1

I am trying to develop a runtime stack tracer. I have a function that returns the EIP address whenever the program being traced segfaults. How can I get back to the ebp of the current function (the one during which the program under observation crashed) so that I can start tracing up?

2 Answers 2

5

There is no way to convert an instruction pointer to a stack frame pointer. The same function may be invoked many times (even recursively) with different stack addresses; that's the whole point of having a call stack. If you have a crash dump file (core file, etc.) it should contain a dump of all the registers. If you want the register values you must read them from here.

5
  • Shouldn't there be some way to access the return address based on the address of the eip?
    – dave
    Nov 15, 2010 at 17:22
  • No, absolutely not. If it were, recursion would not be possible. Reread my answer and experiment with your favorite recursive function call if you still don't understand. Nov 15, 2010 at 17:51
  • How could I go about accessing the ebp then? Would referencing the symbol table of the program help?
    – dave
    Nov 15, 2010 at 18:35
  • No. If you have a dump of a program that crashed, the register values should be included somewhere in that. If not, there is absolutely no way to find what the value of ebp was. Nov 15, 2010 at 18:52
  • This. For your purposes, the instruction and stack [frame] pointers are essentially independent. Whatever OS you are running on should give you a means to get at ebp in your signal handler, but it won't involve eip. Nov 15, 2010 at 19:15
3

The current ebp and esp (and all other registers) at the time of the segfault is available in the ucontext, which is passed as the third argument to the signal handler. The details of what's where in the ucontext is OS and CPU specific.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.