3

I'm trying to reverse a server executable(linux) and I need to find what calls sendmsg. Usually I can just use the xrefs in IDA, but in this case it doesn't show me anything. However, if I set a breakpoint at it I can see it being called when I connect. So my question to you is: how can I find out how the program got to the sendmsg?

  • You can start by attaching a debugger and analysing the stack once you've braked on the sendmsg. – PhoeniX Dec 22 '14 at 8:38
1

If you're breaking at the beginning of sendmsg you can look at the return value on the stack to see where the call came from. As long as no stack frame has been created the return value should be the first thing on the stack above ESP. Take the image below:

enter image description here

Assuming sendmsg is where Bar() is located, the return address would be the location in Foo() after sendmsg was called.

I'm not sure which debugger you're using (would be useful information), but in GDB you can look at the top of the stack (the return value) by using the following command:

(gdb) x/20xw $esp

This technique is useful when following object-oriented code, and xrefs are hard to come by.

Backtrace

Or as suggested by Guntram Blohm you can use a backtrace. In GDB:

(gdb) bt    ; Prints entire backtrace
(gdb) bt n  ; Prints 'n' innermost frames
(gdb) bt -n ; Prints 'n' outermost frames
| improve this answer | |
  • 1
    Or just use the bt command in gdb. – Guntram Blohm supports Monica Dec 22 '14 at 20:40
  • Sometimes I find backtrace overwhelming. Especially if I just want one function back, but for all calls. – RoraΖ Dec 22 '14 at 21:18
0

Breakpoint at the beginning of the function and check the stack for the return address. Or hook your function in c++ for instance and log the _ReturnAddress ()

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.