Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I am studying a Windows x86 binary in windbg. When i debug a function, in can see the call stack with « k » command.
My question is: how works windbg internaly to get this call stack ?
I was thinking it works with ebp register and stack frame.
But some functions does not push esp/ebp in the begining. So how works k command in this case ?
It uses the ebp, esp and eip registers for each stack frame unless you explicitly pass them to the k command yourself. If those registers aren't set correctly then usually you'll get a inaccurate stack trace or nothing at all.
You might find this article to be useful as well.
