I'm familiar with the concept of backtracing the stack after breaking on a specific instruction. What I wonder about is this: theoretically, a great way to aid oneself in analyzing an application would be to let it execute the studied code, then carefully check the stack. As far as I know debuggers will only allow to trace the stack once they actually break on an instruction. This, however, could be problematic in that if I don't know where to place the breakpoint, I'm deprived of this useful technique.
Assume, for example, that I were playing a simple shooting game. After (or maybe before) each shot there would be some math done to calculate the random projectile spread for the weapon. Again, theoretically, if one could just "log" all stack activity done in that period, that could greatly aid analysis.
- Is that possible?
- If the answer to the above is yes, would that be a feasible analysis technique? Given that there's literally tons of code executed all the time in a large, complex application, would it be practically possible to distinguish the studied code from everything else?