I'm trying to reverse a server executable(linux) and I need to find what calls sendmsg. Usually I can just use the xrefs in IDA, but in this case it doesn't show me anything. However, if I set a breakpoint at it I can see it being called when I connect. So my question to you is: how can I find out how the program got to the sendmsg?
If you're breaking at the beginning of
sendmsg you can look at the return value on the stack to see where the call came from. As long as no stack frame has been created the return value should be the first thing on the stack above ESP. Take the image below:
sendmsg is where
Bar() is located, the return address would be the location in
sendmsg was called.
I'm not sure which debugger you're using (would be useful information), but in GDB you can look at the top of the stack (the return value) by using the following command:
(gdb) x/20xw $esp
This technique is useful when following object-oriented code, and xrefs are hard to come by.
Or as suggested by Guntram Blohm you can use a backtrace. In GDB:
(gdb) bt ; Prints entire backtrace (gdb) bt n ; Prints 'n' innermost frames (gdb) bt -n ; Prints 'n' outermost frames