Question

I am working on this small project where I’d like to generate the call graph of an application – I am not planning to do anything complex, it is mainly for fun/experience. I am working on x64 platform.

The first goal I set myself is to be able to measure the time spent in each function of my test application. So far my strategy has been to use __penter()_ and __pexit()_ – __penter()_ is a function that will get called at the start of every method or function and conversely __pexit()_ will get called at the end of every method or function.

With these two functions I can record each function call as well as the time spent in each of them. What I’d like to do next is get the address of each function being called.
For example if we consider the following callstack (very simplified):

main()  
....myFunction()  
........_penter()
 

I am in __penter_ and I want to get the address of the calling function, myFunction(). I already found a way to do it in the case of non-leaf functions, I simply use RtlLookupFunctionEntry. However this solution doesn’t seem to work for leaf functions because they don’t provide any unwind data.

One thing I was thinking about is to go up one more level in the callstack, in main(), and decode the CALL procedure manually – that would involve getting a pointer to the instruction calling myFunction().

I was wondering if any of you would know how to get the address of the current function in the case of leaf functions. I have this gut feeling that my current approach is a bit overcomplicated.

Thanks,

Clem

Answer 1

I believe SymGetSymFromAddr64, probably along with StackWalk64 should get you (most of?) what you want.