4

I have breakpoint in function 'A', but 'A' can be called by functions 'B' and 'C'. When a breakpoint is hit, i'd like to know what called 'A' in the first place. Is there something like a function call stack?

I have found 'debugger->tracing->stack trace' option, but when i press it after breakpoint is hit, it only shows this, which doesnt make any sense: enter image description here

user2545831
  • 43
  • 1
  • 3
  • This probably means the stack frame hasn't been setup correctly yet, so Ida gets confused. Sometimes it helps to single-step a few instructions. Also, when you're certain you're at the very first instruction in the function, check the top of the stack (the dword at [esp/rsp], depending on whether you're on 32 bit or 64 bit) for the return address. If your assembly code wasn't produced by a compiler, and uses a nonstandard way of handling the stack, this might be the only way. – Guntram Blohm Feb 23 '15 at 22:34

1 Answers1

5

Do a function tracing like this:

  1. set a breakpoint at the main function and at your target function
  2. start debugging
  3. when the process is halted: Go to Debugger->Tracing->Function Tracing
  4. continue Process
  5. once the process is halted again, go to Debugger->Tracing->Tracing Window and check for the info you need.

If this does not give you the needed info try basic block or instruction tracing. This will work even if there is a problem with identifying functions / the stack frame ...

More info on the tracing feature can be found here: hex-rays tutorial on tracing

langlauf.io
  • 1,560
  • 1
  • 19
  • 36
  • Hi @user2545831! If this answer has solved your question please consider accepting it by clicking the check-mark. This indicates to the wider community that you've found a solution and gives some reputation to both the answerer and yourself. In case you have any more questions regarding the answer, do not hesitate to ask them. – langlauf.io Feb 27 '15 at 08:45