Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [callstack]

Represent all the active functions in the program at a precise moment. It is composed of a chain of functions where each function has a caller (parent) and a callee (descendant), except for the `main` function which has only a callee, and the last one which has only a caller.

0
votes
1answer
56 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
0
votes
1answer
34 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
0
votes
1answer
167 views

Android Reverse Engineering Network Traffic Stack Trace

Lets say an Android application sends out a traffic out to the server and expects a Json Response Request: https://server:port/userid=user1&token=randomstring7345 We want to replicate the ...
1
vote
1answer
197 views

Why do debuggers sometimes not show entire call stack?

There is something I am not understanding. Why do debuggers sometimes show only part of the call stack? The ones I tried are WinDbg and OllyDbg. Let me explain what I mean. Consider this example: I ...
0
votes
2answers
357 views

Understanding the output of Windbg's `dds esp`

I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
2
votes
2answers
159 views

Any tool for finding IP that a process use/access?

I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the ...
3
votes
2answers
1k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
6
votes
2answers
1k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
1
vote
1answer
207 views

Tracing Callstack Despite Paged out Instructions

REing a binary and while its running (using Windbg by the way) my (call)stack gets mangled. So I start to perform a stack trace [https://msdn.microsoft.com/en-us/library/windows/hardware/ff552143(v=vs....
1
vote
0answers
135 views

How to dump PHP backtrace on live running script in lldb?

I'm trying to print PHP backtrace of the live running script using the following 2 simple steps: Run PHP script as: php -r "sleep(1000);" On another console, I've called directly ...
1
vote
0answers
472 views

Why darwin kernel crashes on function call via lldb while debugging the process?

I wanted to debug the hanging ruby process, but instead my kernel crashes each time when I'm doing the following steps: I'm re-running my ruby script (vagrant) which hangs: $ vagrant destroy -f &...
5
votes
2answers
2k views

Need advice : Reverse engineering a pdf with shellcode

Problem : I try to find the plaintext which was hidden at pdf inbuilt with shellcode What i tried : I received a pdf which contains javascript with it ,i dig the pdf as follows : Exploring ...
5
votes
2answers
242 views

Returning a C function to its grandfather

This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following: Executing function_a Executing ...
1
vote
2answers
173 views

Tracing (“logging”) the stack without setting a breakpoint?

I'm familiar with the concept of backtracing the stack after breaking on a specific instruction. What I wonder about is this: theoretically, a great way to aid oneself in analyzing an application ...
3
votes
1answer
429 views

What do the first 16 bytes on the stack represent?

Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes ...
2
votes
1answer
1k views

Runtime memory reading with injection

I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application. My desired values of that function are: [ESP + 4] which ...
12
votes
2answers
2k views

Detecting recursive functions in IDA

How can I detect/mark recursive functions in IDA? Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
6
votes
2answers
4k views

Break on returning to a specific module

I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
1
vote
0answers
1k views

Getting info for undocumented APIs called by StartServiceCtrlDispatcher

I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
15
votes
1answer
4k views

IDA EBP variable offset

Let's take a look of how IDA displays address of local variable. For instance: MOV EAX, [EBP + var_4] As we all know as far as local variables go, they are located at lower addresses of EBP. Though,...
7
votes
3answers
6k views

buffer overflow exploits - Why is the shellcode put before the return address

The code I'm referring to is found here: Link to code I read that the buffer overflow exploit uses a buffer that looks something like this: | NOP SLED | SHELLCODE | REPEATED RETURN ADDRESS | From ...
6
votes
1answer
373 views

How can I check I've moved outside the stack without triggering a protection fault?

I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...