I'm trying to reverse a server executable(linux) and I need to find what calls sendmsg. Usually I can just use the xrefs in IDA, but in this case it doesn't show me anything. However, if I set a breakpoint at it I can see it being called when I connect. So my question to you is: how can I find out how the program got to the sendmsg?

  • You can start by attaching a debugger and analysing the stack once you've braked on the sendmsg.
    – PhoeniX
    Commented Dec 22, 2014 at 8:38

2 Answers 2


If you're breaking at the beginning of sendmsg you can look at the return value on the stack to see where the call came from. As long as no stack frame has been created the return value should be the first thing on the stack above ESP. Take the image below:

enter image description here

Assuming sendmsg is where Bar() is located, the return address would be the location in Foo() after sendmsg was called.

I'm not sure which debugger you're using (would be useful information), but in GDB you can look at the top of the stack (the return value) by using the following command:

(gdb) x/20xw $esp

This technique is useful when following object-oriented code, and xrefs are hard to come by.


Or as suggested by Guntram Blohm you can use a backtrace. In GDB:

(gdb) bt    ; Prints entire backtrace
(gdb) bt n  ; Prints 'n' innermost frames
(gdb) bt -n ; Prints 'n' outermost frames
  • 1
    Or just use the bt command in gdb. Commented Dec 22, 2014 at 20:40
  • Sometimes I find backtrace overwhelming. Especially if I just want one function back, but for all calls.
    – RoraΖ
    Commented Dec 22, 2014 at 21:18

Breakpoint at the beginning of the function and check the stack for the return address. Or hook your function in c++ for instance and log the _ReturnAddress ()

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.