Windows上的StackWalk64 – 获取符号名称

好的，第二个问题就在一天。 看起来Windows编程让我开心…：S

我目前正在试图获取Win32可执行文件的函数调用堆栈。

今天早上，我也问了一个关于这个问题：

Win32 – 从C代码回溯

现在，我很确定StackWalk64函数是这个关键。 我已经阅读了一些关于如何使用它的文章，以及MS文档。

它实际上显示我的testing程序框架，所以它有点工作…

问题是我无法从堆栈信息中检索符号名称。

我正在使用SymGetSymFromAddr64函数与UnDecorateSymbolName 。 但我只有垃圾人物。

这是我的代码。 希望它不要乱，因为我不习惯Windows编程：

 void printStack( void ) { BOOL result; HANDLE process; HANDLE thread; CONTEXT context; STACKFRAME64 stack; ULONG frame; IMAGEHLP_SYMBOL64 symbol; DWORD64 displacement; char name[ 256 ]; RtlCaptureContext( &context ); memset( &stack, 0, sizeof( STACKFRAME64 ) ); process = GetCurrentProcess(); thread = GetCurrentThread(); displacement = 0; stack.AddrPC.Offset = context.Eip; stack.AddrPC.Mode = AddrModeFlat; stack.AddrStack.Offset = context.Esp; stack.AddrStack.Mode = AddrModeFlat; stack.AddrFrame.Offset = context.Ebp; stack.AddrFrame.Mode = AddrModeFlat; for( frame = 0; ; frame++ ) { result = StackWalk64 ( IMAGE_FILE_MACHINE_I386, process, thread, &stack, &context, NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL ); symbol.SizeOfStruct = sizeof( IMAGEHLP_SYMBOL64 ); symbol.MaxNameLength = 255; SymGetSymFromAddr64( process, ( ULONG64 )stack.AddrPC.Offset, &displacement, &symbol ); UnDecorateSymbolName( symbol.Name, ( PSTR )name, 256, UNDNAME_COMPLETE ); printf ( "Frame %lu:\n" " Symbol name: %s\n" " PC address: 0x%08LX\n" " Stack address: 0x%08LX\n" " Frame address: 0x%08LX\n" "\n", frame, symbol.Name, ( ULONG64 )stack.AddrPC.Offset, ( ULONG64 )stack.AddrStack.Offset, ( ULONG64 )stack.AddrFrame.Offset ); if( !result ) { break; } } } 

实际产出是：

 Frame 0: Symbol name: ╠╠╠╠╠╠╠╠╠╠╠╠ PC address: 0x00BA2763 Stack address: 0x00000000 Frame address: 0x0031F7E8 Frame 1: Symbol name: ╠╠╠╠╠╠╠╠╠╠╠╠☺ PC address: 0x00BB4FFF Stack address: 0x00000000 Frame address: 0x0031F940 Frame 2: Symbol name: ╠╠╠╠╠╠╠╠╠╠╠╠☻ PC address: 0x00BB4E2F Stack address: 0x00000000 Frame address: 0x0031F990 Frame 3: Symbol name: ╠╠╠╠╠╠╠╠╠╠╠╠♥ PC address: 0x75BE3677 Stack address: 0x00000000 Frame address: 0x0031F998 Frame 4: Symbol name: ╠╠╠╠╠╠╠╠╠╠╠╠♦ PC address: 0x770F9D72 Stack address: 0x00000000 Frame address: 0x0031F9A4 Frame 5: Symbol name: ╠╠╠╠╠╠╠╠╠╠╠╠♣ PC address: 0x770F9D45 Stack address: 0x00000000 Frame address: 0x0031F9E4 Frame 6: Symbol name: ╠╠╠╠╠╠╠╠╠╠╠╠♠ PC address: 0x770F9D45 Stack address: 0x00000000 Frame address: 0x0031F9E4 

似乎奇怪的堆栈地址总是0的方式…任何帮助表示赞赏：）

谢谢大家！

编辑

我正在寻找一个普通的C解决scheme，没有第三方库…

 typedef struct _IMAGEHLP_SYMBOL64 { DWORD SizeOfStruct; DWORD64 Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; TCHAR Name[1]; } IMAGEHLP_SYMBOL64; 

  const int MaxNameLen = 255; IMAGEHLP_SYMBOL64* pSymbol = malloc(sizeof(IMAGEHLP_SYMBOL64)+MaxNameLen*sizeof(TCHAR)); pSymbol->MaxNameLength = MaxNameLen; 

 #define MY_MAX_SYM_LEN 255 printStack() { struct sym_pack_tag { IMAGEHLP_SYMBOL64 sym; char name[MY_MAX_SYM_LEN]; } sym_pack; IMAGEHLP_SYMBOL64 *symbol = &sym_pack.sym; ... symbol->SizeOfStruct = sizeof(IMAGEHLP_SYMBOL64 ); symbol->MaxNameLength = MY_MAX_SYM_LEN; if (!SymGetSymFromAddr64( process, stack.AddrPC.Offset, &displacement, symbol )) ... 

 __declspec(naked) void WINAPI CaptureContext_X86ControlOnly(CONTEXT *context) { __asm { push ebp mov ebp, esp mov ecx, context //ecx = [ebp + 8] pop ebp //restore old frame pop eax //pop return address pop ecx //pop context as WINAPI needs. Note: ecx will stay the same mov [ecx]CONTEXT.ContextFlags, CONTEXT_CONTROL mov [ecx]CONTEXT.Ebp, ebp mov [ecx]CONTEXT.Eip, eax mov [ecx]CONTEXT.Esp, esp jmp eax } } //I'm writing from my memory - so step through the code above to double check.