IDA: Finding out what calls sendmsg

Question

I'm trying to reverse a server executable(linux) and I need to find what calls sendmsg. Usually I can just use the xrefs in IDA, but in this case it doesn't show me anything. However, if I set a breakpoint at it I can see it being called when I connect. So my question to you is: how can I find out how the program got to the sendmsg?

Answer 1

If you're breaking at the beginning of sendmsg you can look at the return value on the stack to see where the call came from. As long as no stack frame has been created the return value should be the first thing on the stack above ESP. Take the image below:

Assuming sendmsg is where Bar() is located, the return address would be the location in Foo() after sendmsg was called.

I'm not sure which debugger you're using (would be useful information), but in GDB you can look at the top of the stack (the return value) by using the following command:

(gdb) x/20xw $esp

This technique is useful when following object-oriented code, and xrefs are hard to come by.

Backtrace

Or as suggested by Guntram Blohm you can use a backtrace. In GDB:

(gdb) bt    ; Prints entire backtrace
(gdb) bt n  ; Prints 'n' innermost frames
(gdb) bt -n ; Prints 'n' outermost frames

Answer 2

Breakpoint at the beginning of the function and check the stack for the return address. Or hook your function in c++ for instance and log the _ReturnAddress ()