2,640
社区成员
发帖
与我相关
我的任务
分享
STACKFRAME64 sf;
memset(&sf, 0, sizeof(sf));
DWORD64 eip, esp, ebp;
eip= pExcPointer->ContextRecord->Eip;
esp = pExcPointer->ContextRecord->Esp;
ebp = pExcPointer->ContextRecord->Ebp;
//初始化stackframe结构
sf.AddrPC.Offset = eip;
sf.AddrPC.Mode = AddrModeFlat;
sf.AddrStack.Offset = esp;
sf.AddrStack.Mode = AddrModeFlat;
sf.AddrFrame.Offset = ebp;
sf.AddrFrame.Mode = AddrModeFlat;
DWORD dwMachineType = IMAGE_FILE_MACHINE_I386;
HANDLE hProcess = GetCurrentProcess();
HANDLE hThread = GetCurrentThread();
BOOL bRet = SymInitialize(hProcess, NULL, NULL);
memset(buf, 0, 256);
//WideCharToMultiByte(CP_ACP, 0, szModuleName, wcslen(szModuleName) + 1, buf, 256, NULL, NULL);
PLOADED_IMAGE pLoadImage;
pLoadImage = ImageLoad(szModuleName, NULL);
DWORD dwLoad = SymLoadModule(hProcess, NULL, szModuleName,NULL, 0, pLoadImage->SizeOfImage);
while(1)
{
//获取下一栈帧
if(!StackWalk64(dwMachineType,
hProcess,
hThread,
&sf,
pExcPointer->ContextRecord,
0,
(PFUNCTION_TABLE_ACCESS_ROUTINE64)SymFunctionTableAccess,
(PGET_MODULE_BASE_ROUTINE64)SymGetModuleBase,
0))
break;
......