|
|
Flash Gordon wrote:
> jacob navia wrote, On 28/03/08 21:39:
>
>> 2) See at what offset from the frame pointer is the pushed return
>> address
>
> If there is anything to tell you other than the function prologue. Of
> course the return address might not have been saved to RAM either due to
> function inlining (as an optimisation) or because it did not need to for
> some other reason.
>
Interesting point, if your coding style is anything like mine, you will
have lots of small functions that do get inlined, leaving a pretty
useless call stack
>> 3) The value stored in the saved frame pointer position points to
>> the next frame.
>
> If there is a saved frame pointer. Not all implementations use a
> separate frame pointer.
>
x64 is a prime example, very difficult even for a debugger to work out
the callstack in optimised code.
--
Ian Collins.
|
|