the code inside the function by getting the 0x78123+10001000 "which is dll start address" from IDA top list I can't see the function. Appreciating your help

Answer 1

When you see a large offset in windbg it is usually suspect
windbg resolves offset based on the nearest symbol
in most of the case where a large offset is seen symbols may not be properly available
and windbg uses the nearest symbol which may not be correct

also optimized binaries have functions chunked but pdbs often have the unchunked offsets which windbg uses and may return improper large offsets

you should use the address instead of symbol+offset and do calculations with address instead of symbol+offset value

for example in the stack below notice the vc__filt+0x12f3 and the warning above the line

the vc__filt+0x12f3 is the return address on the stack which is resolved as

00 0012ff38 004012f3 msvcrt!_controlfp

you should mostly use such resolved address instead of symbol+offset

0:000> k
 # ChildEBP RetAddr  
00 0012ff38 004012f3 msvcrt!_controlfp
WARNING: Stack unwind information not available. Following frames may be wrong.
01 0012ff88 76faed6c vc__filt+0x12f3
02 0012ff94 77c537eb kernel32!BaseThreadInitThunk+0xe
03 0012ffd4 77c537be ntdll!__RtlUserThreadStart+0x70
04 0012ffec 00000000 ntdll!_RtlUserThreadStart+0x1b

in case you cant resolve manually you can ask windbg to override the local context and access the return address on each frame using the PseudoRegister @$ra

see below the resolved return address for each frame

0:000> .cxr

0:000> .frame /c /r 0 ; ? @$ra

00 0012ff38 004012f3 msvcrt!_controlfp

msvcrt!_controlfp:
778de1e1 8bff            mov     edi,edi

Evaluate expression: 4199155 = 004012f3 <<<<<<<<<<<<<<<<

0:000> .frame /c /r 1 ; ? @$ra
01 0012ff44 00401237 vc__filt+0x12f3

vc__filt+0x12f3:
004012f3 59              pop     ecx
Evaluate expression: 4198967 = 00401237 <<<<<<<<<<
0:000> .frame /c /r 2 ; ? @$ra
02 0012ff88 76faed6c vc__filt+0x1237

vc__filt+0x1237:
00401237 680c304000      push    offset vc__filt+0x300c (0040300c)

Evaluate expression: 1996156268 = 76faed6c<<<<<<<
0:000> k
  *** Stack trace for last set context - .thread/.cxr resets it
 # ChildEBP RetAddr  
WARNING: Stack unwind information not available. Following frames may be wrong.
02 0012ff88 76faed6c vc__filt+0x1237             <<<<<<<<< return address of last set context
03 0012ff94 77c537eb kernel32!BaseThreadInitThunk+0xe
04 0012ffd4 77c537be ntdll!__RtlUserThreadStart+0x70
05 0012ffec 00000000 ntdll!_RtlUserThreadStart+0x1b