Question

I have a very difficult problem I’m trying to solve: Let’s say I have an arbitrary instruction pointer. I need to find out if that instruction pointer resides in a specific function (let’s call it “Foo”).

One approach to this would be to try to find the start and ending bounds of the function and see if the IP resides in it. The starting bound is easy to find:

    void *start = &Foo;

The problem is, I don’t know how to get the ending address of the function (or how “long” the function is, in bytes of assembly).

Does anyone have any ideas how you would get the “length” of a function, or a completely different way of doing this?

Let’s assume that there is no SEH or C++ exception handling in the function. Also note that I am on a win32 platform, and have full access to the win32 api.

Answer 1

Look at the *.map file which can optionally be generated by the linker when it links the program, or at the program’s debug (*.pdb) file.