1

I'm familiar with the concept of backtracing the stack after breaking on a specific instruction. What I wonder about is this: theoretically, a great way to aid oneself in analyzing an application would be to let it execute the studied code, then carefully check the stack. As far as I know debuggers will only allow to trace the stack once they actually break on an instruction. This, however, could be problematic in that if I don't know where to place the breakpoint, I'm deprived of this useful technique.

Assume, for example, that I were playing a simple shooting game. After (or maybe before) each shot there would be some math done to calculate the random projectile spread for the weapon. Again, theoretically, if one could just "log" all stack activity done in that period, that could greatly aid analysis.

My questions:

  1. Is that possible?
  2. If the answer to the above is yes, would that be a feasible analysis technique? Given that there's literally tons of code executed all the time in a large, complex application, would it be practically possible to distinguish the studied code from everything else?
Improve this question
3
  • 1
    If you're using IDA Pro, try out the 'funcap' plugin: github.com/deresz/funcap
    – Mick
    Oct 6 '14 at 21:06
  • @MickGrove Thanks, looks nice, I'll give it a shot.
    – user4520
    Oct 6 '14 at 21:48
  • This sounds like something that you could use Intel's pintool to help analyze.
    – BitShifter
    Oct 15 '14 at 19:39
1

A debugger cant read/log the Stack when an application is running and not stepped or paused.

The closest thing to what you wanna do is called tracing and supported by some debuggers like OllyDbg and IDA

Improve this answer
3
  • Depends on the debugging approach used. E.g. Win32 debugging API can read/write memory even while the program is running.
    – Igor Skochinsky ♦
    Oct 14 '14 at 10:34
  • reading memory from a running process is dangerous as it can change during read operation. the stack memory regions change so fast that you need some synchronization/locking when reading it. imho thats only possible by pausing the application, reading stack, step one instruction, read, step, read.....
    – pHiL
    Oct 14 '14 at 10:51
  • Yes, it's definitely not safe (at least for this purpose). I just wanted to point out that your claim that debugger can't read memory while app is running is not totally correct.
    – Igor Skochinsky ♦
    Oct 14 '14 at 11:38
1

The approach you describe is implemented in several profilers, usually under the name sampling profiler. What it usually does is:

  1. periodically (e.g. every 100ms) suspend the application
  2. get the current registers of each thread
  3. perform a quick stack trace using the captured ESP/EIP/EBP
  4. resume the application
  5. after the end of profiling, collate the stack traces, resolve addresses to source code lines, etc.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.