1

I am studying a Windows x86 binary in windbg. When i debug a function, in can see the call stack with « k » command.

My question is: how works windbg internaly to get this call stack ?

I was thinking it works with ebp register and stack frame.

But some functions does not push esp/ebp in the begining. So how works k command in this case ?

1 Answer 1

1

It uses the ebp, esp and eip registers for each stack frame unless you explicitly pass them to the k command yourself. If those registers aren't set correctly then usually you'll get a inaccurate stack trace or nothing at all.

You might find this article to be useful as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.