Question

我实现了以下函数来获取windows上的当前堆栈：

struct StackFrame
{
    DWORD64 address;
    std::string name;
    std::string module;
};

std::vector<StackFrame> GetStackTrace()
{
    DWORD  machine = IMAGE_FILE_MACHINE_I386;
    HANDLE process = GetCurrentProcess();
    HANDLE thread  = GetCurrentThread();

    STACKFRAME64 frame   = {};
    CONTEXT      context = {};

    if (SymInitialize(process, NULL, TRUE) == FALSE)
    {
        DBG_TRACE(__FUNCTION__ ": Failed to call SymInitialize.");
        return std::vector<StackFrame>(); 
    }

    context.ContextFlags = CONTEXT_FULL;
    RtlCaptureContext(&context);

    #ifdef _M_IX86
        machine                 = IMAGE_FILE_MACHINE_I386;
        frame.AddrPC.Offset     = context.Eip;
        frame.AddrPC.Mode       = AddrModeFlat;
        frame.AddrFrame.Offset  = context.Ebp;
        frame.AddrFrame.Mode    = AddrModeFlat;
        frame.AddrStack.Offset  = context.Esp;
        frame.AddrStack.Mode    = AddrModeFlat;
    #elif _M_X64
        machine                 = IMAGE_FILE_MACHINE_AMD64;
        frame.AddrPC.Offset     = context.Rip;
        frame.AddrPC.Mode       = AddrModeFlat;
        frame.AddrFrame.Offset  = context.Rsp;
        frame.AddrFrame.Mode    = AddrModeFlat;
        frame.AddrStack.Offset  = context.Rsp;
        frame.AddrStack.Mode    = AddrModeFlat;
    #elif _M_IA64
        machine                 = IMAGE_FILE_MACHINE_IA64;
        frame.AddrPC.Offset     = context.StIIP;
        frame.AddrPC.Mode       = AddrModeFlat;
        frame.AddrFrame.Offset  = context.IntSp;
        frame.AddrFrame.Mode    = AddrModeFlat;
        frame.AddrBStore.Offset = context.RsBSP;
        frame.AddrBStore.Mode   = AddrModeFlat;
        frame.AddrStack.Offset  = context.IntSp;
        frame.AddrStack.Mode    = AddrModeFlat;
    #else
    #error "This platform is not supported."
    #endif

    std::vector<StackFrame> frames;
    while (StackWalk64(machine, process, thread, &frame, &context , NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL))
    {
        StackFrame f;
        f.address = frame.AddrPC.Offset;

        DWORD64 moduleBase = SymGetModuleBase64(process, frame.AddrPC.Offset);

        char moduelBuff[MAX_PATH];            
        if (moduleBase && GetModuleFileNameA((HINSTANCE)moduleBase, moduelBuff, MAX_PATH))
        {
            f.module = basename(moduelBuff);
        }
        else
        {
            f.module = "Unknown Module";
        }

        DWORD64 offset = 0;
        char symbolBuff[sizeof(SYMBOL_INFO) + MAX_SYM_NAME * sizeof(TCHAR)];   
        PSYMBOL_INFO symbol = (PSYMBOL_INFO)symbolBuff;

        symbol->SizeOfStruct = sizeof(SYMBOL_INFO);
        symbol->MaxNameLen   = MAX_SYM_NAME;

        if (SymFromAddr(process, frame.AddrPC.Offset, &offset, symbol))
        {
            f.name = symbol->Name;
        }
        else
        {
            DWORD error = GetLastError();
            DBG_TRACE(__FUNCTION__ ": Failed to resolve address 0x%X: %u\n", frame.AddrPC.Offset, error);
            f.name = "Unknown Function";
        }

        frames.push_back(f);
    }

    SymCleanup(process);

    return frames;
}

堆栈遍历似乎按预期工作，我得到的帧数与调试器中的数量相同。此外，SymGetModuleBase64和GetModuleFileName可以正常解析模块名称。

但是对SymFromAddr的调用总是给我一个模块的相同功能。每个地址都不同并测试一些地址，它们看似正确。

PDB使用/ Zi和/ DEBUG生成。

知道我能做些什么才能让它正常工作？

Answer 1

代码没问题，现在已经成功运行了几年。请参阅 dbg.h 以了解功能实现。

事实证明，环境只是无聊。一些模块以奇怪的方式搞砸了。在其他情况下，代码多年来一直完美运行。

StackWalk64似乎可以工作，但SymFromAddr返回虚假名称

1 个答案: