Posted: Sun Mar 06, 2016 11:27 am Post subject: "Full stack" and "Stack trace"?
Hi there. What does "full stack" and "stack trace" mean when you toggle a breakpoint in the memory viewer? I know a bit about what "stack" is, but what does "full stack" refer to? or which "stack" is CE tracing? What is defference between "full stack" and "stack trace"? Please see the attached file, thanks a lot.
Posted: Sun Mar 06, 2016 12:28 pm Post subject: Re: "Full stack" and "Stack trace"?
fmanager wrote:
Hi there. What does "full stack" and "stack trace" mean when you toggle a breakpoint in the memory viewer? I know a bit about what "stack" is, but what does "full stack" refer to? or which "stack" is CE tracing? What is defference between "full stack" and "stack trace"? Please see the attached file, thanks a lot.
With fullstack you can see all the stack values at a specific breakpoint, starting from esi+0x00.
I use this to check the arguments a function passes to another using cdecl or stdcall convention, because stack trace lists only specific parts of the stack, that give you an overall look at what's happening.
Personally, I prefer full stack view, because it has much more info. _________________
"Full stack" just straight up displays the stack. It gives you the address, how far deep in the stack it is, the value as a DWORD, and CE's guess as to how that value should be interpreted (e.g. pointer, int, float, etc.).
"Stack trace" is basically CE guessing where called subroutines return to. It also shows you possible parameters being passed to the subroutine. I'm not sure if this includes the parameters being passed via registers in a 64-bit process. _________________
I don't know where I'm going, but I'll figure it out when I get there.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum